ci: crane-based Rust checks (clippy/doc/test) via nix flake check

[kixelated]

Why

The self-hosted A1 runner filled its 200G boot volume and CI started failing with No space left on device. Root cause: the heavy Rust CI (just rs ci → cargo clippy/doc/test --all-features) compiled into a persistent CARGO_TARGET_DIR ($HOME/cargo-target/moq-$RUNNER_NAME) that grew unbounded (every branch's artifacts, never pruned — 161G), was unsafe to share across parallel jobs, and lived outside the workspace so the per-job cleanup never touched it. Crane already built the release binaries, but the CI checks never went through it.

What

Move the heavy checks into crane, exposed via flake checks, and make nix flake check the thing that runs them:

• clippy — --all-targets --all-features -- -D warnings
• doc — --no-deps --all-features, RUSTDOCFLAGS=-D warnings
• test — --all-targets --all-features

Dependencies compile once (cargoArtifacts = buildDepsOnly), land in the Cachix binary cache, are shared across machines, and are LRU-evicted by the Nix store's free-space GC. Only first-party code recompiles, inside Nix's sandbox — no persistent target dir to bound.

Then (stage 2 in this PR):

• just rs ci no longer repeats cargo clippy/doc/test (crane owns them); it keeps non-compiling hygiene (fmt/shear/sort), cargo-deny (needs network, can't run in the sandbox), and the default / no-default-feature cargo checks the all-features crane run doesn't cover.
• check.yml drops the persistent CARGO_TARGET_DIR; residual cargo checks use the in-workspace ./target, which the runner wipes per job.
• A self-hosted CI step asserts nothing wrote under $HOME/cargo-target, so a CARGO_TARGET_DIR override can't silently reintroduce an unbounded target dir.

Local just rs check (the fast cargo inner loop) is unchanged.

Verification

CI on the self-hosted aarch64-linux runner is authoritative (Linux-only features: alsa, libva, jemalloc). Confirmed green through iterations: the --all-features dep graph — including boring-sys/quiche — builds in the sandbox (needed git for BoringSSL patches), test fixtures (include_*! data) are kept in the check source, and the test suite passes inside the sandbox.

Notes

• Companion to the runner disk fix (disk-guard timer + CARGO_INCREMENTAL=0, in the oci infra repo).
• Dropping the persistent CARGO_TARGET_DIR also removes the hardcoded-./target wasm-recipe footgun that bit branch claude/merge-main-into-dev-992spq on the self-hosted runner.
• Follow-up ideas: a single shared cargoArtifacts across packages+checks to cut redundant dep compiles; Nix-vendoring the other languages (Go buildGoModule, uv via uv2nix, bun via bun2nix) to extend the "sandbox-except-/nix" model beyond Rust.

[coderabbitai]

Warning

Review limit reached

@kixelated, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 8 minutes and 37 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 30392bd7-123c-4443-912f-ba480534dc63

📥 Commits

Reviewing files that changed from the base of the PR and between d17c90f and 50eb2e0.

📒 Files selected for processing (1)

• .github/workflows/check.yml

Walkthrough

The PR integrates Nix-based CI checks for the Rust workspace with updated GitHub Actions configuration and a new local CI recipe. In nix/overlay.nix, a checkSrc source filter excludes non-source directories such as target and node_modules. A checkCommonArgs attribute set configures full workspace builds with --workspace --all-features, required native inputs, and Linux-only system libraries. A checkDeps derivation compiles third-party dependencies once via craneLib.buildDepsOnly. A moqChecks attribute set defines three derivations—cargoClippy, cargoDoc, and cargoTest—each reusing checkDeps. The overlay's returned attribute set inherits and exposes moqChecks. In flake.nix, the per-system outputs set checks = overlayPkgs.moqChecks. In rs/justfile, the ci recipe is rewritten to run formatting checks, cargo shear, cargo check with multiple configurations, and cargo deny. In .github/workflows/check.yml, GitHub-hosted caching is refined and self-hosted runners now record a baseline marker on $HOME/cargo-target, then assert no leaked writes occur after nix develop --command just ci completes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: moving Rust checks into crane-based derivations exposed via nix flake check. It is specific, clear, and directly reflects the primary objective of the PR.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset. It explains the root cause, solution, implementation details, and verification steps, all aligned with the actual file changes made.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/crane-ci-checks

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}