[eersnington]

Add pipboy hygiene. It runs cargo deny and cargo shear on the merge base and the PR, then diffs the findings. Neither tool compiles anything.

• Fail only on new findings in advisories, licenses, and sources. Bans and unused dependencies are reported only. Existing findings never fail a PR.
• Finding keys leave out the crate version, so a routine bump of an already flagged crate is not new.
• Add deny.toml with the license allow-list from rivet-dev/rivet and its ring clarify entry.
• Run only when *.rs, Cargo.*, deny.toml, or rust-toolchain.toml change.

pnpm --filter pipboy pipboy hygiene --base-root ../base --out hygiene.json

---

This is part 2 of 4 in a stack:

•  4  ci(pipboy): add per-commit CI trace command #2063
•  3  ci(pipboy): add native binary sizes #2062
•  2  ci(pipboy): add rust dependency hygiene #2061 👈
•  1  ci(pipboy): add package footprint #2060

[github-actions]

📟 Pip-Boy · 79fded0

📦 Packages · fresh npm install resolve, no lockfile · this PR vs base

No notable install size, dependency, or entrypoint changes across 6 packages.

All 6 packages · linux-x64-gnu

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/agentos-core	458.2 MB	458.2 MB	458.2 MB	0	121 (0)
@rivet-dev/agentos-node-pty	7.6 KB	18.0 KB	18.0 KB	0	1 (0)
@rivet-dev/agentos-posix	253.6 MB	253.6 MB	253.6 MB	0	7 (0)
@rivet-dev/agentos-runtime-core	253.6 MB	253.6 MB	253.6 MB	0	6 (0)
@rivet-dev/agentos-sandbox	495.5 MB	495.5 MB	495.5 MB	0	177 (0)
@rivet-dev/agentos-toolchain	130.8 KB	141.2 KB	141.2 KB	0	2 (0)

🧹 Rust dependencies · cargo deny + cargo shear

check	new in this PR	fixed	existing on base
advisories	✅ 0	0	26
licenses	✅ 0	499	0
sources	✅ 0	0	0
bans	✅ 0	0	0
unused	✅ 0	0	16

🦀 Binaries

❌ The native job failed. See the run. It produced no report.

⏱ Timing

job	wall time	slowest step
zizmor	9s	Set up job · 2s
changes	25s	checkout · 21s
hygiene	52s	checkout · 25s
self-test	25s	Run pnpm --filter pipboy test · 7s
❌ native · linux-x64-gnu	31s	Build with the publish Dockerfile · 24s
footprint	1m42s	Pack this commit · 26s
report	17s	setup-node · 4s

🔭 Full CI trace for this commit

One OpenTelemetry trace of CI and Pip-Boy for 79fded0: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha 79fded0f85dc392b8b10a94ea19722daec349df9

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/agentos checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.