cicd.yml

name: CI/CD

on:
  pull_request:
  push:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-22.04, macos-13]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - uses: ./
        with:
          nix_archives_url: https://github.com/nixbuild/nix-quick-install-action/releases/download/v28
          nix_version: 2.21.0
      - uses: cachix/cachix-action@v12
        with:
          name: nixbuild
          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
      - name: Build nix archives
        id: build-nix-archives
        run: |
          nix build .#nix-archives
          echo "result=$(readlink result)" >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@v3
        with:
          name: nix-archives-${{ runner.os }}
          path: ${{ steps.build-nix-archives.outputs.result }}/

  test:
    needs: build
    strategy:
      fail-fast: true
      matrix:
        os:
          - ubuntu-22.04
          - macos-14
          - macos-13
        nix_version:
          - 2.24.9
          - 2.23.3
          - 2.22.3
          - 2.21.4
          - 2.20.8
          - 2.19.6
          - 2.18.8
          - 2.3.18
    runs-on: ${{ matrix.os }}
    steps:
      - uses: divnix/nix-cache-action@v3.0.11-nix
        with:
          key: test-${{matrix.os}}-nix-${{matrix.nix_version}}-${{github.run_id}}-${{github.run_attempt}}
          path: |
            /nix
            ~/.cache/nix
      - uses: actions/checkout@v3
      - uses: actions/download-artifact@v3
        id: nix-archives
        with:
          name: nix-archives-${{ runner.os }}
      - uses: ./
        with:
          nix_archives_url: file://${{steps.nix-archives.outputs.download-path}}
          nix_version: ${{ matrix.nix_version }}
          nix_on_tmpfs: true
      - name: Test nix
        run: nix-build -v --version
      - name: Add to store
        run: |
          file="$RANDOM"
          echo "$RANDOM" > "$file"
          path="$(nix-store --add "./$file")"
          mkdir -p ~/.cache/nix
          ln -s "$path" ~/.cache/nix/test-path

  test-cachix:
    needs: build
    strategy:
      fail-fast: true
      matrix:
        os:
          - ubuntu-22.04
          - macos-14
          - macos-13
        nix_version:
          - 2.24.9
          - 2.23.3
          - 2.22.3
          - 2.21.4
          - 2.20.8
          - 2.19.6
          - 2.18.8
          - 2.3.18
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - uses: actions/download-artifact@v3
        id: nix-archives
        with:
          name: nix-archives-${{ runner.os }}
      - uses: ./
        with:
          nix_archives_url: file://${{steps.nix-archives.outputs.download-path}}
          nix_version: ${{ matrix.nix_version }}
          nix_conf: ${{ matrix.nix_conf }}
      - uses: cachix/cachix-action@v12
        with:
          name: nixbuild
          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
          skipPush: true
      - name: Verify nix config
        run: |
          if ! egrep -q "^substituters = https://cache.nixos.org https://nixbuild.cachix.org$" "$HOME/.config/nix/nix.conf"; then
            echo "Invalid substituters config"
            exit 1
          fi
      - name: Push to Cachix
        if: github.event_name == 'push' && github.repository_owner == 'nixbuild'
        run: |
          dd if=/dev/urandom of=random count=1
          cachix push nixbuild "$(nix add-to-store random)"

  test-overwrite-nix-dir:
    needs: test
    strategy:
      fail-fast: true
      matrix:
        os:
          - ubuntu-22.04
          - macos-14
          - macos-13
        nix_version:
          - 2.24.9
          - 2.23.3
          - 2.22.3
          - 2.21.4
          - 2.20.8
          - 2.19.6
          - 2.18.8
          - 2.3.18
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - uses: actions/download-artifact@v3
        id: nix-archives
        with:
          name: nix-archives-${{ runner.os }}
      # For MacOS, we'll run our action before restoring the cache, in order
      # to create the /nix directory, so the cache can be restored. Then we run
      # the action again after the cache has been restored. I guess
      # divnix/nix-cache-action could be changed to create the /nix directory
      # on MacOS.
      - name: Create /nix on MacOS
        if: ${{ startsWith(matrix.os, 'macos-') }}
        uses: ./
        with:
          nix_archives_url: file://${{steps.nix-archives.outputs.download-path}}
          nix_version: ${{ matrix.nix_version }}
      - name: Restore cache
        uses: divnix/nix-cache-action@v3.0.11-nix
        with:
          key: test-${{matrix.os}}-nix-${{matrix.nix_version}}-${{github.run_id}}-${{github.run_attempt}}
          path: |
            /nix
            ~/.cache/nix
      - uses: ./
        with:
          nix_archives_url: file://${{steps.nix-archives.outputs.download-path}}
          nix_version: ${{ matrix.nix_version }}
          nix_on_tmpfs: true
      - name: Test nix
        run: nix-build -v --version
      - name: Verify store path
        run: |
          stat ~/.cache/nix/test-path
          nix-store --verify-path ~/.cache/nix/test-path

  release:
    runs-on: ubuntu-latest
    needs:
      - build
      - test
      - test-cachix
      - test-overwrite-nix-dir
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    steps:
      - uses: actions/checkout@v3
      - uses: actions/download-artifact@v3
        with:
          name: nix-archives-Linux
          path: /tmp/archives
      - uses: actions/download-artifact@v3
        with:
          name: nix-archives-macOS
          path: /tmp/archives
      - uses: ./
        with:
          nix_archives_url: file:///tmp/archives
          nix_version: 2.19.3
      - uses: cachix/cachix-action@v12
        with:
          name: nixbuild
          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
      - name: Build release script
        run: nix build .#release
      - name: Release if needed
        run: ./result/bin/release /tmp/archives ./RELEASE
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}