The first thing CI caught, on its first run, in the commit that added it.
`runway-caldav` depended on serde and never mentioned it. `runway-cli`
depended on tracing while using tracing-subscriber, which is a different
crate; the subscriber stays.
I had run `cargo machete` before committing the workflow and reported it
clean. It was not: the tool prints a paragraph of advice about ignoring false
positives *when it finds something*, and I had tailed the output, seen that
paragraph and "Done!", and cut the two findings off the top. So the check I
claimed to have made was the one thing I had not made.
Which is a decent argument for the guardrail existing. v1 shipped reqwest,
ical, regex and indexed_db_futures into a WASM bundle that used none of them,
and it shipped them because nobody was looking -- not because looking was hard.
connor
d156b4eb15