flake: add lean devShells.ci for sandbox linting #9

New issue

Closed

opened 2026-07-05 03:20:30 +08:00 by weiwen · 0 comments

weiwen commented

2026-07-05 03:20:30 +08:00

Owner

Why

The .sandcastle sandbox needs a Rust toolchain to run lint/test, but we don't want to duplicate the dep list in the Dockerfile. The flake is already the single source of truth for the toolchain. Adding a lean CI shell lets the sandbox pull exactly what it needs without compiling pi from source (the default devShell drags in pi, rust-analyzer, cargo-watch — none needed to lint/test).

What

Add devShells.ci to flake.nix containing only:

rustToolchain (must include clippy + rustfmt components — the current rust-bin.stable.latest.default does)
just
openssl, pkg-config (evie links OpenSSL; clippy/test must compile)

Do not include pi, rust-analyzer, cargo-watch, or nodejs.

Factor the shared inputs so default and ci don't drift (e.g. a let commonBuildInputs = [...] the default extends).

Acceptance criteria

nix develop .#ci -c cargo --version works.
nix develop .#ci -c just --version works.
nix develop .#ci -c true does not build pi.
devShells.default still provides the full env unchanged.

Notes

Foundational for #-DOCKERFILE (baked into the image layer) and the nix develop .#ci -c just check invocation used by the reviewer/implementer.

## Why The `.sandcastle` sandbox needs a Rust toolchain to run lint/test, but we don't want to duplicate the dep list in the Dockerfile. The flake is already the single source of truth for the toolchain. Adding a *lean* CI shell lets the sandbox pull exactly what it needs without compiling `pi` from source (the default devShell drags in `pi`, `rust-analyzer`, `cargo-watch` — none needed to lint/test). ## What Add `devShells.ci` to `flake.nix` containing only: - `rustToolchain` (must include `clippy` + `rustfmt` components — the current `rust-bin.stable.latest.default` does) - `just` - `openssl`, `pkg-config` (evie links OpenSSL; clippy/test must compile) Do **not** include `pi`, `rust-analyzer`, `cargo-watch`, or `nodejs`. Factor the shared inputs so `default` and `ci` don't drift (e.g. a `let commonBuildInputs = [...]` the default extends). ## Acceptance criteria - `nix develop .#ci -c cargo --version` works. - `nix develop .#ci -c just --version` works. - `nix develop .#ci -c true` does **not** build `pi`. - `devShells.default` still provides the full env unchanged. ## Notes Foundational for #-DOCKERFILE (baked into the image layer) and the `nix develop .#ci -c just check` invocation used by the reviewer/implementer.

weiwen referenced this issue

2026-07-05 03:20:43 +08:00

just: add check recipe (fmt + clippy + test) #10

weiwen referenced this issue

2026-07-05 03:21:02 +08:00

sandcastle: base image on nixos/nix and bake devShells.ci #11

weiwen referenced this issue

2026-07-05 03:21:27 +08:00

sandcastle: populate CODING_STANDARDS.md (Rust, evie-specific) #12

weiwen referenced this issue

2026-07-05 03:21:38 +08:00

sandcastle: fix implement-prompt feedback loop (npm -> just check) #13