ref: update the template for rust projects

Update the workflow to use `nix develop` commands instead of multiple
steps (see https://determinate.systems/posts/nix-github-actions).

Add a configuration for `cargo deny` to manage the dependencies I take
on.

1 files changed, 60 insertions, 29 deletions

diff --git a/templates/rust/flake.nix b/templates/rust/flake.nix
index 49c2f76..b6bc262 100644
--- a/templates/rust/flake.nix
+++ b/templates/rust/flake.nix
@@ -4,63 +4,94 @@
   inputs = {
     flake-utils.url = "github:numtide/flake-utils";
     nixpkgs.url = "github:NixOS/nixpkgs";
-    rust-overlay.url = "github:oxalica/rust-overlay";
-    naersk.url = "github:nmattia/naersk";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs = {
+        flake-utils.follows = "flake-utils";
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+    pre-commit-hooks = {
+      url = "github:cachix/pre-commit-hooks.nix";
+      inputs = {
+        flake-utils.follows = "flake-utils";
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
   };
 
   outputs =
     { self
     , flake-utils
     , nixpkgs
-    , naersk
     , rust-overlay
+    , pre-commit-hooks
     }:
+    let
+      # Borrow project metadata from the Rust config
+      meta = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package;
+      inherit (meta) name version;
 
+      overlays = [
+        # Rust helpers
+        (import rust-overlay)
+        # Build Rust toolchain using helpers from rust-overlay
+        (self: super: {
+          # This supplies cargo, rustc, rustfmt, etc.
+          rustToolchain = super.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+        })
+      ];
+    in
     flake-utils.lib.eachDefaultSystem
       (system:
       let
-        overlays = [ (import rust-overlay) ];
         pkgs = import nixpkgs { inherit system overlays; };
-        rust-toolchain =
-          (pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml).override {
-            extensions = [ "rust-src" ];
-          };
-        naersk-lib = naersk.lib."${system}".override {
-          rustc = rust-toolchain;
-        };
       in
-      rec
       {
-        packages.gh-ssh-keys = naersk-lib.buildPackage {
-          pname = "gh-ssh-keys";
-          root = ./.;
-          buildInputs = with pkgs; [
-            pkg-config
-            openssl
-          ];
+        packages = rec {
+          default = XXX;
+          x509-info = pkgs.rustPlatform.buildRustPackage {
+            pname = name;
+            inherit version;
+            src = ./.;
+            release = true;
+            cargoLock.lockFile = ./Cargo.lock;
+          };
         };
 
-        defaultPackage = packages.gh-ssh-keys;
+        checks = {
+          pre-commit = pre-commit-hooks.lib.${system}.run {
+            src = ./.;
+            hooks = {
+              clippy = {
+                enable = true;
+                entry = pkgs.lib.mkForce "cargo clippy -- -D warnings";
+              };
+              nixpkgs-fmt = {
+                enable = true;
+              };
+              rustfmt = {
+                enable = true;
+                entry = pkgs.lib.mkForce "cargo fmt -- --check --color always";
+              };
+            };
+          };
+        };
 
         devShell = pkgs.mkShell {
           nativeBuildInputs = with pkgs; [
-            rust-toolchain
-            openssl
-            pkg-config
+            rustToolchain
             cargo-audit
             cargo-deny
-            cargo-cross
             rust-analyzer
-          ] ++ pkgs.lib.optionals (pkgs.stdenv.isLinux) (with pkgs; [ cargo-watch ]);
+          ];
 
-          shellHook = ''
-            cargo --version
-          '';
+          inherit (self.checks.${system}.pre-commit) shellHook;
         };
       })
     // {
       overlay = final: prev: {
-        gh-ssh-keys = self.defaultPackage.${prev.system};
+        XXX = self.defaultPackage.${prev.system};
       };
     };
 }