Improve nix devx + verify it in CI

.envrc

@@ -0,0 +1 @@
+use flake

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
   pull_request:
+  workflow_dispatch:
 
 env:
   MINIMUM_LINE_COVERAGE_PERCENT: 35

.github/workflows/nix_ci.yml

@@ -0,0 +1,29 @@
+name: Nix Buffers CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check_flake_w_nix_on_ubuntu:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: DeterminateSystems/flake-checker-action@main
+      - name: Run `nix flake check`
+        run: nix flake check
+
+  check_flake_w_nix_on_mac:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: DeterminateSystems/flake-checker-action@main
+      - name: Run `nix flake check`
+        run: nix flake check

flake.nix

@@ -5,27 +5,76 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
   };
 
-  outputs = { self, flake-utils, naersk, nixpkgs }:
-    flake-utils.lib.eachDefaultSystem (system:
-      let
+  outputs = {
+    self,
+    flake-utils,
+    naersk,
+    nixpkgs,
+  }:
+    flake-utils.lib.eachDefaultSystem (
+      system: let
         pkgs = (import nixpkgs) {
           inherit system;
         };
+        inherit (pkgs) lib;
+
         naersk' = pkgs.callPackage naersk {};
-        nativeBuildInputs = with pkgs; [ pkg-config ];
-      in rec {
-        packages.default = naersk'.buildPackage {
-          inherit nativeBuildInputs;
-          src = ./.;
-          buildInputs = with pkgs; [ openssl ] ++ (pkgs.lib.lists.optionals (stdenv.isDarwin) [ darwin.apple_sdk.frameworks.SystemConfiguration ]);
+        nativeBuildInputs = with pkgs; [pkg-config];
+
+        darwin_frameworks = with pkgs.darwin.apple_sdk.frameworks; [
+          Security
+          SystemConfiguration
+        ];
+
+        dev_tools = with pkgs; [
+          cargo
+          rustc
+        ];
+
+        dependencies = with pkgs;
+          [
+            libgit2
+            openssl
+          ]
+          ++ lib.lists.optionals stdenv.isDarwin darwin_frameworks;
+
+        env_vars = {
+          LIBGIT2_NO_VENDOR = 1;
+          OPENSSL_NO_VENDOR = 1;
         };
-        devShells.default = pkgs.mkShell {
-          nativeBuildInputs = with pkgs; nativeBuildInputs ++ [
-            cargo
-            rustc
-          ];
+      in rec {
+        # NB: if this does not build and you need to modify the file,
+        #     please ensure you also make the corresponding changes in the devshell
+        packages.default = naersk'.buildPackage ({
+            inherit nativeBuildInputs;
+            src = ./.;
+            buildInputs = dev_tools ++ dependencies;
+          }
+          // env_vars);
+
+        devShells.default = pkgs.mkShell ({
+            buildInputs = nativeBuildInputs ++ dev_tools ++ dependencies;
+          }
+          // env_vars);
+
+        formatter = pkgs.alejandra;
+
+        checks = {
+          builds = packages.default;
+          nix-files-are-formatted = pkgs.stdenvNoCC.mkDerivation {
+            name = "fmt-check";
+            dontBuild = true;
+            src = ./.;
+            doCheck = true;
+            nativeBuildInputs = with pkgs; [alejandra];
+            checkPhase = ''
+              alejandra -c .
+            '';
+            installPhase = ''
+              mkdir "$out"
+            '';
+          };
         };
-        checks.builds = packages.default;
       }
     );
 }