chore: Fix clang version in devshell (#7860)

Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>

.github/workflows/check-tools.yml

@@ -13,7 +13,7 @@ on:
       - ".github/workflows/check-tools.yml"
       - ".github/scripts/strategy-matrix/linux.json"
       - "bin/check-tools.sh"
-      - "nix/check-tools/**"
+      - "nix/**"
       - "flake.nix"
       - "flake.lock"
       - "rust-toolchain.toml"
@@ -24,7 +24,7 @@ on:
       - ".github/workflows/check-tools.yml"
       - ".github/scripts/strategy-matrix/linux.json"
       - "bin/check-tools.sh"
-      - "nix/check-tools/**"
+      - "nix/**"
       - "flake.nix"
       - "flake.lock"
       - "rust-toolchain.toml"
@@ -61,11 +61,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu
-            snapshot: nix/check-tools/nix-nixos-amd64.txt
+          - runner: ubuntu-latest
+            snapshot: nix/check-tools/nix-ubuntu-amd64.txt
             nix_develop: false
-          - runner: ubuntu-arm64
-            snapshot: nix/check-tools/nix-nixos-arm64.txt
+          - runner: ubuntu-24.04-arm
+            snapshot: nix/check-tools/nix-ubuntu-arm64.txt
             nix_develop: false
           - runner: macos-26-apple-clang-21
             snapshot: nix/check-tools/macos.txt
@@ -73,7 +73,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     # Linux runs inside the pinned nix-nixos image; macOS runs natively and uses
     # the flake's dev shell instead (see the run step below).
-    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-nixos:{0}', needs.linux-image-tag.outputs.tag) || null }}
+    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-ubuntu:{0}', needs.linux-image-tag.outputs.tag) || null }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

nix/check-tools/macos.txt

@@ -8,8 +8,8 @@ Core build tools:
 
 Development tooling:
   [ ok ] ccache               ccache version 4.13.6
-  [ ok ] clang                clang version 21.1.8
-  [ ok ] clang++              clang version 21.1.8
+  [ ok ] clang                clang version 22.1.7
+  [ ok ] clang++              clang version 22.1.7
   [ ok ] ClangBuildAnalyzer   ClangBuildAnalyzer 1.6.0
   [ ok ] curl                 curl 8.20.0 (aarch64-apple-darwin25.3.0) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
   [ ok ] file                 file-5.47
@@ -21,7 +21,7 @@ Development tooling:
   [ ok ] pkg-config           0.29.2
   [ ok ] vim                  VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
   [ ok ] zip                  Zip 3.0
-  [ ok ] clang-format         clang-format version 21.1.8
+  [ ok ] clang-format         clang-format version 22.1.7
   [ ok ] dot                  dot - graphviz version 12.2.1 (0)
   [ ok ] doxygen              1.16.1
   [ ok ] gcovr                gcovr 8.4

nix/packages.nix

@@ -16,7 +16,23 @@ let
     exec ${pkgs.python3}/bin/python3 ${llvmPackages.clang-unwrapped}/bin/run-clang-tidy "$@"
   '';
 
-  rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
+  # rust-overlay's toolchain propagates the *default* stdenv.cc onto the PATH (so
+  # cargo has a linker). That default may be different from the clang we pin here,
+  # so it shadows our clang and the build can silently use a different compiler
+  # version. Drop that cc from every propagation channel instead of pinning a
+  # replacement: the toolchain then carries no compiler and cargo just uses the
+  # active shell's stdenv cc. Must cover all channels — rust-overlay uses both
+  # propagatedBuildInputs and depsHostHostPropagated.
+  rustToolchainBase = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
+  rustToolchain =
+    let
+      defaultCc = pkgs.stdenv.cc; # default compiler from nixpkgs stdenv
+      withoutDefaultCc = builtins.filter (dep: (dep.outPath or "") != defaultCc.outPath);
+    in
+    rustToolchainBase.overrideAttrs (old: {
+      propagatedBuildInputs = withoutDefaultCc (old.propagatedBuildInputs or [ ]);
+      depsHostHostPropagated = withoutDefaultCc (old.depsHostHostPropagated or [ ]);
+    });
 
   # Nix wraps its toolchain so that binaries are exposed only under unsuffixed
   # names (gcc, g++, clang-tidy, ...). Several tools probe for a