From 8a769bc1692e8d1a141751645410e316968b27da Mon Sep 17 00:00:00 2001
From: Suyog Tandel <git@suyogtandel.in>
Date: Thu, 9 Jul 2026 20:22:32 +0530
Subject: [PATCH] ci: replace Nix with rust-toolchain, add audit-check and
 CodeQL jobs

- Switch `checks` and docs jobs from Nix to dtolnay/rust-toolchain +
  Swatinem/rust-cache + apt system deps for faster setup
- Add dependency vulnerability scanning via rustsec/audit-check@v2.0.0
- Add CodeQL static analysis via github/codeql-action@v4 (manual build)
---
 .github/workflows/ci.yml   | 70 ++++++++++++++++++++++++++++++++------
 .github/workflows/docs.yml | 10 +++---
 2 files changed, 64 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c1f0b38..a44ae4c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,32 +22,42 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v22
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
 
-      - name: Setup Nix cache
-        uses: DeterminateSystems/magic-nix-cache-action@v14
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: install dependencies (linux)
+        run: |
+          sudo apt-get update
+          sudo apt install -y \
+            pkg-config libpcsclite-dev libudev-dev libvulkan-dev \
+            libwayland-dev wayland-protocols libxkbcommon-dev \
+            libxcb1-dev libxkbcommon-x11-dev libfontconfig1-dev \
+            libasound2-dev libdbus-1-dev libx11-dev \
+            libxcb-shape0-dev libxcb-xfixes0-dev libusb-1.0-0-dev
 
       - name: Check formatting
-        run: nix develop --command cargo fmt --all -- --check
+        run: cargo fmt --all -- --check
 
       - name: Run cargo check
-        run: nix develop --command cargo check --all-targets
+        run: cargo check --all-targets
 
       - name: Run clippy
-        run: nix develop --command cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --all-targets -- -D warnings
 
       - name: Check for missing documentation
-        run: nix develop --command bash -c 'RUSTFLAGS="-D missing_docs" cargo check --all-targets'
+        run: RUSTFLAGS="-D missing_docs" cargo check --all-targets
 
       - name: Check documentation builds cleanly
-        run: nix develop --command bash -c 'RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items'
+        run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items
 
       - name: Build project
-        run: nix develop --command cargo build --verbose
+        run: cargo build --verbose
 
       - name: Run tests
-        run: nix develop --command cargo test --verbose
+        run: cargo test --verbose
 
   verify-build:
     name: Build (${{ matrix.platform }} / ${{ matrix.target }})
@@ -95,3 +105,41 @@ jobs:
 
       - name: Build
         run: cargo build --verbose --target ${{ matrix.target }}
+
+  audit:
+    name: Security Audit
+    needs: checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  codeql:
+    name: CodeQL Analysis
+    needs: checks
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+
+      - name: Setup Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@v14
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: rust
+          build-mode: manual
+
+      - name: Build with Nix
+        run: nix develop --command cargo build --verbose
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 197b5dd..386f215 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -24,14 +24,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v22
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
 
-      - name: Setup Nix cache
-        uses: DeterminateSystems/magic-nix-cache-action@v14
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
 
       - name: Generate Documentation
-        run: nix develop --command cargo doc --document-private-items
+        run: cargo doc --document-private-items
 
       - name: Create Redirect Index
         run: |