move vm tests out of checks into a nightly vmTests workflow

.forgejo/workflows/vm-nightly.yml

@@ -0,0 +1,49 @@
+name: vm-nightly
+
+# Builds the `vmTests` flake output: tests that boot NixOS VMs and need KVM.
+# They are not `checks`, so the per-PR `nix flake check` job never runs them.
+# Nightly plus manual dispatch; a failing test fails the run, which the forge
+# shows as a failed scheduled run.
+#
+# Run one by hand from the forge UI (Actions, vm-nightly, "Run workflow",
+# `test` input) or locally with `nix build .#vmTests.x86_64-linux.<name>`.
+#
+# ⚠️ The hour is deliberate: at the default job capacity of 1
+# (`services.hyperhive.deploy.ci-runner.concurrency`) this job holds the
+# runner for its whole run and everything else queues behind it. It sits
+# between coverage (02:00) and flake-update (03:00).
+#
+# Separate from ci.yml because a `workflow_dispatch` trigger there fires every
+# job in that file, and this must not run per pull request.
+on:
+  workflow_dispatch:
+    inputs:
+      test:
+        description: "vmTests attribute to build (empty builds all)"
+        required: false
+        default: ""
+  schedule:
+    - cron: "30 2 * * *"
+
+jobs:
+  vm-tests:
+    name: nix build vmTests
+    if: vars.PUBLIC_FORGE != 'true'
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: build
+        env:
+          TEST: ${{ inputs.test }}
+        run: |
+          set -eu
+          system=x86_64-linux
+          tests="$TEST"
+          if [ -z "$tests" ]; then
+            tests="$(nix eval --raw ".#vmTests.$system" --apply 'ts: builtins.concatStringsSep " " (builtins.attrNames ts)')"
+          fi
+          set --
+          for t in $tests; do
+            set -- "$@" ".#vmTests.$system.$t"
+          done
+          nix build --no-link --keep-going --print-build-logs "$@"