Fix Nix flake recursion and enforce root/workspace Nix validation in PR CI

[Copilot]

nix build could fail at flake evaluation due to an infinite recursion in zebra-crosslink/flake/default.nix, and CI did not consistently validate the same Nix entrypoints contributors run locally. This update fixes the flake recursion and adds explicit PR-time verification for both repository-root and zebra-crosslink Nix flows.

• Flake evaluation fix (zebra-crosslink/flake/default.nix)

  • Converted flakelib to a recursive attrset (rec) and removed self-referential inheritance that triggered infinite recursion during evaluation.

• PR validation workflow (.github/workflows/nix-verify.yml)

  • Added/updated a dedicated Nix verification workflow for PRs and pushes to main.
  • Installs Nix, enables cache, then runs:
    • nix build --print-build-logs in repo root
    • nix build --print-build-logs in zebra-crosslink
    • nix develop --command cargo build in zebra-crosslink

• Coverage alignment with contributor usage

  • Ensures CI checks both flake entrypoints (root and workspace) instead of only the workspace path.

jobs:
  nix-verify:
    defaults:
      run:
        working-directory: zebra-crosslink
    steps:
      - name: Verify root nix build
        working-directory: ${{ github.workspace }}
        run: nix build --print-build-logs
      - name: Verify nix build
        run: nix build --print-build-logs
      - name: Verify nix develop cargo build
        run: nix develop --command cargo build

[shielded-nate]

The first verification step I did immediately failed; @copilot please fix:

$ nix build --print-build-logs
error:
       … while evaluating the attribute 'root.result'
         at «flakes-internal»/call-flake.nix:94:7:
           93|     {
           94|       result =
             |       ^
           95|         if node.flake or true then

       … in the left operand of the update (//) operator
         at «flakes-internal»/call-flake.nix:81:9:
           80|         # This is shadowed in the next //
           81|         // sourceInfo
             |         ^
           82|         // {

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: syntax error, unexpected '='
       at /nix/store/srq4vs55a79jfdr6a0h1qwyigqynw8pn-source/zebra-crosslink/flake/outputs.nix:135:17:
          134|         do
          135|           files+=("$f")
             |                 ^
          136|         done < <(find '${p}' -type f -name '*.nix' -print0)

[Copilot]

The first verification step I did immediately failed; @copilot please fix:

Addressed in c01eee8. The shared nixfmt-check shell generation no longer emits the invalid syntax; it now routes each configured path through a simpler check_path helper and preserves formatter failures.

[shielded-nate]

I still cannot verify a simple nix build on my system. @copilot please ensure the github action verification is using nix and running a similar command for verification, and also, fix the error shown here:

$ time nix build --print-build-logs
error:
       … while calling the 'import' builtin
         at /nix/store/149l5az424sdxh3vvfykxf102siwhnb1-source/zebra-crosslink/flake/default.nix:26:10:
           25| let
           26|   pkgs = import nixpkgs {
             |          ^
           27|     inherit system;

       … while realising the context of a path

       … while evaluating the attribute 'nixpkgs'
         at /nix/store/149l5az424sdxh3vvfykxf102siwhnb1-source/zebra-crosslink/flake/default.nix:40:5:
           39|   flakelib = {
           40|     nixpkgs = pkgs;
             |     ^
           41|

       error: infinite recursion encountered
       at /nix/store/149l5az424sdxh3vvfykxf102siwhnb1-source/zebra-crosslink/flake/default.nix:40:5:
           39|   flakelib = {
           40|     nixpkgs = pkgs;
             |     ^
           41|

real    0m1.838s
user    0m0.131s
sys     0m0.285s