CI: Switch tooling setup to Nix

.forgejo/workflows/verify.yaml

@@ -17,9 +17,14 @@ jobs:
     timeout-minutes: 20
     container:
       image: rust:slim
+      env:
+        RUSTUP_HOME: /rust/rustup
+        CARGO_HOME: /rust/cargo
     steps:
       - name: Install action dependencies
-        run: apt-get install --no-install-recommends --update -y nodejs curl git
+        run: >
+          apt-get install --no-install-recommends --update -y
+          nodejs git curl xz-utils
 
       - name: Checkout code
         uses: actions/checkout@v6
@@ -28,35 +33,41 @@ jobs:
 
       - name: Set up Rust toolchain
         run: |
+          mkdir -p "$RUSTUP_HOME"
+          mkdir -p "$CARGO_HOME"
+
+          rust_version=$(
+              grep '^rust-version = "' Cargo.toml \
+              | cut -d '"' -f 2
+          )
+
+          rustup default "$rust_version"
+          rustup toolchain install nightly
           rustup component add llvm-tools
           rustup component add --toolchain nightly rustfmt clippy
-          rustup target add x86_64-unknown-linux-gnu
-          rustup target add x86_64-unknown-linux-musl
-
-      - name: Set up additional tooling
-        run: .forgejo/workflows/setup-tools.sh
+          rustup target add x86_64-unknown-linux-musl x86_64-unknown-linux-gnu
 
       - name: Set up CI user
         run: |
-          useradd -m ci && chown -R ci:ci .
-          git config --global --add safe.directory "$PWD"
+          useradd -m ci
+          mkdir /nix
+          chown -R ci:ci "$RUSTUP_HOME" "$CARGO_HOME" "$PWD" /nix
+          printf '[safe]\ndirectory = %s\n' "$PWD" > /etc/gitconfig
 
-      - name: Text matches
-        run: just ci todos-assess version-assess spell
-      - name: Schema lint
-        run: just ci schema-lint
-      - name: Deny
-        run: just ci deny
-      - name: Format
-        run: just ci format-assess
-      - name: Lint
-        run: just ci lint-assess
-      - name: MSRV
-        run: just ci msrv-assess
-      - name: Cargo check
-        run: just ci check
-      - name: Test
-        run: just ci test
-      - name: Coverage
-        run: just ci cover-assess
+      - name: Set up Nix
+        run: |
+          mkdir /etc/nix
+          echo experimental-features = nix-command flakes \
+            >> /etc/nix/nix.conf
+          su ci -c "
+            sh -c 'curl -L https://nixos.org/nix/install |
+              bash -s -- --no-daemon' \
+          "
 
+      - name: Assess
+        run: |
+          su ci -lc "
+            export RUSTUP_HOME=$RUSTUP_HOME CARGO_HOME=$CARGO_HOME
+            nix develop path:$FORGEJO_WORKSPACE -c \
+              just -f $FORGEJO_WORKSPACE/.justfile verify
+          "