Add NixOS eval/build GitHub Actions and unignore .github

.github/workflows/nixos-build.yml

@@ -0,0 +1,79 @@
+name: NixOS build
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/nixos-build.yml"
+      - "flake.lock"
+      - "flake.nix"
+      - "flake/**"
+      - "hosts/**"
+      - "modules/**"
+      - "overlays/**"
+      - "profiles/**"
+      - "shells/**"
+      - ".sops.yaml"
+      - "secrets/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  discover-hosts:
+    name: Discover NixOS hosts
+    runs-on: ubuntu-latest
+    outputs:
+      hosts: ${{ steps.hosts.outputs.hosts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Evaluate NixOS hosts
+        id: hosts
+        run: |
+          set -euo pipefail
+          hosts_json=$(nix eval --json '.#nixosConfigurations' --apply 'configs: builtins.attrNames configs')
+          echo "hosts=${hosts_json}" >> "$GITHUB_OUTPUT"
+          echo "Discovered hosts: ${hosts_json}"
+
+  build-host:
+    name: Build ${{ matrix.host }}
+    needs: discover-hosts
+    if: ${{ needs.discover-hosts.outputs.hosts != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        host: ${{ fromJSON(needs.discover-hosts.outputs.hosts) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Build NixOS system
+        run: |
+          set -euo pipefail
+          nix build ".#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel" \
+            --print-build-logs

.github/workflows/nixos-eval.yml

@@ -0,0 +1,78 @@
+name: NixOS eval
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/nixos-eval.yml"
+      - "flake.lock"
+      - "flake.nix"
+      - "flake/**"
+      - "hosts/**"
+      - "modules/**"
+      - "overlays/**"
+      - "profiles/**"
+      - "shells/**"
+      - ".sops.yaml"
+      - "secrets/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  discover-hosts:
+    name: Discover NixOS hosts
+    runs-on: ubuntu-latest
+    outputs:
+      hosts: ${{ steps.hosts.outputs.hosts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Evaluate NixOS hosts
+        id: hosts
+        run: |
+          set -euo pipefail
+          hosts_json=$(nix eval --json '.#nixosConfigurations' --apply 'configs: builtins.attrNames configs')
+          echo "hosts=${hosts_json}" >> "$GITHUB_OUTPUT"
+          echo "Discovered hosts: ${hosts_json}"
+
+  eval-host:
+    name: Eval ${{ matrix.host }}
+    needs: discover-hosts
+    if: ${{ needs.discover-hosts.outputs.hosts != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        host: ${{ fromJSON(needs.discover-hosts.outputs.hosts) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Evaluate NixOS system derivation
+        run: |
+          set -euo pipefail
+          nix eval ".#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel.drvPath"

.gitignore

@@ -5,6 +5,8 @@
 !LICENSE
 !AGENTS.md
 
+!.github/
+
 !.envrc
 
 !.sops.yaml