flake: add coding-agent validation workflow

flake/default.nix

@@ -3,5 +3,6 @@
     ./formatter.nix
     ./git-hooks.nix
     ./registry.nix
+    ./validation.nix
   ];
 }

flake/git-hooks.nix

@@ -34,7 +34,9 @@
             ];
           };
 
+          actionlint.enable = true;
           deadnix.enable = true;
+          ruff.enable = true;
           statix.enable = true;
           shellcheck.enable = true;
         };

flake/registry.nix

@@ -25,23 +25,63 @@ let
     else
       { };
   configurations = dotfilesLib.hosts.mkConfigurations hostSpecs;
+
+  validationMetadata = {
+    schemaVersion = 1;
+
+    hosts = lib.mapAttrs (
+      name: spec:
+      let
+        isDarwin = lib.hasSuffix "-darwin" spec.system;
+      in
+      {
+        inherit (spec) system user;
+        kind = if isDarwin then "darwin" else "nixos";
+        homeManager = spec.homeManager or true;
+        selectedUnits = dotfilesLib.hosts.selectedUnits spec;
+        buildAttr =
+          if isDarwin then
+            "darwinConfigurations.${name}.system"
+          else
+            "nixosConfigurations.${name}.config.system.build.toplevel";
+      }
+    ) hostSpecs;
+
+    units = lib.mapAttrs (
+      _id: unit: {
+        inherit (unit) id relativePath;
+        directory = "modules/${lib.concatStringsSep "/" unit.relativePath}";
+        includes = unit.meta.includes;
+        fragments = builtins.attrNames (lib.filterAttrs (_: value: value != null) unit.fragments);
+      }
+    ) dotfilesLib.registry.units;
+  };
 in
 {
   flake = {
     inherit (configurations) darwinConfigurations nixosConfigurations;
-    lib = dotfilesLib;
+    lib = dotfilesLib // { inherit validationMetadata; };
   };
 
   perSystem =
     { pkgs, system, ... }:
     let
-      nixosChecks =
-        lib.mapAttrs' (name: nixos: lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel)
-          (
-            lib.filterAttrs (
-              _: nixos: nixos.pkgs.stdenv.hostPlatform.system == system
-            ) configurations.nixosConfigurations
-          );
+      nixosChecks = lib.mapAttrs' (
+        name: nixos:
+        lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel
+      ) (
+        lib.filterAttrs (
+          name: _: hostSpecs.${name}.system == system
+        ) configurations.nixosConfigurations
+      );
+      darwinChecks = lib.mapAttrs' (
+        name: darwin:
+        lib.nameValuePair "darwin-${name}" darwin.system
+      ) (
+        lib.filterAttrs (
+          name: _: hostSpecs.${name}.system == system
+        ) configurations.darwinConfigurations
+      );
     in
     {
       checks = {
@@ -49,6 +89,7 @@ in
           inherit inputs lib pkgs;
         };
       }
-      // nixosChecks;
+      // nixosChecks
+      // darwinChecks;
     };
 }

flake/validation.nix

@@ -0,0 +1,48 @@
+_: {
+  perSystem =
+    { pkgs, config, ... }:
+    let
+      script = pkgs.writeText "dotfiles-check.py" (builtins.readFile ../scripts/dotfiles-check.py);
+      dotfilesCheck = pkgs.writeShellApplication {
+        name = "dotfiles-check";
+        runtimeInputs = [
+          pkgs.git
+          pkgs.nix
+          pkgs.python3
+        ];
+        text = ''
+          exec python3 ${script} "$@"
+        '';
+      };
+    in
+    {
+      apps = {
+        check = {
+          type = "app";
+          program = "${dotfilesCheck}/bin/dotfiles-check";
+        };
+        nix-fast-build = {
+          type = "app";
+          program = "${pkgs.nix-fast-build}/bin/nix-fast-build";
+        };
+      };
+
+      packages = {
+        dotfiles-check = dotfilesCheck;
+        inherit (pkgs) nix-fast-build;
+      };
+
+      devShells.validation = config.pre-commit.devShell;
+
+      checks = {
+        validation-tool = pkgs.runCommand "dotfiles-check-self-test" {
+          nativeBuildInputs = [ dotfilesCheck ];
+        } ''
+          dotfiles-check self-test
+          touch "$out"
+        '';
+
+        dotnix-shell = config.devShells.dotnix;
+      };
+    };
+}