fix(nix): make flake checks hermetic

.github/actions/setup-nix/action.yml

@@ -0,0 +1,47 @@
+name: Nix Build
+description: Install Nix, configure Cachix, and build flake targets.
+
+inputs:
+  build:
+    description: Flake output namespace, such as packages or checks.
+    required: true
+  system:
+    description: Nix system to build for.
+    required: true
+  targets:
+    description: Newline-separated package or check targets to build.
+    required: true
+  cachix_auth_token:
+    description: Cachix write token.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install Nix
+      uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          accept-flake-config = true
+
+    - name: Set up Cachix
+      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      with:
+        name: openshell
+        authToken: ${{ inputs.cachix_auth_token }}
+        skipAddingSubstituter: true
+
+    - name: Build targets
+      shell: bash
+      env:
+        BUILD: ${{ inputs.build }}
+        SYSTEM: ${{ inputs.system }}
+        TARGETS: ${{ inputs.targets }}
+      run: |
+        attrs=()
+        while IFS= read -r target; do
+          [ -n "$target" ] || continue
+          attrs+=(".#${BUILD}.${SYSTEM}.${target}")
+        done <<< "$TARGETS"
+
+        nix build "${attrs[@]}" --no-link --no-update-lock-file