nix-checks.yaml

name: Nix

on:
  pull_request:

# Cancel an in-progress run when a newer commit supersedes it on the same
# branch (e.g. when update-vendor-hash pushes a hash fix).
concurrency:
  group: nix-checks-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  list:
    runs-on: ubuntu-latest
    outputs:
      checks: ${{ steps.checks.outputs.result }}
      packages: ${{ steps.packages.outputs.result }}
    steps:
      - uses: actions/checkout@v6
      - uses: DeterminateSystems/nix-installer-action@v21
      - id: checks
        run: |
          CHECKS=$(nix eval .#checks.x86_64-linux \
            --apply builtins.attrNames --json)
          echo "result=$CHECKS" >> "$GITHUB_OUTPUT"
      - id: packages
        run: |
          PACKAGES=$(nix eval .#packages.x86_64-linux \
            --apply 'ps: builtins.attrNames (removeAttrs ps ["default"])' \
            --json)
          echo "result=$PACKAGES" >> "$GITHUB_OUTPUT"

  checks:
    needs: list
    runs-on: ubuntu-latest
    strategy:
      matrix:
        check: ${{ fromJSON(needs.list.outputs.checks) }}
    steps:
      - uses: actions/checkout@v6
      - uses: DeterminateSystems/nix-installer-action@v21
      - uses: DeterminateSystems/magic-nix-cache-action@v13
      - run: nix build .#checks.x86_64-linux.${{ matrix.check }}

  packages:
    needs: list
    runs-on: ubuntu-latest
    strategy:
      matrix:
        package: ${{ fromJSON(needs.list.outputs.packages) }}
    steps:
      - uses: actions/checkout@v6
      - uses: DeterminateSystems/nix-installer-action@v21
      - uses: DeterminateSystems/magic-nix-cache-action@v13
      - run: nix run .#${{ matrix.package }}
      - run: git diff --exit-code

  nix-checks-pass:
    if: always()
    needs: [list, checks, packages]
    runs-on: ubuntu-latest
    steps:
      - if: >-
          contains(needs.*.result, 'failure') ||
          contains(needs.*.result, 'cancelled')
        run: exit 1