From 86c1deed89c49f7300c8dd75bacaa46a6a4d26ae Mon Sep 17 00:00:00 2001
From: Simon Scatton <sscatton@nvidia.com>
Date: Tue, 9 Jun 2026 12:30:15 +0200
Subject: [PATCH] ci: add nix clippy lint checks

---
 .github/workflows/nix-ci.yml | 23 ++++++++++++++++++++---
 flake.nix                    | 10 +++++++++-
 nix/workspace.nix            | 12 +++++++++++-
 3 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/nix-ci.yml b/.github/workflows/nix-ci.yml
index fe653b5e8..fcb8d0323 100644
--- a/.github/workflows/nix-ci.yml
+++ b/.github/workflows/nix-ci.yml
@@ -51,7 +51,7 @@ jobs:
         uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Build package
-        run: nix build ".#packages.${{ matrix.target.system }}.${{ matrix.package }}" --no-link --print-build-logs --no-update-lock-file
+        run: nix build ".#packages.${{ matrix.target.system }}.${{ matrix.package }}" --no-link --no-update-lock-file
 
   test:
     name: Test ${{ matrix.check }} (${{ matrix.target.system }})
@@ -93,7 +93,7 @@ jobs:
         uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Run test
-        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.check }}" --no-link --print-build-logs --no-update-lock-file
+        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.check }}" --no-link --no-update-lock-file
 
   lint:
     name: Lint ${{ matrix.lint }} (${{ matrix.target.system }})
@@ -109,6 +109,23 @@ jobs:
             runner: linux-arm64-cpu8
         lint:
           - rustfmt
+          - openshell-bootstrap-clippy
+          - openshell-cli-clippy
+          - openshell-core-clippy
+          - openshell-driver-docker-clippy
+          - openshell-driver-kubernetes-clippy
+          - openshell-driver-podman-clippy
+          - openshell-driver-vm-clippy
+          - openshell-ocsf-clippy
+          - openshell-policy-clippy
+          - openshell-prover-clippy
+          - openshell-providers-clippy
+          - openshell-router-clippy
+          - openshell-sandbox-clippy
+          - openshell-server-macros-clippy
+          - openshell-server-clippy
+          - openshell-tui-clippy
+          - openshell-vfio-clippy
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -119,4 +136,4 @@ jobs:
         uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Run lint
-        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.lint }}" --no-link --print-build-logs --no-update-lock-file
+        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.lint }}" --no-link --no-update-lock-file
diff --git a/flake.nix b/flake.nix
index f30308ebf..aa7b1cb20 100644
--- a/flake.nix
+++ b/flake.nix
@@ -63,6 +63,13 @@
           openshell-driver-podman = workspaceCrates.openshell-driver-podman.package;
         };
 
+        crateTests = lib.mapAttrs' (
+          name: crate: lib.nameValuePair "${name}-test" crate.test
+        ) workspaceCrates;
+        crateClippy = lib.mapAttrs' (
+          name: crate: lib.nameValuePair "${name}-clippy" crate.clippy
+        ) workspaceCrates;
+
         treefmtEval = treefmt-nix.lib.evalModule pkgs {
           projectRootFile = "flake.nix";
           programs.nixfmt.enable = true;
@@ -77,7 +84,8 @@
         };
 
         checks =
-          lib.mapAttrs' (name: crate: lib.nameValuePair "${name}-test" crate.test) workspaceCrates
+          crateTests
+          // crateClippy
           // {
             rustfmt = craneLib.cargoFmt {
               pname = "openshell-workspace";
diff --git a/nix/workspace.nix b/nix/workspace.nix
index 9d8e847af..dce48ceea 100644
--- a/nix/workspace.nix
+++ b/nix/workspace.nix
@@ -188,9 +188,19 @@ let
           cargoArtifacts = cratesTestDeps;
         }
       );
+
+      clippy = craneLib.cargoClippy (
+        common
+        // {
+          inherit src;
+          nativeBuildInputs = lib.unique (effectiveNativeBuildInputs ++ nativeCheckInputs);
+          cargoArtifacts = cratesTestDeps;
+          cargoClippyExtraArgs = "--all-targets -- -D warnings";
+        }
+      );
     in
     {
-      inherit package test;
+      inherit package test clippy;
     };
 in
 {