Repository navigation
Add Nix tooling: flake, devshell, crane checks, CI, stub Cargo workspace - #2
Closed
patextreme wants to merge 17 commits into
Closed
patextreme wants to merge 17 commits into
patextreme wants to merge 17 commits into
Conversation
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
The repository ruleset requires DCO and CodeQL status checks, but the workflows were missing. This adds both so pushes can succeed on protected branches. Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
Signed-off-by: Pat Losoponkul <[email protected]>
patextreme
marked this pull request as draft
June 30, 2026 10:32
Bootstrap reproducible Nix development environment and check/CI guardrails for the sdk-rust submodule (OpenSpec change: add-nix-tooling). - flake.nix (flake-parts + devshell + rust-overlay + crane), systems: x86_64-linux, aarch64-darwin - nix/rust-toolchain.nix: stable toolchain (rust-src, rust-analyzer, wasm32-unknown-unknown) + shared craneLib - nix/devshells/default.nix: sdk-rust devshell (rust, C toolchain, cargo-nextest/deny/audit, nix hygiene tools) - nix/checks: lint-nix + crane rust-fmt/clippy/test/deny/audit sharing one buildDepsOnly cargoArtifacts derivation - nix/apps: format (cargo fmt + nixfmt) and format-nix - deny.toml: cargo-deny policy (advisories/licenses/bans/sources) - stub Cargo workspace: root Cargo.toml + crates/identus-ssi placeholder (edition 2024, MSRV 1.85.0, resolver 3, workspace lints) - .github/workflows/nix-checks.yml: matrix (ubuntu/macos) nix flake check - Remove the broken repo-local .github/workflows/dco.yml (unresolvable christophebedard/dco action + typo'd harden-runner SHA). Sibling submodules (e.g. neoprism) carry no repo-local DCO workflow; DCO is enforced at the org level by the cncf/dco2 status check, which passes on signed-off commits. - README: document nix develop workflow Signed-off-by: Pat Losoponkul <[email protected]>
- Remove broken .github/workflows/codeql.yml: CodeQL does not support Rust (its python analysis is useless here) and the harden-runner SHA was a typo. Sibling submodules (e.g. neoprism) use Scorecard, not CodeQL. This also clears the yamllint trailing-newline failure. - markdownlint: ignore .pi/** (agent tooling scaffolding) and openspec/** (OpenSpec-managed artifacts use a format that conflicts with MD041 first-line-h1). - README: add `text` language to the workflow diagram fence (MD040). - AGENTS: add a blank line before a list (MD032). Signed-off-by: Pat Losoponkul <[email protected]>
7 of 19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bootstrap reproducible Nix development environment and check/CI guardrails for the
sdk-rustsubmodule (OpenSpec change:add-nix-tooling).This is a greenfield submodule: previously there was no
flake.nixand noCargo.toml. This PR establishes the reproducible environment and the check/CI guardrails that all subsequent feature proposals will rely on, plus a stub Cargo workspace the checks operate on.What's included
flake-parts+devshell+rust-overlay+crane), systems:x86_64-linux,aarch64-darwin.nix/rust-toolchain.nix): stable toolchain withrust-src,rust-analyzer,wasm32-unknown-unknowntarget + a sharedcraneLib.nix/devshells/default.nix, namesdk-rust): rust, C toolchain (stdenv.cc,pkg-config,openssl),cargo-nextest/cargo-deny/cargo-audit, protobuf, and Nix hygiene tools (nixfmt,deadnix,statix).nix/checks/):lint-nix(deadnix/statix/nixfmt) + cranerust-fmt/rust-clippy(-D warnings) /rust-test(cargo-nextest) /rust-deny/rust-audit(pinnedadvisory-db), sharing onebuildDepsOnlycargoArtifacts derivation.nix run .#format(cargo fmt + nixfmt) andnix run .#format-nix.deny.toml: cargo-deny policy (advisories / licenses / bans / sources), permissive.Cargo.toml(resolver = "3",edition = "2024", MSRV1.85.0, workspace lints) +crates/identus-ssiplaceholder..github/workflows/nix-checks.yml— matrixubuntu-latest/macos-latest, installs Nix via DeterminateSystems, runsnix flake check; all third-party actions pinned to commit SHAs.nix developworkflow.Verification
nix develop -c cargo build,cargo test,cargo fmt --check,cargo clippy -- -D warningsall pass.nix flake checkgreen onx86_64-linux;aarch64-darwinoutputs (checks/apps/devShells) evaluate cleanly (darwin build runs in CI).nix run .#format/nix run .#format-nixverified.Notes
🤖 Generated with the help of pi