From 37261d113c16e562a0c8e992b4dc2c02c9dd1c39 Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Tue, 14 Jul 2026 18:38:23 +0000
Subject: [PATCH] chore: add pinned Rust security tools

---
 .github/workflows/rust.yml |  4 ++--
 flake.lock                 | 19 ++++++++++++++++++-
 flake.nix                  | 11 ++++++++++-
 3 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 061ad2f4..ca308d4d 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -61,7 +61,7 @@ jobs:
         uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
 
       - name: Run clippy
-        run: cargo clippy --all-targets --all-features -- -D warnings
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
 
   test:
     name: Test Suite
@@ -86,4 +86,4 @@ jobs:
         uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
 
       - name: Run tests
-        run: cargo test --all-features
+        run: cargo test --locked --all-features
diff --git a/flake.lock b/flake.lock
index 8544226a..66b62de5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -78,7 +78,8 @@
         "flake-utils": "flake-utils",
         "nitro-util": "nitro-util",
         "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay",
+        "security-tools-nixpkgs": "security-tools-nixpkgs"
       }
     },
     "rust-overlay": {
@@ -101,6 +102,22 @@
         "type": "github"
       }
     },
+    "security-tools-nixpkgs": {
+      "locked": {
+        "lastModified": 1784007870,
+        "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index 611044c3..40bc568c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,17 +8,20 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixpkgs.url = "nixpkgs/nixos-unstable";
+    # Keep dev security tools current without moving the application or Nitro build pin.
+    security-tools-nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nitro-util = {
       url = "github:monzo/aws-nitro-util/7d755578b0b0b9850c0d7c4738a6c8daf3ff55c0";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs = { self, nixpkgs, flake-utils, rust-overlay, nitro-util }:
+  outputs = { self, nixpkgs, security-tools-nixpkgs, flake-utils, rust-overlay, nitro-util }:
     flake-utils.lib.eachDefaultSystem (system:
       let
         overlays = [ rust-overlay.overlays.default ];
         pkgs = import nixpkgs { inherit system overlays; };
+        securityToolsPkgs = import security-tools-nixpkgs { inherit system; };
         rust = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
         nitro = nitro-util.lib.${system};
 
@@ -56,7 +59,13 @@
           pkgs.libiconv
           pkgs.apple-sdk
         ];
+        securityToolInputs = [
+          securityToolsPkgs.cargo-audit
+          securityToolsPkgs.cargo-deny
+          securityToolsPkgs.cargo-machete
+        ];
         inputs = commonInputs
+          ++ securityToolInputs
           ++ pkgs.lib.optionals pkgs.stdenv.isLinux linuxOnlyInputs
           ++ pkgs.lib.optionals pkgs.stdenv.isDarwin darwinOnlyInputs;