nix: Move postgrest-check-static inside derivation of static package

This will make the static build fail if we're not producing a static binary.

.github/workflows/ci.yaml

@@ -134,14 +134,9 @@ jobs:
       - uses: actions/checkout@v4
       - name: Setup Nix Environment
         uses: ./.github/actions/setup-nix
-        with:
-          tools: tests
-          cache-id: common
 
       - name: Build static executable
         run: nix-build -A postgrestStatic
-      - name: Check static executable
-        run: postgrest-check-static result/bin/postgrest
       - name: Save built executable as artifact
         uses: actions/upload-artifact@v4
         with:

nix/static.nix

@@ -46,9 +46,21 @@ let
       });
     });
 
-  makeExecutableStatic = drv:
+  makeExecutableStatic = drv: pkgs.lib.pipe drv [
-    lib.justStaticExecutables
+    (lib.compose.appendConfigureFlags [ "--enable-executable-static" ])
-      (lib.appendConfigureFlag drv "--enable-executable-static");
+    lib.compose.justStaticExecutables
+    (lib.compose.overrideCabal (drv: {
+      postInstall = ''
+        exe="$out/bin/postgrest"
+        if ! (file "$exe" | grep 'statically linked') then
+          echo "not a static executable, ldd output:"
+          ldd "$exe"
+          exit 1
+        fi
+        "$exe" --help
+      '';
+    }))
+  ];
 
 in
 {

nix/tools/tests.nix

@@ -192,26 +192,6 @@ let
         sed -i 's|^module \(.*\):|module \1/|g' test/coverage.overlay
       '';
 
-  checkStatic =
-    checkedShellScript
-      {
-        name = "postgrest-check-static";
-        docs = "Verify that the argument is a static executable.";
-        args = [ "ARG_POSITIONAL_SINGLE([executable], [Executable])" ];
-        inRootDir = true;
-        withEnv = postgrest.env;
-      }
-      ''
-        exe="$_arg_executable"
-        ldd_output=$(ldd "$exe" 2>&1 || true)
-        if ! grep -q "not a dynamic executable" <<< "$ldd_output"; then
-          echo "not a static executable, ldd output:"
-          echo "$ldd_output"
-          exit 1
-        fi
-        "$exe" --help
-      '';
-
 in
 buildToolbox
 {
@@ -225,6 +205,5 @@ buildToolbox
       dumpSchema
       coverage
       coverageDraftOverlay
-      checkStatic
     ];
 }