Nix build and cache

.github/workflows/build.yml

@@ -0,0 +1,61 @@
+name: "Build"
+on:
+  pull_request:
+  push:
+jobs:
+  nix-build:
+    if: github.event.pull_request.draft == false
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - system: varda
+            os: aarch64
+          - system: durincore
+            os: x86_64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Create nix mount point
+        if: contains(matrix.os, 'x86_64')
+        run: sudo mkdir /nix
+      - name: Checkout repository
+        uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Nix
+        uses: https://github.com/cachix/install-nix-action@v26
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: https://github.com/DeterminateSystems/magic-nix-cache-action@main
+      - uses: https://github.com/cachix/cachix-action@v14
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        with:
+          name: hsndev
+          # If you chose API tokens for write access OR if you have a private cache
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Garbage collect build dependencies
+        run: nix-collect-garbage
+
+      - name: Build new ${{ matrix.system }} system
+        run: |
+          set -o pipefail
+          nix build \
+            ".#top.${{ matrix.system }}" \
+            --profile ./profile \
+            --fallback \
+            -v \
+            --log-format raw \
+             > >(tee stdout.log) 2> >(tee /tmp/nix-build-err.log >&2)
+  nix-build-success:
+    if: ${{ always() }}
+    needs:
+      - nix-build
+    name: Nix Build Successful
+    runs-on: docker
+    steps:
+      - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        name: Check matrix status
+        run: exit 1