Fix toolchain invocation for Nix and resolve partial crate versions

.github/workflows/nix.yml

@@ -0,0 +1,29 @@
+name: Nix
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  check:
+    name: nix flake check
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - uses: DeterminateSystems/nix-installer-action@main
+
+    - uses: DeterminateSystems/magic-nix-cache-action@main
+
+    - name: Check flake
+      run: nix flake check
+
+    - name: Check dev shell
+      run: nix develop --command rustc --version

.github/workflows/rust.yml

@@ -77,7 +77,7 @@ jobs:
           ${{ runner.os }}-cargo-
 
     - name: Run unit tests
-      run: cargo test --workspace --lib --bins --verbose
+      run: cargo test --workspace --lib --bins --verbose -- --include-ignored
 
     - name: Run doc tests
       run: cargo test --workspace --doc --verbose
@@ -107,4 +107,4 @@ jobs:
           ${{ runner.os }}-cargo-
 
     - name: Run integration tests
-      run: cargo test --workspace --test integration_tests --verbose
+      run: cargo test --workspace --test integration_tests --verbose -- --include-ignored

flake.nix

@@ -29,14 +29,17 @@
         pkgs,
         ...
       }: let
-        # Use rust-toolchain.toml for the exact nightly version
-        rustToolchain = inputs'.fenix.packages.fromToolchainFile {
-          file = ./rust-toolchain.toml;
-          sha256 = "";
-        };
-
-        # Nightly toolchain for runtime (used by the binary to fetch docs)
-        rustNightly = rustToolchain;
+        # Use fenix's rolling latest nightly so the flake doesn't break every
+        # time the preferred dated nightly in rust-toolchain.toml changes.
+        # The runtime's toolchain probe (resolve_toolchain) validates
+        # compatibility at startup anyway.
+        rustNightly = inputs'.fenix.packages.latest.withComponents [
+          "cargo"
+          "clippy"
+          "rustc"
+          "rustfmt"
+          "rust-src"
+        ];
 
         craneLib = inputs.crane.mkLib pkgs;
 
@@ -61,12 +64,12 @@
               darwin.apple_sdk.frameworks.Security
               darwin.apple_sdk.frameworks.SystemConfiguration
             ]
-            ++ pkgs.lib.optional pkgs.lib.isLinux gcc.cc.lib;
+            ++ pkgs.lib.optional pkgs.stdenv.hostPlatform.isLinux gcc.cc.lib;
 
           nativeBuildInputs = with pkgs; [
             pkg-config
           ]
-          ++ pkgs.lib.optional pkgs.lib.isLinux autoPatchelfHook;
+          ++ pkgs.lib.optional pkgs.stdenv.hostPlatform.isLinux autoPatchelfHook;
         };
 
         # Build dependencies only
@@ -124,6 +127,12 @@
               inherit cargoArtifacts;
               partitions = 1;
               partitionType = "count";
+            }
+            // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
+              # autoPatchelfHook only runs during fixupPhase, but nextest
+              # executes test binaries during checkPhase — set LD_LIBRARY_PATH
+              # so they can find libssl and other shared libs.
+              LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [pkgs.openssl];
             });
         };
       };