ci: add nix-build job and required-checks job

Add a `nix-build` job to verify `nix build` works for all the packages
in the flake. Add a `required-checks` job to make branch protection
easier, meaning we can add more jobs with only a code modification
instead of a config change on the repo.

Test plan:
- CI

Author: JakeHillion

.github/workflows/ci.yml

@@ -14,6 +14,18 @@ jobs:
         nix --experimental-features 'nix-command flakes' fmt
         git diff --exit-code
 
+  nix-build:
+    name: Test Nix build
+    runs-on: 16-core-ubuntu
+    steps:
+    - uses: actions/[email protected]
+    - uses: cachix/install-nix-action@v27
+    - run: |
+        nix flake show --json \
+          | jq -r '.packages."x86_64-linux" | keys[]' \
+          | sed 's/^/.#/' \
+          | xargs nix build
+
   build-test:
     runs-on: 16-core-ubuntu
     strategy:
@@ -52,3 +64,16 @@ jobs:
       with:
         name: test-results-${{ matrix.llvm_version }}
         path: build/test/results.xml
+
+  required-checks:
+    runs-on: ubuntu-latest
+    needs: [
+      lint,
+      nix-build,
+      build-test,
+    ]
+    if: always()
+    env:
+      NEEDS_CONTEXT: ${{ toJSON(needs) }}
+    steps:
+      - run: echo "$NEEDS_CONTEXT" | jq -e 'to_entries | all(.value.result == "success")'