feat: add cargo-aprz and cargo-ensure-no-default-features

[Martin Taillefer (geeknoid)]

Summary

Migrates two standalone tools into this repo, and fixes several repo-wide issues found along the way.

New crates

• cargo-aprz / cargo-aprz-lib — dependency approval and reporting tool, split into a thin binary over a library so doc2readme can generate its README.
• cargo-ensure-no-default-features — validates that dependencies declare default-features = false.

Both are adapted to repo conventions: workspace-inherited package fields, workspace dependencies with features declared per-crate, anvil-managed lint sentinels, Microsoft copyright headers, and design docs.

Notable details:

• cargo-aprz-lib gets a build script declaring the all_tables / all_fields cfgs, so unexpected_cfgs stays quiet without editing the anvil-managed check-cfg list.
• The network_tests feature is replaced with #[ignore]. just test and just clippy both pass --all-features, so the feature would have made CI run ~24 minutes of live-network tests. They still compile (so clippy lints them) and run with --run-ignored all.
• kstring is pinned to 2.0.2 — 2.0.3+ requires rustc 1.96, above our MSRV of 1.95. Reached transitively via gix-attributes → gix → rustsec.
• deny.toml allows RUSTSEC-2024-0436 (unmaintained paste, via cel-interpreter, no safe upgrade) and CDLA-Permissive-2.0 (webpki-root-certs, via reqwest's rustls backend).

Normalizing cargo-ensure-no-cyclic-deps

Its directory (cargo_ensure_no_cyclic_deps) did not match its package name, which produced dead links in the root README and in its own published repository / homepage metadata. Renamed the directory to match, and brought the crate in line with the others: workspace-inherited dependencies, authors and homepage; shared logo and favicon; docs.rs metadata.

Root documentation fixes

• README.md listed only 4 of the 7 tools built here — it now lists all of them.
• CHANGELOG.md linked to 22 crates from the oxidizer repo, none of which exist here, so every link was dead. It now links to this repo's changelogs.
• Added the missing cargo-each changelog.
• add-crate.ps1 now preserves existing changelog links verbatim instead of rebuilding them from package names, so a future directory/package mismatch cannot silently break them.

Binary file handling

.zst, .gz and other binary formats fell through to the catch-all * text eol=lf rule in .gitattributes, so Git rewrote CRLF byte pairs inside them. This was not hypothetical — the staged rustdoc JSON fixture had already been truncated from 46,200 to 46,197 bytes, which would not have decompressed.

• Marked compressed and binary formats -text and moved them into LFS.
• Set lfs: true on all CI checkouts, via the cargo-anvil templates for the generated workflows, so LFS-stored test fixtures are not checked out as pointer files. Regeneration is idempotent (anvil --dry-run reports no pending changes).
• Documented git lfs install --local as a setup step in DEVELOPMENT.md.

Validation

All run locally against the full workspace:

Gate	Result
cargo build --workspace --all-features --all-targets	pass
cargo clippy --workspace --all-targets --all-features	0 warnings
cargo nextest run --workspace --all-features	1361 passed, 30 skipped
cargo test --doc --workspace --all-features	pass
cargo doc --workspace --no-deps --all-features (nightly)	0 warnings
cargo fmt --all --check (nightly)	pass
cargo sort --check --grouped --workspace	pass
cargo heather	354/354
cargo deny --all-features --workspace check all	all ok
cargo spellcheck	clean
just readme-check	pass
cargo check-external-types (nightly)	pass

Pre-existing and unrelated: the cargo-anvil::schemas tests taplo_validates_emitted_toml_files and actionlint_validates_emitted_workflows fail locally with Permission denied (os error 13) when spawning their validators. They were excluded from the local run above; CI should exercise them normally.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[github-actions]

⚠️ Breaking Changes Detected

error: failed to retrieve local crate data from git revision

Caused by:
    0: failed to retrieve manifest file from git revision source
    1: possibly due to errors: [
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/crates/cargo_ensure_no_cyclic_deps/tests/fixtures/with_self_dev_dep/Cargo.toml: no `package` table,
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/crates/cargo_ensure_no_cyclic_deps/tests/fixtures/without_cycle/Cargo.toml: no `package` table,
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/Cargo.toml: no `package` table,
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/crates/cargo-anvil/tests/fixtures/customized/Cargo.toml: no `package` table,
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/crates/cargo_ensure_no_cyclic_deps/tests/fixtures/with_cycle/Cargo.toml: no `package` table,
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/crates/cargo-anvil/tests/fixtures/opt-outs/Cargo.toml: no `package` table,
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/crates/cargo-anvil/tests/fixtures/migration/Cargo.toml: no `package` table,
         failed to parse /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17/crates/cargo_ensure_no_cyclic_deps/tests/fixtures/with_dev_cycle/Cargo.toml: no `package` table,
       ]
    2: package `cargo-aprz-lib` not found in /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/012d2124056156320ceeb904595feef7780e9b17

Stack backtrace:
   0: <anyhow::Error>::msg::<alloc::string::String>
   1: <cargo_semver_checks::rustdoc_gen::RustdocFromProjectRoot>::get_crate_source
   2: <cargo_semver_checks::rustdoc_gen::StatefulRustdocGenerator<cargo_semver_checks::rustdoc_gen::CoupledState>>::prepare_generator
   3: <cargo_semver_checks::Check>::check_release::{closure#5}
   4: <cargo_semver_checks::Check>::check_release
   5: cargo_semver_checks::exit_on_error::<cargo_semver_checks::Report, cargo_semver_checks::main::{closure#5}>
   6: cargo_semver_checks::main
   7: std::sys::backtrace::__rust_begin_short_backtrace::<fn(), ()>
   8: main
   9: <unknown>
  10: __libc_start_main
  11: _start

If the breaking changes are intentional then everything is fine - this message is merely informative.

Remember to apply a version number bump with the correct severity when publishing a version with breaking changes (1.x.x -> 2.x.x or 0.1.x -> 0.2.x).

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

❌ Patch coverage is 99.98490% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 99.9%. Comparing base (0b690f1) to head (abddbb1).

Files with missing lines	Patch %	Lines
crates/cargo-aprz-lib/src/commands/config.rs	99.6%	1 Missing ⚠️

❌ Your project status has failed because the head coverage (99.9%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff            @@
##             main     #76      +/-   ##
=========================================
- Coverage   100.0%   99.9%    -0.1%     
=========================================
  Files          58     135      +77     
  Lines        3277   17449   +14172     
=========================================
+ Hits         3277   17448   +14171     
- Misses          0       1       +1     

Flag	Coverage Δ
linux	99.9% <99.9%> (-0.1%)	⬇️
linux-arm	99.9% <99.9%> (-0.1%)	⬇️
scheduled	?
windows	99.9% <99.9%> (-0.1%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.