From c4817a9518e64544e006a5152fde8ce1a812fdd0 Mon Sep 17 00:00:00 2001
From: BinFlip <code@binflip.rs>
Date: Wed, 2 Sep 2026 19:48:01 -0700
Subject: [PATCH] fix: drop path-patched crates from Cargo.lock, gate publish
 in CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`cargo publish` for v0.5.0 failed: the committed `Cargo.lock` carried sixteen
entries for unrelated sibling crates (analysir, dotscope, nimrod, …). They come
from a `[patch.crates-io]` block in a parent `.cargo/config.toml` on the
machine the lock was last written on, and cargo strips them in any other
checkout — which leaves the working directory dirty and makes `cargo publish`
refuse.

The lock is regenerated outside that config. No dependency versions change;
only the phantom entries go.

Adds a `Package` CI job running `cargo publish --dry-run`, which performs the
same git-cleanliness and packaging checks as a real publish. The existing jobs
(test, clippy, fmt, doc) all passed on the release commit, so nothing caught
this before the release workflow ran.
---
 .github/workflows/ci.yml | 12 ++++++++
 Cargo.lock               | 64 ----------------------------------------
 2 files changed, 12 insertions(+), 64 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca53716..ade5aa7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,6 +43,18 @@ jobs:
           components: rustfmt
       - run: cargo fmt --check
 
+  package:
+    name: Package
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      # Runs the same git-cleanliness and packaging checks as a real publish,
+      # so a release cannot be the first thing to discover them. `cargo
+      # publish` refuses when the checkout is dirty, which a `Cargo.lock`
+      # written under a `[patch]`-bearing parent `.cargo/config.toml` will be.
+      - run: cargo publish --dry-run
+
   doc:
     name: Docs
     runs-on: ubuntu-latest
diff --git a/Cargo.lock b/Cargo.lock
index 2d8086a..d11ab85 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -228,67 +228,3 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
  "windows-link",
 ]
-
-[[patch.unused]]
-name = "analysir"
-version = "0.1.0"
-
-[[patch.unused]]
-name = "analyssa"
-version = "0.6.0"
-
-[[patch.unused]]
-name = "autoit-rs"
-version = "0.1.1"
-
-[[patch.unused]]
-name = "darwinscope"
-version = "0.1.1"
-
-[[patch.unused]]
-name = "dotscope"
-version = "0.9.0"
-
-[[patch.unused]]
-name = "innospect"
-version = "0.1.3"
-
-[[patch.unused]]
-name = "mallabel"
-version = "0.1.0"
-
-[[patch.unused]]
-name = "nimrod"
-version = "0.3.1"
-
-[[patch.unused]]
-name = "nsis"
-version = "0.4.0"
-
-[[patch.unused]]
-name = "pascalscript"
-version = "0.1.2"
-
-[[patch.unused]]
-name = "securs-abi"
-version = "0.1.0"
-
-[[patch.unused]]
-name = "securs-fleet"
-version = "0.1.0"
-
-[[patch.unused]]
-name = "securs-spec"
-version = "0.1.0"
-
-[[patch.unused]]
-name = "securs-wg"
-version = "0.1.0"
-
-[[patch.unused]]
-name = "undelphi"
-version = "0.3.2"
-
-[[patch.unused]]
-name = "visualbasic"
-version = "0.3.1"