Cargo.toml

[package]
name = "echidnabot"
version = "0.1.0"
edition = "2021"
license = "MPL-2.0"
description = "Proof-aware CI bot that orchestrates ECHIDNA for theorem proof verification"
repository = "https://github.com/hyperpolymath/echidnabot"
keywords = ["theorem-prover", "formal-verification", "ci", "bot", "echidna"]
categories = ["development-tools", "science"]
authors = ["Jonathan D.A. Jewell <jonathan.jewell@open.ac.uk>"]
readme = "README.adoc"

[lib]
name = "echidnabot"
path = "src/lib.rs"

[[bin]]
name = "echidnabot"
path = "src/main.rs"

# Note: the previous `echidnabot-mcp` standalone bin was retired
# 2026-04-25 when the BoJ-only-MCP exception was sunset (BoJ revived,
# cartridge `consultant_qa` activated). MCP traffic now routes through
# `boj-server/cartridges/echidna-llm-mcp`; see echidnabot Phase 6
# (commit 4a7871c) for the BoJ-routed call path.

[dependencies]
# Fleet coordination
gitbot-shared-context = { version = "0.1.0", git = "https://github.com/hyperpolymath/gitbot-fleet", rev = "40ef6bf1a43813948476d33c764e3405adc950c2" }

# ECHIDNA trust kernel. Canonical trust-level algorithm and source-level
# axiom scanner, shared with ECHIDNA so echidnabot no longer re-implements
# them. Pinned by full rev (immutable). At this rev the crate is still named
# `echidna-core-spark`; it is being renamed `echidna-core-creusot` upstream,
# and the trust types are meant to move into `echidna-core` proper. Follow-up:
# re-point this line once that lands on echidna `main` (see
# docs/ECHIDNA-INTEGRATION.adoc).
echidna-core-spark = { git = "https://github.com/hyperpolymath/echidna", rev = "b761b3a832981be51d4e88076ef1b90fe5037e9c" }

# Minimum-version handshake with the ECHIDNA server.
semver = "1"


# Async runtime
tokio = { version = "1", features = ["full"] }

# HTTP framework
axum = { version = "0.8", features = ["macros"] }
tower = "0.5"
tower-http = { version = "0.7", features = ["cors", "trace", "request-id"] }

# GraphQL
async-graphql = { version = "7", features = ["uuid", "chrono"] }
async-graphql-axum = "7"

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"
toml = "1.1"

# Database
# NOTE: `default-features = false` + explicit re-add of `macros`/`migrate`
# mirrors echidnabot#46 (chore(deps): trim sqlx default-features) —
# preserve forward-compat so a #46/#OTel merge doesn't churn this line.
sqlx = { version = "0.8.1", default-features = false, features = ["runtime-tokio-rustls", "sqlite", "postgres", "uuid", "chrono", "macros", "migrate"] }

# GitHub API. Use Octocrab's AWS-LC JWT backend instead of its default
# `rust_crypto` backend, which currently pulls the unfixed rsa 0.9 timing
# advisory (RUSTSEC-2023-0071).
octocrab = { version = "0.54", default-features = false, features = [
    "default-client",
    "follow-redirect",
    "jwt-aws-lc-rs",
    "retry",
    "rustls",
    "rustls-ring",
    "timeout",
    "tracing",
] }

# HTTP client (for ECHIDNA communication)
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }

# Utilities
async-trait = "0.1"
# v7 for records, v8 for content ids; minted only in src/ids.rs.
uuid = { version = "1.10", features = ["v7", "v8", "serde"] }
# RFC 8785 (JCS) canonical bytes for src/ids.rs content ids. The estate
# crate hyperpolymath/ijson-jcs is not public, so a public build cannot
# depend on it; swap once it is (docs/ECHIDNA-INTEGRATION.adoc).
serde_json_canonicalizer = "0.3"
chrono = { version = "0.4", features = ["serde"] }
thiserror = "2"
anyhow = "1"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }

# OpenTelemetry distributed tracing — exports span data via OTLP/gRPC
# to any OTel-compatible collector (Jaeger, Tempo, Honeycomb, etc.).
# Enable by setting `OTEL_EXPORTER_OTLP_ENDPOINT` or [observability]
# `otlp_endpoint` in echidnabot.toml. When unset, only the fmt layer
# is installed, so logs continue to work without a collector.
opentelemetry = { version = "0.33", features = ["trace"] }
opentelemetry-otlp = { version = "0.33", features = ["grpc-tonic", "trace"] }
opentelemetry_sdk = { version = "0.33", features = ["rt-tokio", "trace"] }
tracing-opentelemetry = "0.34"

rand = "0.10"

# Crypto for webhook verification
hmac = "0.13"
sha2 = "0.11"
hex = "0.4"

# CLI
clap = { version = "4", features = ["derive", "env"] }

# Config
config = "0.15"

# Filesystem utilities
tempfile = "3"

# URL encoding for GitLab/Bitbucket APIs
urlencoding = "2"

[dev-dependencies]
criterion = { version = "0.8", features = ["html_reports"] }
tokio-test = "0.4"
axum-test = "21"
mockall = "0.15"
tempfile = "3"
wiremock = "0.6"
proptest = "1"

[profile.release]
lto = true
codegen-units = 1
strip = true

# Packaging metadata for cargo-deb
[package.metadata.deb]
maintainer = "hyperpolymath <packages@hyperpolymath.dev>"
copyright = "2025, hyperpolymath"
license-PMPL--1.0 = ["LICENSE", "0"]
extended-description = """
ECHIDNABOT is a proof-aware CI bot that orchestrates ECHIDNA for theorem
proof verification. It integrates with GitHub to automatically verify
formal proofs in pull requests.
"""
depends = "$auto, openssl"
section = "devel"
priority = "optional"
assets = [
    ["target/release/echidnabot", "usr/bin/", "755"],
    ["README.adoc", "usr/share/doc/echidnabot/README.adoc", "644"],
]

# Packaging metadata for cargo-generate-rpm
[package.metadata.generate-rpm]
assets = [
    { source = "target/release/echidnabot", dest = "/usr/bin/echidnabot", mode = "755" },
    { source = "README.adoc", dest = "/usr/share/doc/echidnabot/README.adoc", mode = "644" },
]

[package.metadata.generate-rpm.requires]
openssl = "*"