Merge pull request #207 from loss-and-quick/ci/nix-fmt-check

ci: gate nix formatting on the treefmt flake check

Author: loss-and-quick

.github/workflows/ci.yml

@@ -226,6 +226,37 @@ jobs:
       - name: Build the desktop package
         run: nix build .#kasumi-desktop --accept-flake-config --print-build-logs
 
+  # ── Formatting gate for the nix expressions. The rust (`cargo fmt`), frontend
+  #    (`biome`), and shell (`shellcheck`) jobs each cover their own tree, but nothing
+  #    checked the `.nix` files — so alejandra/statix/deadnix drift (see #206, which
+  #    reformatted every expression) could land unnoticed. This realises the flake's
+  #    own treefmt check derivation: the exact `nix fmt` config, no duplicated
+  #    formatter list. treefmt runs all its formatters, but the nix ones are the only
+  #    CI gap it closes, so it's path-gated on the nix expressions like nix-build. ──
+  nix-fmt:
+    needs: changes
+    if: needs.changes.outputs.nix == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@da36cb69b1c3247ad7a1f931ebfd954a1105ef14 # v14
+        with:
+          extra-conf: |
+            accept-flake-config = true
+
+      - name: Cachix
+        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: kasumi-proxy
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: treefmt check (fails on any unformatted file)
+        run: nix build .#checks.x86_64-linux.treefmt --accept-flake-config --print-build-logs
+
   # ── Desktop compile smoke (Linux + Windows) on the plain rustup toolchain — the
   #    path release/nightly actually bundle with (the nix `nix-build` job realises the
   #    flake package; this proves the non-nix one). Compile-only (no bundle): catches
@@ -325,7 +356,7 @@ jobs:
   #    failure or cancellation fails CI. Point branch protection at THIS context so
   #    path-skipped jobs never block a merge. ──
   ci:
-    needs: [changes, frontend, shellcheck, rust, nix-build, desktop-linux, desktop-windows]
+    needs: [changes, frontend, shellcheck, rust, nix-build, nix-fmt, desktop-linux, desktop-windows]
     if: always()
     runs-on: ubuntu-latest
     steps: