feat: nix: CI without depending on flakehub.com

.github/workflows/nix-update-lock.yaml

@@ -0,0 +1,19 @@
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 0'
+ 
+jobs:
+  update-flake-inputs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-title: "Update flake.lock"
+          pr-labels: |
+            dependencies
+            automated
+      - uses: DeterminateSystems/flake-checker-action@main
+      - run: nix flake check --all-systems

.github/workflows/nix.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - nix
     tags:
       - v?[0-9]+.[0-9]+.[0-9]+*
 
@@ -14,7 +13,11 @@ concurrency:
  
 jobs:
   nix-ci:
-    uses: DeterminateSystems/ci/.github/workflows/workflow.yml@main
+    runs-on: ubuntu-latest
-    permissions:
+    steps:
-      id-token: write
+      - uses: actions/checkout@v4
-      contents: read
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flake-checker-action@main
+      - run: nix flake check --all-systems

flake.nix

@@ -26,13 +26,17 @@ rec {
         inherit system;
         overlays = [devshell.overlays.default];
       };
-    in {
+    in rec {
       formatter = pkgs.alejandra;
       packages = {
         headplane = pkgs.callPackage ./nix/package.nix {};
         headplane-agent = pkgs.callPackage ./nix/agent.nix {};
       };
-      devShell = pkgs.devshell.mkShell rec {
+      checks.default = pkgs.symlinkJoin {
+        name = "headplane-with-agent";
+        paths = [packages.headplane packages.headplane-agent];
+      };
+      devShells.default = pkgs.devshell.mkShell rec {
         name = description;
         motd = let
           providedPackages = pkgs.lib.concatStringsSep "\n" (