ci(branch-checks): run Rust checks in Nix shells

.config/nextest.toml

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[profile.ci]
+fail-fast = false
+status-level = "fail"
+final-status-level = "fail"
+failure-output = "immediate-final"

.github/workflows/branch-checks.yml

@@ -99,114 +99,72 @@ jobs:
         run: mise run rust:deny:policy
 
   rust:
-    name: Rust (${{ matrix.runner }})
+    name: Rust (${{ matrix.system }})
     needs: pr_metadata
     if: needs.pr_metadata.outputs.should_run == 'true'
     strategy:
       fail-fast: false
       matrix:
-        runner: [linux-amd64-cpu8, linux-arm64-cpu8]
+        include:
+          - runner: linux-amd64-cpu8
+            system: x86_64-linux
+          - runner: linux-arm64-cpu8
+            system: aarch64-linux
+          - runner: macos-15-xlarge
+            system: aarch64-darwin
     runs-on: ${{ matrix.runner }}
-    env:
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_GHA_VERSION: branch-checks-rust-${{ matrix.runner }}
-    container:
-      image: ghcr.io/nvidia/openshell/ci:latest
-      credentials:
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
+    defaults:
+      run:
+        shell: nix develop .#devShells.${{ matrix.system }}.default -c bash -euo pipefail {0}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Configure GHA sccache backend
-        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install tools
-        run: mise install --locked
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: openshell
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Realize Nix development shell
+        shell: bash
+        run: nix build --no-link ".#devShells.${{ matrix.system }}.default"
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          # Keep branch-check caches partitioned by runner architecture; lint
+          # Keep branch-check caches partitioned by target system; lint
           # and test intentionally share the same job-local target directory.
-          shared-key: rust-checks-${{ matrix.runner }}
+          shared-key: rust-checks-${{ matrix.system }}
           # Preserve compiled artifacts from failed lint/test runs so the next
           # push to the same PR branch does not start from a cold cache.
           cache-on-failure: "true"
+          cache-workspace-crates: "true"
+          cache-bin: "false"
+          cmd-format: nix develop .#devShells.${{ matrix.system }}.default -c {0}
 
       - name: Format
-        run: mise run rust:format:check
-
-      - name: Lint
-        run: mise run rust:lint
-
-      - name: Test
-        run: mise run test:rust
-
-      - name: Verify telemetry can be compiled out
-        run: mise run rust:verify:telemetry-off
-
-      - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
-        run: mise run rust:verify:system-ca-roots
-
-      - name: sccache stats
-        if: always()
         run: |
-          set +e
-          stats_bin="${SCCACHE_PATH:-sccache}"
-          "$stats_bin" --show-stats
-          status=$?
-          if [ "$status" -ne 0 ]; then
-            echo "::warning::sccache stats unavailable (exit $status)"
-          fi
-          exit 0
-
-  rust-macos:
-    name: Rust lint (macOS)
-    needs: pr_metadata
-    if: needs.pr_metadata.outputs.should_run == 'true'
-    runs-on: macos-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install mise
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf https://mise.run | MISE_VERSION=v2026.4.25 sh
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH"
-
-      - name: Configure GHA sccache backend
-        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
+          cargo fmt --all -- --check
+          cargo fmt --manifest-path e2e/rust/Cargo.toml --all -- --check
+          cargo fmt --manifest-path examples/governance-interceptor/Cargo.toml --all -- --check
 
-      - name: Install Rust and Clippy
+      - name: Lint
         run: |
-          mise install --locked rust
-          rustup component add clippy
-
-      - name: Cache Rust target and registry
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          shared-key: rust-clippy-macos
-          cache-on-failure: "true"
+          cargo clippy --workspace --all-targets -- -D warnings
+          cargo clippy --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings
+          cargo check --manifest-path examples/governance-interceptor/Cargo.toml --all-targets
 
-      - name: Lint macOS-sensitive crates
-        # Formatting is target-independent and already checked by the Linux jobs.
-        # The full mise lint covers every workspace/E2E target and requires extra
-        # native dependencies such as Z3; keep this guard focused on macOS cfgs.
+      - name: Test
+        env:
+          OPENSHELL_TELEMETRY_ENABLED: "false"
         run: |
-          cargo clippy \
-            -p openshell-sandbox \
-            -p openshell-core \
-            -p openshell-cli \
-            -p openshell-driver-db-credstore \
-            -p openshell-driver-docker \
-            -p openshell-driver-kubernetes \
-            -p openshell-driver-kubernetes-secrets \
-            -p openshell-driver-podman \
-            -p openshell-driver-vault \
-            --all-targets \
-            -- -D warnings
+          cargo nextest run --profile ci --workspace --exclude openshell-server
+          cargo test --doc --workspace --exclude openshell-server
+          cargo nextest run --profile ci -p openshell-server --features test-support
+          cargo test --doc -p openshell-server --features test-support
 
   python:
     name: Python (${{ matrix.runner }})

flake.nix

@@ -4,6 +4,13 @@
 {
   description = "OpenShell development environment";
 
+  nixConfig = {
+    extra-substituters = [ "https://openshell.cachix.org" ];
+    extra-trusted-public-keys = [
+      "openshell.cachix.org-1:OAr5MunsfH5PZvUsfD08OtGx5RtcwdNZGJdU5FqLm5w="
+    ];
+  };
+
   inputs = {
     flake-utils.url = "github:numtide/flake-utils";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
@@ -33,34 +40,52 @@
           inherit system;
           overlays = [ (import rust-overlay) ];
         };
+        commonDevShellPackages = with pkgs; [
+          cargo-nextest
+          # Assemble Debian artifacts on macOS and Linux.
+          dpkg
+          # Required to find packages.
+          pkg-config
+          # Coverage.
+          lcov
+        ];
         treefmtEval = treefmt-nix.lib.evalModule pkgs {
           projectRootFile = "flake.nix";
           programs.nixfmt.enable = true;
         };
         rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+        z3-static = pkgs.callPackage ./nix/pkgs/z3-static.nix { };
+        aws-lc-static = pkgs.callPackage ./nix/pkgs/aws-lc-static.nix { };
         testGuest = import ./nix/test-guest { inherit pkgs; };
       in
       {
         apps.test-guest = testGuest.app;
         apps.test-guest-cache = testGuest.cacheApp;
 
-        devShells.default = pkgs.mkShell {
-          packages = with pkgs; [
-            rustToolchain
-            # Assemble Debian artifacts on macOS and Linux.
-            dpkg
-            # Required to find packages
-            pkg-config
-            # Required for bindgen generation.
-            llvmPackages.libclang
-            # system dependency for openshell-prover
-            z3
-            # Coverage
-            lcov
-          ];
-
-          env = {
-            LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
+        devShells = {
+          default =
+            (pkgs.mkShell.override {
+              stdenv =
+                if pkgs.stdenv.hostPlatform.isLinux then
+                  pkgs.stdenvAdapters.useMoldLinker pkgs.stdenv
+                else
+                  pkgs.stdenv;
+            })
+              {
+                packages = [
+                  rustToolchain
+                  z3-static
+                  aws-lc-static
+                ]
+                ++ commonDevShellPackages;
+              };
+        }
+        // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
+          glibc-2-28 = import ./nix/devShells/glibc-2-28.nix {
+            inherit pkgs rust-overlay commonDevShellPackages;
+          };
+          musl = import ./nix/devShells/musl.nix {
+            inherit pkgs rust-overlay commonDevShellPackages;
           };
         };
 

nix/devShells/glibc-2-28.nix

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{
+  pkgs,
+  rust-overlay,
+  commonDevShellPackages,
+}:
+
+let
+  toolchain = import ../toolchains/linux-gnu-2.28 { inherit pkgs; };
+  z3-static = pkgs.callPackage ../pkgs/z3-static.nix {
+    stdenv = toolchain.stdenv;
+  };
+  aws-lc-static = pkgs.callPackage ../pkgs/aws-lc-static.nix {
+    stdenv = toolchain.stdenv;
+  };
+  rustScope = {
+    stdenv = toolchain.stdenv;
+    gccForLibs.lib = toolchain.sharedRuntime;
+    pkgsTargetTarget = pkgs.pkgsTargetTarget // {
+      stdenv = toolchain.stdenv;
+    };
+  };
+  rust-bin = rust-overlay.lib.mkRustBin { } (
+    pkgs
+    // rustScope
+    // {
+      callPackage = pkgs.newScope rustScope;
+    }
+  );
+in
+(pkgs.mkShell.override { stdenv = toolchain.stdenv; }) {
+  packages = [
+    (rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml)
+    z3-static
+    aws-lc-static
+  ]
+  ++ commonDevShellPackages;
+}

nix/devShells/musl.nix

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{
+  pkgs,
+  rust-overlay,
+  commonDevShellPackages,
+}:
+
+let
+  muslPkgs = pkgs.pkgsMusl;
+  stdenv = pkgs.stdenvAdapters.useMoldLinker muslPkgs.stdenv;
+  rust-bin = rust-overlay.lib.mkRustBin { } muslPkgs;
+  rustToolchain = (rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml).override {
+    enableLibsecret = false;
+  };
+in
+(muslPkgs.mkShell.override { inherit stdenv; }) {
+  packages = [
+    rustToolchain
+    (muslPkgs.callPackage ../pkgs/z3-static.nix { })
+    (muslPkgs.callPackage ../pkgs/aws-lc-static.nix {
+      rust-bindgen = pkgs.rust-bindgen;
+    })
+  ]
+  ++ commonDevShellPackages;
+}

nix/pkgs/aws-lc-static.nix

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{
+  aws-lc,
+  rust-bindgen,
+  stdenv,
+}:
+
+aws-lc.override {
+  inherit stdenv rust-bindgen;
+  useSharedLibraries = false;
+  withRustBindings = true;
+}