Sandbox miri test execution so it hopefully finally works in ci

Author: mineichen

.github/workflows/rust.yml

@@ -33,7 +33,7 @@ jobs:
   test_miri:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: DeterminateSystems/nix-installer-action@main
 

flake.nix

@@ -49,6 +49,27 @@
             export PKG_CONFIG_PATH="${pkgs.openssl.dev}/lib/pkgconfig"
             ${script}
           '');
+        
+        # Pure package for miri-test (built in sandbox)
+        miriTestPure = pkgs.writeShellApplication {
+          name = "miri-test-pure";
+          runtimeInputs = [
+            nightlyToolchain
+          ] ++ commonBuildInputs;
+          
+          text = ''
+            set -e
+            # Additional environment setup (runtimeInputs handles PATH for binaries)
+            export LD_LIBRARY_PATH="${pkgs.openssl.out}/lib"
+            export PKG_CONFIG_PATH="${pkgs.openssl.dev}/lib/pkgconfig"
+            # MIRI_SYSROOT needs to be writable - use a cache directory
+            # cargo miri setup will create the sysroot here
+            export MIRI_SYSROOT="''${MIRI_SYSROOT:-$HOME/.cache/miri}"
+            mkdir -p "$MIRI_SYSROOT"
+            cargo miri setup
+            cargo miri test miri
+          '';
+        };
       in {
         devShells.default = pkgs.mkShell {
           buildInputs = [
@@ -104,49 +125,14 @@
           '';
         };
 
+        # Pure package for miri-test (built in sandbox)
+        packages.miri-test-pure = miriTestPure;
+
+        # App that uses the pure package (built in sandbox when run)
+        # When you run `nix run .#miri-test`, it will build the pure package first
         apps.miri-test = {
           type = "app";
-          program = writeShellScriptWithError "miri-test" ''
-            export PATH="${nightlyToolchain}/bin:$PATH"
-            # Ensure cargo uses the nightly toolchain from PATH (not rustup)
-            unset RUSTUP_TOOLCHAIN
-            # nix run preserves the working directory, but ensure we're in project root
-            if [ ! -f "Cargo.toml" ]; then
-              # Try to find project root
-              while [ "$PWD" != "/" ] && [ ! -f "Cargo.toml" ]; do
-                cd ..
-              done
-              if [ ! -f "Cargo.toml" ]; then
-                echo "Error: Could not find Cargo.toml" >&2
-                exit 1
-              fi
-            fi
-            # Verify we're using nightly (using case-insensitive check without grep)
-            RUSTC_VERSION=$(rustc --version)
-            case "$RUSTC_VERSION" in
-              *nightly*) ;;
-              *) echo "Error: Not using nightly toolchain, got: $RUSTC_VERSION" >&2; exit 1;;
-            esac
-            # Verify cargo is also nightly
-            CARGO_VERSION=$(cargo --version)
-            case "$CARGO_VERSION" in
-              *nightly*) ;;
-              *) echo "Error: cargo is not nightly, got: $CARGO_VERSION" >&2; exit 1;;
-            esac
-            # Verify cargo-miri is available and comes from nightly
-            if ! command -v cargo-miri >/dev/null 2>&1; then
-              echo "Error: cargo-miri not found in PATH" >&2
-              exit 1
-            fi
-            # Verify cargo-miri is from the nightly toolchain we set in PATH
-            CARGO_MIRI_PATH=$(command -v cargo-miri)
-            case "$CARGO_MIRI_PATH" in
-              *nightly*) ;;
-              *) echo "Error: cargo-miri not from nightly toolchain, found at: $CARGO_MIRI_PATH" >&2; exit 1;;
-            esac
-            cargo miri setup
-            cargo miri test miri
-          '';
+          program = "${miriTestPure}/bin/miri-test-pure";
         };
 
         apps.build-book = {