chore: Verify tooling version for Nix-managed environments (#7862)

.github/workflows/check-tools.yml

@@ -0,0 +1,114 @@
+# Verifies the committed snapshots of `bin/check-tools.sh` output for each Nix
+# environment (see nix/check-tools/). If the environment changes — a new image
+# tag, an updated flake.lock, a different tool list — without the matching
+# snapshot being regenerated and committed, this workflow fails so the drift is
+# caught in review.
+#
+# To regenerate the snapshots, see nix/check-tools/README.md.
+name: Check tools
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/check-tools/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  push:
+    branches:
+      - "develop"
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/check-tools/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  # The nix-nixos image tag is pinned alongside the build matrix in linux.json,
+  # so snapshots are checked against the exact image CI builds against.
+  linux-image-tag:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Read nix image tag
+        id: tag
+        run: echo "tag=$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)" >>"${GITHUB_OUTPUT}"
+
+  # One job for all environments; they differ only in whether the tools come
+  # from the nix-nixos container (Linux) or `nix develop` (macOS).
+  check-tools:
+    needs: linux-image-tag
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu
+            snapshot: nix/check-tools/nix-nixos-amd64.txt
+            nix_develop: false
+          - runner: ubuntu-arm64
+            snapshot: nix/check-tools/nix-nixos-arm64.txt
+            nix_develop: false
+          - runner: macos-26-apple-clang-21
+            snapshot: nix/check-tools/macos.txt
+            nix_develop: true
+    runs-on: ${{ matrix.runner }}
+    # Linux runs inside the pinned nix-nixos image; macOS runs natively and uses
+    # the flake's dev shell instead (see the run step below).
+    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-nixos:{0}', needs.linux-image-tag.outputs.tag) || null }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
+        with:
+          enable_ccache: false
+
+      - name: Regenerate snapshot
+        env:
+          CHECK_TOOLS_SKIP_CLONE: "1"
+          # check-tools.sh skips some macOS tools when CI is set; the snapshots
+          # capture the full `nix develop` environment, so unset it here.
+          CI: ""
+        run: |
+          if [ "${{ matrix.nix_develop }}" = "true" ]; then
+              # `nix develop` prints the dev-shell greeting first; keep only the
+              # check-tools.sh output (from the "Detected OS:" line onward).
+              nix --extra-experimental-features "nix-command flakes" develop \
+                  -c bash bin/check-tools.sh | sed -n '/^Detected OS:/,$p' >"${{ matrix.snapshot }}"
+          else
+              bash bin/check-tools.sh >"${{ matrix.snapshot }}"
+          fi
+
+      - name: Verify snapshot is up to date
+        run: |
+          if ! git diff --exit-code -- "${{ matrix.snapshot }}"; then
+              echo "::error::${{ matrix.snapshot }} is out of date. Regenerate it (see nix/check-tools/README.md) and commit the result."
+              exit 1
+          fi
+
+      - name: Upload regenerated snapshot
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: check-tools-${{ runner.os }}-${{ runner.arch }}
+          path: ${{ matrix.snapshot }}