From f4e9fb8ab2f52d10e6ae5877e0a1259ad43eeb23 Mon Sep 17 00:00:00 2001
From: Thomas Jiang <thomasjiangcy@gmail.com>
Date: Sat, 9 May 2026 17:16:57 +0800
Subject: [PATCH] chore: improve dependency maintenance

---
 .github/dependabot.yml   |  5 +++++
 .github/workflows/ci.yml | 15 +++++++++++++--
 CONTRIBUTING.md          |  6 ++++++
 Cargo.toml               |  3 +++
 README.md                | 12 +++++++++++-
 deny.toml                | 32 ++++++++++++++++++++++++++++++++
 justfile                 | 14 ++++++++++----
 lefthook.yml             |  2 +-
 mise.toml                |  2 ++
 9 files changed, 83 insertions(+), 8 deletions(-)
 create mode 100644 deny.toml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d69dd82..d04ffad 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,11 @@ updates:
       time: "06:00"
       timezone: "UTC"
     versioning-strategy: "auto"
+    groups:
+      cargo-patch-minor:
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "github-actions"
     directory: "/"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5b899c..66bbb46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,18 @@ jobs:
         run: cargo fmt --all --check
 
       - name: Lint
-        run: cargo clippy --all-targets --all-features -- -D warnings
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
+
+      - name: Install dependency tooling
+        uses: taiki-e/install-action@v2.77.2
+        with:
+          tool: cargo-deny@0.19.4,cargo-machete@0.9.2
+
+      - name: Dependency policy
+        run: cargo deny check
+
+      - name: Unused dependencies
+        run: cargo machete
 
       - name: Test
-        run: cargo test --all-targets --all-features
+        run: cargo test --locked --all-targets --all-features
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1fc2284..ef4df14 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -8,6 +8,8 @@ Thanks for contributing. This guide focuses on the fastest path to ship safe cha
 - `mise`
 - `just`
 - `lefthook`
+- `cargo-deny` (installed by `mise install`)
+- `cargo-machete` (installed by `mise install`)
 
 ## Setup
 
@@ -29,6 +31,10 @@ just lint
 # test
 just test
 
+# dependency policy and unused dependency checks
+just deps-check
+just deps-unused
+
 # full local gate (required before PR)
 just ci
 
diff --git a/Cargo.toml b/Cargo.toml
index fb372ac..c0c47ff 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,6 +2,9 @@
 name = "pkgrep"
 version = "0.7.0"
 edition = "2024"
+description = "Dependency source cache helper for developers and coding agents"
+license = "MIT"
+repository = "https://github.com/thomasjiangcy/pkgrep"
 
 [dependencies]
 anyhow = "1.0.102"
diff --git a/README.md b/README.md
index 8d901ee..c19680f 100644
--- a/README.md
+++ b/README.md
@@ -310,6 +310,8 @@ Prerequisites:
 - `mise` (required for project tooling)
 - `just` (required task runner)
 - `lefthook` (required for git hook checks)
+- `cargo-deny` (installed by `mise install`)
+- `cargo-machete` (installed by `mise install`)
 
 ### Tooling via mise
 
@@ -323,6 +325,8 @@ Common development commands:
 ```bash
 just fmt
 just lint
+just deps-check
+just deps-unused
 just test
 just ci
 just hooks-run
@@ -331,7 +335,13 @@ just hooks-run
 Git hooks:
 
 - `pre-commit`: no-mocks policy + `cargo fmt --check`
-- `pre-push`: clippy (`-D warnings`) + full test suite
+- `pre-push`: full `just ci` gate
+
+Dependency maintenance:
+
+- Dependabot checks Cargo and GitHub Actions daily.
+- `just deps-check` runs `cargo-deny` for advisories, license policy, duplicate versions, and allowed sources.
+- `just deps-unused` runs `cargo-machete` to detect unused direct dependencies.
 
 ### Maintainer Release Flow
 
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..f884b3d
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,32 @@
+[advisories]
+version = 2
+db-path = "~/.cargo/advisory-db"
+db-urls = ["https://github.com/rustsec/advisory-db"]
+yanked = "deny"
+ignore = []
+
+[licenses]
+version = 2
+confidence-threshold = 0.8
+allow = [
+    "0BSD",
+    "Apache-2.0",
+    "BSD-3-Clause",
+    "CDLA-Permissive-2.0",
+    "ISC",
+    "MIT",
+    "MPL-2.0",
+    "Unicode-3.0",
+    "Unlicense",
+    "Zlib",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+highlight = "all"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
diff --git a/justfile b/justfile
index e4ff1b6..fac8acb 100644
--- a/justfile
+++ b/justfile
@@ -10,13 +10,19 @@ fmt-check:
     cargo fmt --all --check
 
 lint:
-    cargo clippy --all-targets --all-features -- -D warnings
+    cargo clippy --locked --all-targets --all-features -- -D warnings
 
 check:
-    cargo check --all-targets --all-features
+    cargo check --locked --all-targets --all-features
 
 test:
-    cargo test --all-targets --all-features
+    cargo test --locked --all-targets --all-features
+
+deps-check:
+    cargo deny check
+
+deps-unused:
+    cargo machete
 
 test-no-mocks:
     ./.dev/check_no_mocks.sh
@@ -27,4 +33,4 @@ hooks-install:
 hooks-run:
     lefthook run pre-commit && lefthook run pre-push
 
-ci: fmt-check lint test-no-mocks test
+ci: fmt-check lint deps-check deps-unused test-no-mocks test
diff --git a/lefthook.yml b/lefthook.yml
index 7ec7209..817d8be 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -9,4 +9,4 @@ pre-commit:
 pre-push:
   commands:
     ci:
-      run: cargo clippy --all-targets --all-features -- -D warnings && cargo test --all-targets --all-features -q
+      run: mise exec -- just ci
diff --git a/mise.toml b/mise.toml
index 9a067cd..442faea 100644
--- a/mise.toml
+++ b/mise.toml
@@ -2,3 +2,5 @@
 rust = "stable"
 just = "latest"
 lefthook = "latest"
+"cargo:cargo-deny" = "0.19.4"
+"cargo:cargo-machete" = "0.9.2"