ci(check): add check workflow

.envrc

@@ -1,3 +1,3 @@
 # shellcheck disable=SC2148
 watch_file flake/**/*.nix
-use flake
+use flake . --accept-flake-config

.github/workflows/check.yaml

@@ -0,0 +1,33 @@
+name: "Check"
+on:
+  push:
+    branches:
+      - "master"
+  pull_request:
+    branches:
+      - "master"
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v25
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+      - uses: cachix/cachix-action@v14
+        with:
+          name: sunziping2016
+          # Create a personal auth token from https://app.cachix.org/personal-auth-tokens,
+          # login to cachix, and then generate a signing key and provision it.
+          #     cachix authtoken --stdin  # paste personal auth token
+          #     cachix generate-keypair sunziping2016
+          #     gh secret set CACHIX_SIGNING_KEY  # paste signing key
+          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
+      - run: nix flake show
+      - run: nix flake check --all-systems
+      - run: nix build .#nixosConfigurations.aliyun-hz2.config.system.build.toplevel -L

flake.nix

@@ -1,6 +1,11 @@
 {
   description = "Ziping Sun's NixOS configuration";
 
+  nixConfig.extra-substituters = [ "https://sunziping2016.cachix.org" ];
+  nixConfig.extra-trusted-public-keys = [
+    "sunziping2016.cachix.org-1:7g2G+myu9428IcIKO83W9efXq+uGR1u4C3LR//yVpUc="
+  ];
+
   inputs = {
     # nixpkgs
 
@@ -67,6 +72,9 @@
 
     gitignore-nix.url = "github:hercules-ci/gitignore.nix";
     gitignore-nix.inputs.nixpkgs.follows = "nixpkgs";
+
+    nix-github-actions.url = "github:nix-community/nix-github-actions";
+    nix-github-actions.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =