ci: build the flake and guard the version literal (#39)

Two gaps the nix packaging left open:

- Nothing built the flake, so a go.sum move that stales vendorHash stayed
  invisible until someone installed the CLI with nix. The new `nix` job
  builds chrome-cdp and runs the binary, so the PR that moves go.sum goes red.
- flake.nix carries the version as a literal, because a flake building
  `src = self` has no git tag to read. The release workflow now fails when
  the tag and that literal disagree, rather than shipping a binary that
  reports the wrong version.

Author: sanketsudake

.github/workflows/ci.yml

@@ -77,3 +77,19 @@ jobs:
 
       - name: Test the npm installer shim
         run: cd npm && node --test
+
+  # The flake is how this CLI reaches nix users (sanketsudake/dotfiles installs
+  # it that way), and its vendorHash goes stale whenever go.sum moves. Building
+  # it here makes the PR that moves go.sum go red, instead of the break landing
+  # on a machine downstream.
+  nix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: "experimental-features = nix-command flakes"
+      - name: Build the flake package
+        run: nix build .#chrome-cdp --print-build-logs
+      - name: Smoke-test the built binary
+        run: ./result/bin/chrome-cdp --version

.github/workflows/release.yml

@@ -20,6 +20,19 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+
+      # A flake building `src = self` has no git tag to read, so flake.nix
+      # carries the version as a literal. Fail the release rather than ship a
+      # binary that reports the wrong version to nix users.
+      - name: flake.nix version matches the tag
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          flake=$(sed -n 's/^ *version = "\(.*\)";$/\1/p' flake.nix)
+          if [ "$tag" != "$flake" ]; then
+            echo "::error::tag $tag does not match flake.nix version $flake"
+            exit 1
+          fi
+
       - uses: goreleaser/goreleaser-action@v6
         with:
           version: "~> v2"