build(nix): add per-crate crane workspace builds

.github/actions/setup-nix/action.yml

@@ -0,0 +1,47 @@
+name: Nix Build
+description: Install Nix, configure Cachix, and build flake targets.
+
+inputs:
+  build:
+    description: Flake output namespace, such as packages or checks.
+    required: true
+  system:
+    description: Nix system to build for.
+    required: true
+  targets:
+    description: Newline-separated package or check targets to build.
+    required: true
+  cachix_auth_token:
+    description: Cachix write token.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install Nix
+      uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          accept-flake-config = true
+
+    - name: Set up Cachix
+      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      with:
+        name: openshell
+        authToken: ${{ inputs.cachix_auth_token }}
+        skipAddingSubstituter: true
+
+    - name: Build targets
+      shell: bash
+      env:
+        BUILD: ${{ inputs.build }}
+        SYSTEM: ${{ inputs.system }}
+        TARGETS: ${{ inputs.targets }}
+      run: |
+        attrs=()
+        while IFS= read -r target; do
+          [ -n "$target" ] || continue
+          attrs+=(".#${BUILD}.${SYSTEM}.${target}")
+        done <<< "$TARGETS"
+
+        nix build "${attrs[@]}" --no-link --no-update-lock-file

.github/workflows/nix-ci.yml

@@ -0,0 +1,149 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Nix CI
+
+on:
+  push:
+    branches:
+      - main
+      - "pull-request/[0-9]+"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    name: Build (${{ matrix.target.system }})
+    runs-on: ${{ matrix.target.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - system: x86_64-linux
+            runner: linux-amd64-cpu8
+          - system: aarch64-linux
+            runner: linux-arm64-cpu8
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Build packages
+        uses: ./.github/actions/setup-nix
+        with:
+          build: packages
+          system: ${{ matrix.target.system }}
+          targets: |
+            openshell
+            openshell-gateway
+            openshell-sandbox
+            openshell-driver-kubernetes
+            openshell-driver-podman
+            openshell-driver-vm
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  images:
+    name: Build Images (${{ matrix.target.system }})
+    needs: build
+    runs-on: ${{ matrix.target.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - system: x86_64-linux
+            runner: linux-amd64-cpu8
+          - system: aarch64-linux
+            runner: linux-arm64-cpu8
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Build images
+        uses: ./.github/actions/setup-nix
+        with:
+          build: packages
+          system: ${{ matrix.target.system }}
+          targets: |
+            openshell-gateway-image
+            openshell-supervisor-image
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  test:
+    name: Test (${{ matrix.target.system }})
+    needs: build
+    runs-on: ${{ matrix.target.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - system: x86_64-linux
+            runner: linux-amd64-cpu8
+          - system: aarch64-linux
+            runner: linux-arm64-cpu8
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Run tests
+        uses: ./.github/actions/setup-nix
+        with:
+          build: checks
+          system: ${{ matrix.target.system }}
+          targets: |
+            openshell-bootstrap-test
+            openshell-cli-test
+            openshell-core-test
+            openshell-driver-docker-test
+            openshell-driver-kubernetes-test
+            openshell-driver-podman-test
+            openshell-driver-vm-test
+            openshell-ocsf-test
+            openshell-policy-test
+            openshell-prover-test
+            openshell-providers-test
+            openshell-router-test
+            openshell-sandbox-test
+            openshell-server-macros-test
+            openshell-server-test
+            openshell-tui-test
+            openshell-vfio-test
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  lint:
+    name: Lint
+    runs-on: linux-amd64-cpu8
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Run lints
+        uses: ./.github/actions/setup-nix
+        with:
+          build: checks
+          system: x86_64-linux
+          targets: |
+            rustfmt
+            spdx-headers
+            openshell-bootstrap-clippy
+            openshell-cli-clippy
+            openshell-core-clippy
+            openshell-driver-docker-clippy
+            openshell-driver-kubernetes-clippy
+            openshell-driver-podman-clippy
+            openshell-driver-vm-clippy
+            openshell-ocsf-clippy
+            openshell-policy-clippy
+            openshell-prover-clippy
+            openshell-providers-clippy
+            openshell-router-clippy
+            openshell-sandbox-clippy
+            openshell-server-macros-clippy
+            openshell-server-clippy
+            openshell-tui-clippy
+            openshell-vfio-clippy
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}