feat(ci): automate Nix dependency hash updates

.github/workflows/ci.yml

@@ -276,6 +276,19 @@ jobs:
       - name: JDBC plugin package check
         run: ./plugins/jdbc/package.sh
 
+  nix-packaging:
+    needs: changes
+    if: needs.changes.outputs.nix == 'true'
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
+      - name: Build Nix package
+        run: nix build .#dbx-desktop --no-link --print-build-logs
+
   changes:
     runs-on: ubuntu-22.04
     outputs:
@@ -285,6 +298,7 @@ jobs:
       rust_full: ${{ steps.rust-mode.outputs.full }}
       jdbc: ${{ steps.filter.outputs.jdbc }}
       agents: ${{ steps.filter.outputs.agents }}
+      nix: ${{ steps.filter.outputs.nix }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -325,6 +339,20 @@ jobs:
               - 'plugins/jdbc/**'
             agents:
               - 'agents/**'
+            nix:
+              # The fixed-output pnpm hash must change whenever the workspace dependency graph changes.
+              - 'package.json'
+              - 'packages/**/package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
+              - 'flake.nix'
+              - 'flake.lock'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'crates/**/Cargo.toml'
+              - 'src-tauri/Cargo.toml'
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/update-nix-pnpm-hash.yml'
 
       - name: Select Rust feature coverage
         id: rust-mode