[botandbang]

What and why

cargo remove cleans up the root Cargo.toml after every removal and deletes each [profile.*.package.<name>] whose crate isn't a direct dependency of some member (gc_workspace in remove.rs, since rust-lang/cargo#11194, Cargo 1.67). Six of our dev-profile entries are for transitive crates (inout, hybrid-array, clap_builder, referencing, symphonia-core, symphonia-codec-pcm), so any cargo remove deletes them with their comments. It happens on every cargo from 1.95 to nightly 1.101. Patches had the same bug and were fixed in rust-lang/cargo#12454; profiles weren't.

Added:

• A rule in tools/policy/cargo.rego with the crates the dev profile optimises (dev_optimised). It fails when one of them is still in Cargo.lock but its [profile.dev.package.*] entry is gone, and when Cargo.toml has an entry the list doesn't have. A crate that leaves Cargo.lock doesn't trip it.
• Tests for both cases and for a crate leaving the lockfile, with a lockfile in the policy fixtures.
• A note in .github/CONTRIBUTING.md under Checks on how to put the entries back.

Changed:

• tools/policy.sh gives conftest Cargo.lock as Cargo.lock.toml, since conftest picks its parser by extension.
• .github/NEW_PROJECT.md's summary of the policies mentions the new one.

Fixes LOC-135

How it was tested

• tools/policy.sh on main: OPA 63/63 with coverage complete, conftest 43/43.
• With the Cargo.toml a real cargo remove -p locallibrary-cli --dev walkdir left behind, conftest fails with exactly the 6 put back [profile.dev.package.X] failures.
• Each rule broken once (drop & locked, invert not dev_packages[name], invert not name in dev_optimised): the matching new test fails, then passes restored.
• shellcheck tools/policy.sh, and oxfmt --check on the two .github docs.

Checklist

• Tests cover the change
• The READMEs, docs/ and --help still say what the code does

[linear-code]

LOC-135

[github-actions]

Size

Compared with main. KiB are 1,024 bytes.

	This pull request	main	Change
Client JavaScript	635.1 KiB	635.1 KiB	0 B (0%)
Client JavaScript, brotli	209.5 KiB	209.5 KiB	0 B (0%)
Client CSS	88.6 KiB	88.6 KiB	0 B (0%)
Client CSS, brotli	12.7 KiB	12.7 KiB	0 B (0%)