add ensure hashes workflow

.github/workflows/nix-ci.yml

@@ -0,0 +1,31 @@
+name: Nix CI
+on:
+  push:
+  pull_request:
+jobs:
+  check-hashes:
+    name: Ensure Nix Hashes are up-to-date
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install nix
+        uses: cachix/install-nix-action@v22
+
+      - name: Prepare Nix shell
+        run: nix develop --impure .#ci
+
+      - name: Update npm Hashes
+        working-directory: nix/package/web
+        run: nix develop --impure .#ci --command "./update.sh"
+
+      - name: Update Composer Hashes
+        working-directory: nix/package
+        run: nix develop --impure .#ci --command "./update.sh"
+
+      - name: Check if up-to-date
+        shell: bash
+        run: |
+          if [ "$(git status --porcelain=v1 2>/dev/null | wc -l)" = "1" ]; then
+            git status
+            echo "::error::Nix hashes are not up to date"
+          fi

nix/shell.nix

@@ -1,9 +1,11 @@
 {...}: {
   perSystem = {
+    config,
     pkgs,
     lib,
     ...
-  }: {
+  }: rec {
+    devenv.shells.ci = devenv.shells.default;
     devenv.shells.default = {
       config,
       inputs,