feat(rust): add function-local-use policy lint (#402)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>

Author: yordis

rsworkspace/crates/a2a-auth-callout/src/credentials/mtls/tests.rs

@@ -1,3 +1,5 @@
+use rcgen::{BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, KeyPair};
+
 use super::*;
 
 #[test]
@@ -13,8 +15,6 @@ fn rejects_empty_trust_bundle() {
 
 #[tokio::test]
 async fn verifies_rcgen_chain() {
-    use rcgen::{BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, KeyPair};
-
     let ca_key = KeyPair::generate().expect("ca key");
     let mut ca_dn = DistinguishedName::new();
     ca_dn.push(DnType::CommonName, "test-ca");
@@ -44,8 +44,6 @@ async fn verifies_rcgen_chain() {
 
 #[tokio::test]
 async fn rejects_wrong_anchor() {
-    use rcgen::{BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, KeyPair};
-
     let unrelated_key = KeyPair::generate().expect("k");
     let mut unrelated_dn = DistinguishedName::new();
     unrelated_dn.push(DnType::CommonName, "other-ca");

rsworkspace/crates/a2a-auth-callout/src/dispatcher/tests.rs

@@ -1,5 +1,6 @@
 use super::*;
 use crate::account_resolver::StaticAccountResolver;
+use crate::bridge_mint::{BridgeClientInfo, BridgeMintRequest};
 use crate::credentials::api_key::{ApiKey, ApiKeyEntry, ApiKeyRegistry, HmacApiKeyVerifier};
 use crate::credentials::mtls::ClientCertPem;
 use crate::credentials::oidc::BearerToken;
@@ -147,8 +148,6 @@ async fn dispatch_infers_oidc_when_user_jwt_present() {
 
 #[tokio::test]
 async fn dispatch_mtls_when_cert_present() {
-    use crate::bridge_mint::{BridgeClientInfo, BridgeMintRequest};
-
     let mtls: Arc<dyn MTlsVerifier> = Arc::new(StubMtlsVerifier);
     let d = dispatcher_with(None, Some(mtls), None, &["tenant-acme"]);
     let req = ServerAuthRequestClaims::from_bridge_mint(BridgeMintRequest {

rsworkspace/crates/a2a-auth-callout/src/error/tests.rs

@@ -12,7 +12,6 @@ fn display_connect() {
 
 #[test]
 fn display_subscribe() {
-    use std::error::Error;
     let e = AuthCalloutError::Subscribe(async_nats::SubscribeError::new(
         async_nats::SubscribeErrorKind::InvalidSubject,
     ));

rsworkspace/crates/a2a-auth-callout/tests/nats_server_callout_integration.rs

@@ -9,6 +9,7 @@
 //! would let this harness move back behind the abstraction.
 #![allow(clippy::expect_used, clippy::unwrap_used, clippy::panic)]
 
+use std::net::{IpAddr, Ipv4Addr};
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
@@ -33,6 +34,7 @@ use jsonwebtoken::jwk::{
 };
 use jsonwebtoken::{Algorithm, EncodingKey, Header, encode};
 use rand::rngs::OsRng;
+use rcgen::{BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, KeyPair, SanType};
 use rsa::RsaPrivateKey;
 use rsa::pkcs8::EncodePrivateKey;
 use rsa::traits::PublicKeyParts;
@@ -571,10 +573,6 @@ struct TlsFixture {
 }
 
 fn write_tls_fixture() -> TlsFixture {
-    use std::net::{IpAddr, Ipv4Addr};
-
-    use rcgen::{BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, KeyPair, SanType};
-
     let dir = tempfile::tempdir().expect("tls tempdir");
     let cert_dir = dir.path().join("certs");
     std::fs::create_dir_all(&cert_dir).expect("certs dir");

rsworkspace/crates/a2a-bridge/src/auth/callout_mint.rs

@@ -9,6 +9,23 @@ use async_trait::async_trait;
 use super::{AuthMintWire, BytesPayload};
 use crate::error::BridgeError;
 
+#[cfg(test)]
+use a2a_auth_callout::StaticAccountResolver;
+#[cfg(test)]
+use a2a_auth_callout::credentials::oidc::{BearerToken, OidcVerifier};
+#[cfg(test)]
+use a2a_auth_callout::dispatcher::{CalloutDispatcher, CalloutDispatcherConfig};
+#[cfg(test)]
+use a2a_auth_callout::jwt::{AudienceAccount, CallerId, ExternalSubject, SpiceDbPrincipal, UserJwtClaims};
+#[cfg(test)]
+use a2a_auth_callout::permissions::IssuedPermissions;
+#[cfg(test)]
+use a2a_auth_callout::signing_key_source::{KeyVersion, SigningKeySource, StaticSigningKeySource};
+#[cfg(test)]
+use serde_json::json;
+#[cfg(test)]
+use std::time::Duration;
+
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct BridgeTenantAccount(String);
 
@@ -80,17 +97,6 @@ impl AuthMintWire for InProcessCalloutDispatcherMintWire {
 
 #[cfg(test)]
 pub(crate) fn harness_callout_dispatcher(caller_id: &str) -> a2a_auth_callout::dispatcher::CalloutDispatcher {
-    use std::sync::Arc;
-    use std::time::Duration;
-
-    use a2a_auth_callout::StaticAccountResolver;
-    use a2a_auth_callout::credentials::oidc::{BearerToken, OidcVerifier};
-    use a2a_auth_callout::dispatcher::{CalloutDispatcher, CalloutDispatcherConfig};
-    use a2a_auth_callout::jwt::{AudienceAccount, CallerId, ExternalSubject, SpiceDbPrincipal, UserJwtClaims};
-    use a2a_auth_callout::permissions::IssuedPermissions;
-    use a2a_auth_callout::signing_key_source::{KeyVersion, SigningKeySource, StaticSigningKeySource};
-    use serde_json::json;
-
     struct HarnessOidcVerifier {
         caller_id: CallerId,
     }

rsworkspace/crates/a2a-nats-http/src/rest.rs

@@ -15,6 +15,7 @@ use a2a::types::{
     ListTaskPushNotificationConfigsRequest, ListTasksRequest, SendMessageRequest, TaskPushNotificationConfig,
 };
 use a2a_nats::client::{A2aClient, ClientError};
+use a2a_nats::error::*;
 use a2a_nats::task_id::A2aTaskId;
 use axum::Json;
 use axum::extract::{Path, Query, State};
@@ -415,7 +416,6 @@ pub(crate) fn rest_error_response(err: &ClientError) -> Response {
 }
 
 pub(crate) fn http_status_for_jsonrpc_code(code: i32) -> StatusCode {
-    use a2a_nats::error::*;
     match code {
         TASK_NOT_FOUND => StatusCode::NOT_FOUND,
         TASK_NOT_CANCELABLE => StatusCode::CONFLICT,

rsworkspace/crates/a2a-nats-http/src/runtime.rs

@@ -6,6 +6,27 @@
 use a2a_identity_types::JwtError;
 use a2a_nats::{A2aPrefixError, AgentIdError};
 
+#[cfg(not(coverage))]
+use std::net::SocketAddr;
+
+#[cfg(not(coverage))]
+use a2a_identity_types::MintedUserJwt;
+#[cfg(not(coverage))]
+use a2a_nats::client::A2aClient;
+#[cfg(not(coverage))]
+use a2a_nats::{A2aAgentId, A2aPrefix, Config, NatsConfig};
+#[cfg(not(coverage))]
+use tracing::info;
+#[cfg(not(coverage))]
+use trogon_nats::jetstream::NatsJetStreamClient;
+#[cfg(not(coverage))]
+use trogon_std::env::SystemEnv;
+#[cfg(not(coverage))]
+use trogon_std::signal::shutdown_signal;
+
+#[cfg(not(coverage))]
+use crate::router;
+
 #[cfg_attr(coverage, allow(dead_code))]
 const DEFAULT_BIND: &str = "0.0.0.0:8080";
 #[cfg_attr(coverage, allow(dead_code))]
@@ -45,18 +66,6 @@ fn env_flag<E: trogon_std::env::ReadEnv>(env: &E, key: &str) -> bool {
 
 #[cfg(not(coverage))]
 pub async fn run() -> Result<(), RuntimeError> {
-    use std::net::SocketAddr;
-
-    use a2a_identity_types::MintedUserJwt;
-    use a2a_nats::client::A2aClient;
-    use a2a_nats::{A2aAgentId, A2aPrefix, Config, NatsConfig};
-    use tracing::info;
-    use trogon_nats::jetstream::NatsJetStreamClient;
-    use trogon_std::env::SystemEnv;
-    use trogon_std::signal::shutdown_signal;
-
-    use crate::router;
-
     let env = SystemEnv;
 
     let raw_prefix = trogon_std::env::ReadEnv::var(&env, a2a_nats::ENV_A2A_PREFIX)

rsworkspace/crates/a2a-nats-http/src/tests.rs

@@ -13,6 +13,9 @@ use trogon_nats::AdvancedMockNatsClient;
 use trogon_nats::jetstream::mocks::MockJetStreamConsumerFactory;
 
 use crate::router;
+use crate::runtime::RuntimeError;
+use crate::sse::client_error_to_jsonrpc_code;
+use a2a_nats::client::ClientError;
 
 fn test_config() -> A2aPrefix {
     A2aPrefix::new("a2a".to_string()).unwrap()
@@ -368,7 +371,6 @@ async fn push_set_not_supported_maps_to_correct_error_code() {
 
 #[test]
 fn runtime_error_display_shows_env_var_name() {
-    use crate::runtime::RuntimeError;
     assert_eq!(
         RuntimeError::MissingAgentId.to_string(),
         "A2A_AGENT_ID environment variable is required"
@@ -430,9 +432,6 @@ async fn agent_routed_subject_unanswered_when_gateway_routing_enabled() {
 
 #[test]
 fn client_error_to_jsonrpc_code_maps_known_errors() {
-    use crate::sse::client_error_to_jsonrpc_code;
-    use a2a_nats::client::ClientError;
-
     assert_eq!(client_error_to_jsonrpc_code(&ClientError::TaskNotFound).0, -32001);
     assert_eq!(client_error_to_jsonrpc_code(&ClientError::TaskNotCancelable).0, -32002);
     assert_eq!(

rsworkspace/crates/a2a-nats-server/src/main.rs

@@ -7,19 +7,28 @@
 //! `cfg(not(coverage))` because `trogon-nats::NatsJetStreamClient` is
 //! excluded during coverage runs.
 
+#[cfg(not(coverage))]
+use a2a_nats::jetstream::{StreamProvisionOptions, provision_streams_with_options};
+#[cfg(not(coverage))]
+use a2a_nats::nats_connect_timeout;
+#[cfg(not(coverage))]
+use a2a_nats::server::Bridge;
+#[cfg(not(coverage))]
+use a2a_nats_server::NoopHandler;
+#[cfg(not(coverage))]
+use a2a_nats_server::runtime::{RuntimeError, parse_env};
+#[cfg(not(coverage))]
+use tokio_util::sync::CancellationToken;
+#[cfg(not(coverage))]
+use tracing::{error, info};
+#[cfg(not(coverage))]
+use trogon_nats::jetstream::NatsJetStreamClient;
+#[cfg(not(coverage))]
+use trogon_std::env::SystemEnv;
+
 #[cfg(not(coverage))]
 #[tokio::main]
 async fn main() {
-    use a2a_nats::jetstream::{StreamProvisionOptions, provision_streams_with_options};
-    use a2a_nats::nats_connect_timeout;
-    use a2a_nats::server::Bridge;
-    use a2a_nats_server::NoopHandler;
-    use a2a_nats_server::runtime::{RuntimeError, parse_env};
-    use tokio_util::sync::CancellationToken;
-    use tracing::{error, info};
-    use trogon_nats::jetstream::NatsJetStreamClient;
-    use trogon_std::env::SystemEnv;
-
     tracing_subscriber::fmt::init();
 
     let env = SystemEnv;

rsworkspace/crates/a2a-nats-stdio/src/runtime.rs

@@ -9,6 +9,20 @@ use a2a_nats::{A2aAgentId, A2aPrefix, A2aPrefixError, AgentIdError, DEFAULT_A2A_
 use trogon_nats::connect::ConnectError;
 use trogon_std::env::ReadEnv;
 
+#[cfg(not(coverage))]
+use a2a_nats::client::A2aClient;
+#[cfg(not(coverage))]
+use a2a_nats::{Config, apply_timeout_overrides, nats_connect_timeout};
+#[cfg(not(coverage))]
+use trogon_nats::jetstream::NatsJetStreamClient;
+#[cfg(not(coverage))]
+use trogon_std::env::SystemEnv;
+#[cfg(not(coverage))]
+use trogon_std::signal::shutdown_signal;
+
+#[cfg(not(coverage))]
+use crate::io_loop::run_io_loop;
+
 pub(crate) const ENV_A2A_AGENT_ID: &str = "A2A_AGENT_ID";
 
 #[derive(Debug, thiserror::Error)]
@@ -63,14 +77,6 @@ pub fn parse_env<E: ReadEnv>(env: &E) -> Result<ValidatedStdioConfig, RuntimeErr
 /// `RuntimeError` on env validation failure; connect-and-pump is in main.rs.
 #[cfg(not(coverage))]
 pub async fn run() -> Result<(), RuntimeError> {
-    use a2a_nats::client::A2aClient;
-    use a2a_nats::{Config, apply_timeout_overrides, nats_connect_timeout};
-    use trogon_nats::jetstream::NatsJetStreamClient;
-    use trogon_std::env::SystemEnv;
-    use trogon_std::signal::shutdown_signal;
-
-    use crate::io_loop::run_io_loop;
-
     let env = SystemEnv;
     let validated = parse_env(&env)?;