ci: add check workflow

Author: kid

.github/workflows/check.yaml

@@ -0,0 +1,49 @@
+name: Validate Nix Flake
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        required: false
+        type: string
+  push:
+    paths:
+      - "**.nix"
+      - "**.lock"
+      - ".github/workflows/check.yaml"
+      - ".github/actions/**/*"
+
+permissions: {}
+
+jobs:
+  check-flake:
+    name: Check (${{ matrix.system }})
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            system: x86_64-linux
+          - os: macos-latest
+            system: aarch64-darwin
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref && inputs.ref || github.ref_name }}
+          persist-credentials: false
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: cachix/cachix-action@v16
+        with:
+          name: kidibox
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - name: Check Flake
+        run: nix flake check