fix: use cargo-machete to clean up unused dependencies

Author: iamquang95

.githooks/pre-push

@@ -8,6 +8,12 @@ if ! cargo deny check; then
     exit 1
 fi
 
+# Unused dependency check
+if ! cargo machete; then
+    echo "❌ Unused dependencies detected (run 'cargo machete')"
+    exit 1
+fi
+
 # Formatting check
 if ! cargo +nightly fmt --all -- --check; then
     echo "❌ Formatting issues (run 'cargo +nightly fmt --all')"

.github/workflows/dependency-audit.yml

@@ -30,5 +30,11 @@ jobs:
       - name: Install `cargo-deny`
         run: cargo install cargo-deny@0.19.0
 
+      - name: Install `cargo-machete`
+        run: cargo install cargo-machete@0.9.2
+
       - name: Run `cargo-deny` audit
         run: cargo deny check
+
+      - name: Run `cargo-machete`
+        run: cargo machete

CONTRIBUTING.md

@@ -10,7 +10,7 @@ The easiest way to set up the development environment is using [Nix](https://nix
 nix develop
 ```
 
-This automatically provides all required dependencies (Rust toolchain, Protobuf, oas3-gen, cargo-deny) and configures git hooks.
+This automatically provides all required dependencies (Rust toolchain, Protobuf, oas3-gen, cargo-deny, cargo-machete) and configures git hooks.
 
 ### Manual Setup
 
@@ -20,6 +20,7 @@ If you prefer not to use Nix, install the following manually:
 * [Protobuf](https://protobuf.dev/installation/)
 * [Docker](https://www.docker.com/)
 * [cargo-deny](https://github.com/EmbarkStudios/cargo-deny) - `cargo install cargo-deny@0.19.0`
+* [cargo-machete](https://github.com/bnjbvr/cargo-machete) - `cargo install cargo-machete@0.9.2`
 * [oas3-gen](https://github.com/eklipse2k8/oas3-gen) - `cargo install oas3-gen@0.24.0`
 
 Then install the pre-push git hook:

Cargo.lock

@@ -94,8 +94,8 @@ oas3-gen-support = "0.24"
 bon = "3.8"
 testcontainers = "0.27"
 test-case = "3.3"
-ethereum_ssz = { version = "0.10" }
-ethereum_ssz_derive = { version = "0.10" }
+ssz = { package = "ethereum_ssz", version = "0.10" }
+ssz_derive = { package = "ethereum_ssz_derive", version = "0.10" }
 tree_hash = "0.12"
 tree_hash_derive = "0.12"
 tar = "0.4"

Cargo.toml

@@ -10,17 +10,14 @@ publish.workspace = true
 backon.workspace = true
 chrono.workspace = true
 pluto-core.workspace = true
-pluto-tracing.workspace = true
 pluto-eth2api.workspace = true
-anyhow.workspace = true
 tokio.workspace = true
 tokio-util.workspace = true
 prost.workspace = true
 prost-types.workspace = true
 regex.workspace = true
 thiserror.workspace = true
 tracing.workspace = true
-tracing-subscriber.workspace = true
 url.workspace = true
 reqwest.workspace = true
 serde.workspace = true

crates/app/Cargo.toml

@@ -26,7 +26,6 @@ pluto-relay-server.workspace = true
 pluto-tracing.workspace = true
 pluto-core.workspace = true
 pluto-p2p.workspace = true
-pluto-eth2api.workspace = true
 pluto-eth2util.workspace = true
 pluto-k1util.workspace = true
 pluto-ssz.workspace = true

crates/cli/Cargo.toml

@@ -8,12 +8,9 @@ publish.workspace = true
 
 [dependencies]
 async-trait.workspace = true
-ethereum_ssz.workspace = true
 cancellation.workspace = true
 chrono.workspace = true
 crossbeam.workspace = true
-futures.workspace = true
-futures-timer.workspace = true
 dyn-clone.workspace = true
 dyn-eq.workspace = true
 hex.workspace = true
@@ -25,16 +22,15 @@ prost-types.workspace = true
 regex.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-serde_with.workspace = true
 base64.workspace = true
 thiserror.workspace = true
 tokio.workspace = true
 tokio-util.workspace = true
 tracing.workspace = true
 pluto-eth2util.workspace = true
 pluto-ssz.workspace = true
+ssz.workspace = true
 tree_hash.workspace = true
-unsigned-varint.workspace = true
 
 [dev-dependencies]
 anyhow.workspace = true

crates/core/Cargo.toml

@@ -12,7 +12,6 @@ hex.workspace = true
 pluto-eth2api.workspace = true
 rand.workspace = true
 rand_core.workspace = true
-serde.workspace = true
 thiserror.workspace = true
 
 [lints.rust]

crates/crypto/Cargo.toml

@@ -6,6 +6,11 @@ repository.workspace = true
 license.workspace = true
 publish.workspace = true
 
+[package.metadata.cargo-machete]
+# `oas3-gen` writes `src/client.rs` and `src/types.rs` during build; these
+# dependencies are used by that generated code but absent in a fresh checkout.
+ignored = ["bon", "http", "oas3-gen-support", "regex", "reqwest", "validator"]
+
 [dependencies]
 anyhow.workspace = true
 bon.workspace = true
@@ -20,8 +25,8 @@ thiserror.workspace = true
 chrono.workspace = true
 hex.workspace = true
 validator.workspace = true
-ethereum_ssz.workspace = true
-ethereum_ssz_derive.workspace = true
+ssz.workspace = true
+ssz_derive.workspace = true
 tree_hash.workspace = true
 tree_hash_derive.workspace = true
 alloy.workspace = true