Add CI to prevent unformatted code from getting in

Also added is a `.git-blame-ignore-revs` file (also in nixpkgs) that can
be used in a gitconfig to prevent `git blame` from showing specific
commit revs. See https://git-scm.com/docs/git-blame#Documentation/git-blame.txt---ignore-revs-fileltfilegt
for more info.

.git-blame-ignore-revs

@@ -0,0 +1 @@
+da818e1101a49b1e86dc31f917502ac440630bab

.github/workflows/ci.yaml

@@ -0,0 +1,15 @@
+name: ci
+on:
+  workflow_dispatch: # allows manual triggering
+  pull_request:
+    branches:
+      - master
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - run: nix flake check

ci/formatting.nix

@@ -0,0 +1,6 @@
+{ lib, runCommand, fd, nixpkgs-fmt }:
+
+runCommand "repo-formatting" { } ''
+  ${lib.getExe fd} . -e nix ${../.} | xargs ${lib.getExe nixpkgs-fmt} --check
+  touch $out
+''

flake.nix

@@ -50,6 +50,12 @@
         };
       };
 
+      checks = nixpkgs.lib.mapAttrs
+        (system: _: {
+          formatting = nixpkgs.legacyPackages.${system}.callPackage ./ci/formatting.nix { };
+        })
+        self.legacyPackages;
+
       # Not everything here should be cross-compiled to aarch64-linux
       legacyPackages.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.callPackage ./default.nix { };
       legacyPackages.aarch64-linux = nixpkgs.legacyPackages.aarch64-linux.callPackage ./default.nix { };