nix.yml

name: Nix

on:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: nix-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect code changes
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.detect.outputs.code_changed }}
      nix_lock: ${{ steps.detect.outputs.nix_lock_changed }}
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Detect code changes
        id: detect
        env:
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.sha }}
        run: .github/scripts/detect-code-changes.sh "$BASE_SHA" "$HEAD_SHA"

  package:
    name: Package
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Nix
        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
        with:
          extra_nix_config: |
            extra-substituters = https://nix-community.cachix.org
            extra-trusted-public-keys = nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=

      - name: Verify Nix dependency lockfile
        if: needs.changes.outputs.nix_lock == 'true'
        run: |
          nix run .#update-bun-lock
          if ! git diff --exit-code nix/bun.lock.nix; then
            echo "::error::Nix lockfile is out of date. Please run 'bun run nix:update-lock' and commit the changes to nix/bun.lock.nix."
            exit 1
          fi

      # The host check realizes bun2nix paths that the following cross-system
      # evaluation references, even though that evaluation does not build outputs.
      - name: Check flake outputs
        run: nix flake check --print-build-logs

      - name: Evaluate all supported systems
        run: nix flake check --all-systems --no-build

      - name: Build Hunk package
        run: nix build .#default --print-build-logs

      - name: Smoke test Nix package
        run: |
          ./result/bin/hunk --version
          skill_path="$(./result/bin/hunk skill path)"
          test -f "$skill_path"