workflows/build: build nixpkgs tarball

This adds a build job for the tarball, which might help uncover eval
issues on attributes not normally touched by Eval, aka those added in
`pkgs/top-level/packages-config.nix`.

.github/workflows/build.yml

@@ -27,8 +27,8 @@ jobs:
         include:
           - runner: ubuntu-24.04
             system: x86_64-linux
-            builds: [shell, manual-nixos, lib-tests]
-            desc: shell, docs, lib
+            builds: [shell, manual-nixos, lib-tests, tarball]
+            desc: shell, docs, lib, tarball
           - runner: ubuntu-24.04-arm
             system: aarch64-linux
             builds: [shell, manual-nixos, manual-nixpkgs, manual-nixpkgs-tests]
@@ -85,6 +85,10 @@ jobs:
         if: contains(matrix.builds, 'lib-tests') && !cancelled()
         run: nix-build untrusted/ci -A lib-tests
 
+      - name: Build tarball
+        if: contains(matrix.builds, 'tarball') && !cancelled()
+        run: nix-build untrusted/ci -A tarball
+
       - name: Upload NixOS manual
         if: |
           contains(matrix.builds, 'manual-nixos') && !cancelled() &&

ci/default.nix

@@ -89,7 +89,7 @@ let
     };
 
 in
-{
+rec {
   inherit pkgs fmt;
   requestReviews = pkgs.callPackage ./request-reviews { };
   codeownersValidator = pkgs.callPackage ./codeowners-validator { };
@@ -113,4 +113,18 @@ in
     minimum = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.minimum; };
   };
   shell = import ../shell.nix { inherit nixpkgs system; };
+  tarball = import ../pkgs/top-level/make-tarball.nix {
+    # Mirrored from top-level release.nix:
+    nixpkgs = {
+      outPath = pkgs.lib.cleanSource ../.;
+      revCount = 1234;
+      shortRev = "abcdef";
+      revision = "0000000000000000000000000000000000000000";
+    };
+    officialRelease = false;
+    inherit pkgs lib-tests;
+    # 2.28 / 2.29 take 9x longer than 2.30 or Lix.
+    # TODO: Switch back to nixVersions.latest
+    nix = pkgs.lix;
+  };
 }