Planted Nix files used to validate the codeql-nix extractor's end-to-end pipeline through GitHub Code Scanning.
This repo intentionally contains supply-chain anti-patterns. Do not
treat the contents of nix/ as best practice.
The .github/workflows/scan.yml workflow runs the codeql-nix
extractor against nix/, emits SARIF, and uploads it via
github/codeql-action/upload-sarif. Findings appear in the
Security → Code scanning tab of this repository.