diff --git a/.github/workflows/internal-deps.yml b/.github/workflows/internal-deps.yml
new file mode 100644
index 000000000..6d5c55066
--- /dev/null
+++ b/.github/workflows/internal-deps.yml
@@ -0,0 +1,331 @@
+name: Internal dependencies
+
+# Every internal Git dependency names `branch = "main"`, and Cargo.lock picks
+# the commit CI builds and Fabro ships. Each night this job moves the lock to
+# the current main of each internal library with `cargo update -p`, then runs
+# the Linux test suite from rust.yml against it, so drift is noticed without
+# anyone asking. A passing lock goes to one pull request from
+# `bot/internal-deps`, opened or updated here and never merged here. A failure
+# opens one tracking issue labeled `internal-deps`, or comments on the open
+# one; the next passing run closes it. Nothing is pushed to main.
+
+on:
+ schedule:
+ - cron: "17 6 * * *"
+ workflow_dispatch:
+
+# Never cancel a run midway: the report and pull request jobs must see how
+# the check ended.
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: false
+
+permissions: {}
+
+env:
+ CARGO_TERM_COLOR: always
+ CARGO_NET_RETRY: "10"
+
+jobs:
+ check:
+ name: Test (Linux)
+ runs-on: ubuntu-24.04-x86-32-cores
+ timeout-minutes: 60
+ permissions:
+ contents: read
+ outputs:
+ changed: ${{ steps.update.outputs.changed }}
+ summary: ${{ steps.update.outputs.summary }}
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+ with:
+ toolchain: 1.97.1
+ - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+ with:
+ cache-on-failure: true
+ - uses: taiki-e/install-action@773334c0e05d7e699e4d78234494308223f3a2cf # nextest
+ # One package per internal repository: updating one package from a Git
+ # repository moves every package from that repository. daytona-sdk comes
+ # through sandbox-driver, but its repository is separate, so it moves on
+ # its own. The summary names each repository whose locked commit moved,
+ # for the job summary, the pull request, and the tracking issue.
+ - name: Update internal dependencies
+ id: update
+ env:
+ INTERNAL_CRATES: sandbox-driver pebble-agent petri-runtime lithos-llm twin-openai daytona-sdk
+ run: |
+ set -euo pipefail
+ cp Cargo.lock "$RUNNER_TEMP/Cargo.lock.before"
+ args=()
+ for crate in $INTERNAL_CRATES; do
+ args+=(-p "$crate")
+ done
+ cargo update "${args[@]}" 2>&1 | tee "$RUNNER_TEMP/cargo-update.log"
+
+ python3 - "$RUNNER_TEMP/Cargo.lock.before" Cargo.lock > "$RUNNER_TEMP/summary.md" <<'PY'
+ import re
+ import sys
+ import tomllib
+
+ SOURCE = re.compile(r"git\+https://github\.com/([^?#]+?)(?:\.git)?\?[^#]*#([0-9a-f]+)$")
+
+ def commits(path):
+ found = {}
+ with open(path, "rb") as lock:
+ for package in tomllib.load(lock).get("package", []):
+ match = SOURCE.match(package.get("source", ""))
+ if match:
+ found.setdefault(match[1], set()).add(match[2])
+ return found
+
+ before, after = commits(sys.argv[1]), commits(sys.argv[2])
+ rows = []
+ for repo in sorted(set(before) | set(after)):
+ old, new = sorted(before.get(repo, ())), sorted(after.get(repo, ()))
+ if old == new:
+ continue
+ if len(old) == 1 and len(new) == 1:
+ moved = f"[`{old[0][:7]}...{new[0][:7]}`](https://github.com/{repo}/compare/{old[0]}...{new[0]})"
+ else:
+ moved = " ".join(f"`{c[:7]}`" for c in old) + " -> " + " ".join(f"`{c[:7]}`" for c in new)
+ rows.append(f"| `{repo}` | {moved} |")
+ if rows:
+ print("| Repository | Commits |\n|---|---|")
+ print("\n".join(rows))
+ else:
+ print("No internal commit moved.")
+ PY
+ {
+ echo
+ echo "cargo update output
"
+ echo
+ echo '```'
+ cat "$RUNNER_TEMP/cargo-update.log"
+ echo '```'
+ echo
+ echo "