flake clippy: override build phase to bypass naersk mode

flake.nix

@@ -126,24 +126,38 @@
       checks = forAllSystems (
         {
           treefmt-eval,
+          pkgs,
           naersk-lib,
           ...
         }:
         {
           formatting = treefmt-eval.config.build.check self;
-          clippy = naersk-lib.buildPackage {
-            src = ./.;
-            mode = "clippy";
-            cargoBuildOptions =
-              orig:
-              orig
-              ++ [
-                "--workspace"
-                "--"
-                "-D"
-                "warnings"
-              ];
-          };
+          # Clippy as a check: reuse naersk's vendored-deps environment but
+          # replace the build phase with `cargo clippy --workspace --all-targets
+          # -- -D warnings`. Naersk's own `mode = "clippy"` mangles the `--`
+          # separator, so we go through overrideAttrs instead.
+          clippy =
+            (naersk-lib.buildPackage {
+              src = ./.;
+              # Skip the actual build; we only care about the clippy lint.
+              doCheck = false;
+              copyTarget = false;
+            }).overrideAttrs
+              (old: {
+                pname = "${old.pname}-clippy";
+                nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.clippy ];
+                buildPhase = ''
+                  runHook preBuild
+                  cargo clippy --workspace --all-targets -- -D warnings
+                  runHook postBuild
+                '';
+                installPhase = ''
+                  runHook preInstall
+                  mkdir -p $out
+                  touch $out/.clippy-passed
+                  runHook postInstall
+                '';
+              });
         }
       );
     };