ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main, master]

permissions:
  id-token: "write"
  contents: "read"

jobs:
  build-x86_64-linux:
    uses: ./.github/workflows/build-x86_64-linux.yml

  # build-aarch64-linux:
  #   uses: ./.github/workflows/build-aarch64-linux.yml

  lints:
    name: Lints
    runs-on: ubuntu-latest
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v4
      - name: Check Nixpkgs input
        uses: DeterminateSystems/flake-checker-action@main
        with:
          fail-mode: true
          check-outdated: false # PRs shouldn't fail because main's nixpkgs is out of date
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
      - uses: DeterminateSystems/magic-nix-cache-action@main
        with:
          use-gha-cache: false
      - name: Check rustfmt
        run: nix develop --command bash -c 'cd nixsa-bin && check-rustfmt'
      - name: Check Clippy
        run: nix develop --command bash -c 'cd nixsa-bin && check-clippy'
      - name: Check Spelling
        run: nix develop --command bash -c 'cd nixsa-bin && check-spelling'
      - name: Check nixpkgs-fmt formatting
        run: nix develop --command bash -c 'cd nixsa-bin && check-nixpkgs-fmt'
      - name: Check EditorConfig conformance
        run: nix develop --command bash -c 'cd nixsa-bin && check-editorconfig'

  run-x86_64-linux:
    name: Run x86_64 Linux
    runs-on: ubuntu-latest
    needs: [lints, build-x86_64-linux]
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v4
      - name: Restore Github cache artifacts
        uses: actions/cache/restore@v4
        with:
          path: nixsa-*.tar.xz
          key: x86_64-linux-artifacts-${{ github.sha }}
      - name: Install bubblewrap
        run: sudo apt-get -y install bubblewrap
      - name: Check tarball
        run: nixsa-build/check_tarball.py nixsa-*.tar.xz


  # run-aarch64-linux:
  #   name: Run aarch64 Linux
  #   runs-on: namespace-profile-default-arm64
  #   needs: [lints, build-aarch64-linux]
  #   permissions:
  #     id-token: "write"
  #     contents: "read"
  #   steps:
  #     - uses: actions/checkout@v4
  #     - name: Restore Github cache artifacts
  #       uses: actions/cache/restore@v4
  #       with:
  #         path: nixsa-*.tar.xz
  #         key: aarch64-linux-artifacts-${{ github.sha }}
  #     - name: Check tarball
  #       run: nixsa-build/check_tarball.py nixsa-*.tar.xz