ci: evaluate with nix-eval-jobs under a memory cap, then build the checks

scripts/ci-flake-check.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+# CI's "nix flake check" job: the same coverage as `nix flake check` on
+# x86_64-linux, as two processes so the evaluator has exited before any build
+# starts and no single evaluator holds the whole suite's heap.
+#
+# 1. nix-eval-jobs evaluates every check, package, dev shell, the formatter
+#    and each nixosConfiguration's toplevel, one worker at a time. A worker
+#    past --max-memory-size is replaced after its current attribute, so the
+#    peak is about the cap plus the heaviest single attribute.
+# 2. nix build builds the checks' derivations. The other attributes are
+#    evaluated only, as `nix flake check` does.
+#
+# nix-eval-jobs reports an evaluation error as an `error` field on that
+# attribute's line, not as its exit status, so this script fails on any.
+#
+# Needs nix-eval-jobs and jq on PATH; ci.yml takes both from the flake's
+# pinned nixpkgs.
+set -eu
+
+system=x86_64-linux
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+nix-eval-jobs \
+  --workers 1 \
+  --max-memory-size 4096 \
+  --gc-roots-dir "$work/gcroots" \
+  --flake . \
+  --select "flake: let o = flake.outputs; group = s: s // { recurseForDerivations = true; }; in {
+    checks = group o.checks.$system;
+    packages = group o.packages.$system;
+    devShells = group o.devShells.$system;
+    formatter = o.formatter.$system;
+    nixosConfigurations = group (builtins.mapAttrs (_: c: c.config.system.build.toplevel) o.nixosConfigurations);
+  }" >"$work/jobs.json"
+
+jq -r 'select(has("error")) | "\(.attr): \(.error)"' "$work/jobs.json" >"$work/errors"
+if [ -s "$work/errors" ]; then
+  echo "evaluation failed for $(jq -s 'map(select(has("error"))) | length' "$work/jobs.json") attribute(s):" >&2
+  cat "$work/errors" >&2
+  exit 1
+fi
+
+jq -r 'select(.attrPath[0] == "checks") | .drvPath + "^*"' "$work/jobs.json" >"$work/build"
+if [ ! -s "$work/build" ]; then
+  echo "nix-eval-jobs returned no checks; the --select expression matched nothing" >&2
+  exit 1
+fi
+echo "evaluated $(jq -s length "$work/jobs.json") attributes; building $(wc -l <"$work/build") checks"
+
+set --
+while IFS= read -r drv; do
+  set -- "$@" "$drv"
+done <"$work/build"
+nix build --no-link --keep-going "$@"