vm-tests: full-setup script lives in full-setup.py, build-time values in env, ruff in ci

.forgejo/workflows/ci.yml

@@ -99,6 +99,19 @@ jobs:
           fi
           echo "$files" | xargs nix develop -c shellcheck -S warning
 
+  ruff-vm-tests:
+    name: ruff (vm-tests)
+    if: vars.PUBLIC_FORGE != 'true'
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: lint
+        # ruff from this flake's nixpkgs pin, as the jq job does. The config in
+        # nix/vm-tests/ruff.toml names the globals the test driver provides.
+        run: |
+          nix shell --inputs-from . nixpkgs#ruff --command sh -c \
+            'ruff check nix/vm-tests && ruff format --check nix/vm-tests'
+
   prose-lint:
     name: prose lint (vale)
     if: vars.PUBLIC_FORGE != 'true'