native modules: build rust workspace crates through the repo flake

.github/workflows/ci.yml

@@ -248,6 +248,33 @@ jobs:
       - name: Bake e2e tests
         run: uv run pytest -m bake_e2e dimos/cli/bake/test_bake_e2e.py --no-cov
 
+  cargo-nix-current:
+    # Cargo.nix is generated from Cargo.lock and gives every crate its own
+    # derivation, which is what lets one module rebuild without the others.
+    # It is the successor to an aggregate `cargoHash`, and the reason it is an
+    # improvement is this job: a stale generated file is a diff CI can print,
+    # where a stale hash was a number a human had to re-paste from a failed
+    # build. Note this fires on lock changes from main too, because CI builds
+    # the merge commit.
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # For checkout
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Install Nix
+        run: bash docker/ros/install-nix.sh
+      - name: Regenerate Cargo.nix
+        run: bin/regen-cargo-nix
+      - name: Fail if the committed Cargo.nix is stale
+        run: |
+          if ! git diff --exit-code -- Cargo.nix; then
+            echo "::error::Cargo.nix is out of date — run bin/regen-cargo-nix and commit the result"
+            exit 1
+          fi
+
   cpp:
     timeout-minutes: 30
     runs-on: ubuntu-latest
@@ -949,6 +976,7 @@ jobs:
     needs:
     - lint
     - rust
+    - cargo-nix-current
     - cpp
     - md-babel
     - web

.gitignore

@@ -36,6 +36,11 @@ build/
 result
 result-*
 
+# crate2nix's prefetch cache. Deliberately not committed: its keys are scoped
+# to a git dependency's *branch* with no rev, so a committed copy goes stale
+# the moment that branch moves. Cargo.nix already carries the hashes.
+crate-hashes.json
+
 # Editor and OS files
 .vscode/
 .DS_Store

.pre-commit-config.yaml

@@ -39,15 +39,21 @@ repos:
     rev: v4.6.0
     hooks:
       - id: check-case-conflict
+      # These three rewrite bytes, so they are kept off files that must stay
+      # byte-identical to something outside this repo: patches (upstream
+      # diffs), and Cargo.nix, which bin/regen-cargo-nix reproduces verbatim
+      # and the cargo-nix-current CI job diffs. crate2nix ends it with a blank
+      # line; reformatting it here would fail that job on every run, because
+      # CI does not run these hooks.
       - id: trailing-whitespace
         language: python
         types: [text]
-        exclude: \.patch$  # patch files contain intentional trailing whitespace
+        exclude: &verbatim-files (\.patch$|^Cargo\.nix$)
       - id: end-of-file-fixer
-        exclude: \.patch$  # keep patch files byte-identical to upstream diffs
+        exclude: *verbatim-files
       - id: mixed-line-ending
         args: [--fix=lf]
-        exclude: \.patch$  # keep patch files byte-identical to upstream diffs
+        exclude: *verbatim-files
       - id: check-json
         exclude: ^misc/DimSim/public/sims/  # LFS-tracked
       - id: check-toml
@@ -137,7 +143,7 @@ repos:
       - id: cargo-fmt
         name: cargo fmt
         entry: |
-          bash -c '
+          nix develop path:nix/rust -c bash -c '
             set -euo pipefail
             git ls-files "*Cargo.toml" | while read -r m; do
               cargo locate-project --manifest-path "$m" --workspace --message-format plain
@@ -152,14 +158,18 @@ repos:
       - id: cargo-clippy
         name: cargo clippy
         entry: |
-          bash -c '
+          nix develop path:nix/rust -c bash -c '
             set -euo pipefail
             git ls-files "*Cargo.toml" | while read -r m; do
               cargo locate-project --manifest-path "$m" --workspace --message-format plain
             done | sort -u | while read -r root; do
-              # A crate with its own flake carries system deps the root shell lacks.
-              if [ -f "$(dirname "$root")/flake.nix" ]; then
-                nix develop "path:$(dirname "$root")" -c cargo clippy --manifest-path "$root" --workspace --all-targets -- -D warnings
+              dir=$(dirname "$root")
+              # A module crate with its own flake carries system deps the toolchain
+              # shell lacks. The repo-root flake is skipped on purpose: a flake ref
+              # copies its whole source tree into the store, and that tree is the
+              # entire repository.
+              if [ "$dir" != "$(git rev-parse --show-toplevel)" ] && [ -f "$dir/flake.nix" ]; then
+                nix develop "path:$dir" -c cargo clippy --manifest-path "$root" --workspace --all-targets -- -D warnings
               else
                 cargo clippy --manifest-path "$root" --workspace --all-targets -- -D warnings
               fi