cicd.yml

name: CI/CD

on:
  pull_request:
  push:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-22.04, macos-13, macos-14]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: cachix/install-nix-action@v30
      - uses: cachix/cachix-action@v15
        with:
          name: nixbuild
          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
      - name: Build nix archives
        id: build-nix-archives
        run: |
          nix build .#nix-archives
          echo "result=$(readlink result)" >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@v4
        with:
          name: nix-archives-${{ runner.os }}
          path: ${{ steps.build-nix-archives.outputs.result }}/

  test:
    needs: build
    strategy:
      fail-fast: true
      matrix:
        os:
          - ubuntu-22.04
          - macos-14
          - macos-13
        nix_version:
          - 2.24.9
          - 2.23.3
          - 2.22.3
          - 2.21.4
          - 2.20.8
          - 2.19.6
          - 2.18.8
          - 2.3.18
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        id: nix-archives
        with:
          name: nix-archives-${{ runner.os }}
      - uses: ./
        with:
          nix_archives_url: file://${{steps.nix-archives.outputs.download-path}}
          nix_version: ${{ matrix.nix_version }}
          nix_on_tmpfs: true
      - name: Test nix
        run: nix-build -v --version
      - name: Add to store
        run: |
          file="$RANDOM"
          echo "$RANDOM" > "$file"
          path="$(nix-store --add "./$file")"

  test-cachix:
    needs: build
    strategy:
      fail-fast: true
      matrix:
        os:
          - ubuntu-22.04
          - macos-14
          - macos-13
        nix_version:
          - 2.24.9
          - 2.23.3
          - 2.22.3
          - 2.21.4
          - 2.20.8
          - 2.19.6
          - 2.18.8
          - 2.3.18
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        id: nix-archives
        with:
          name: nix-archives-${{ runner.os }}
      - uses: ./
        with:
          nix_archives_url: file://${{steps.nix-archives.outputs.download-path}}
          nix_version: ${{ matrix.nix_version }}
          nix_conf: ${{ matrix.nix_conf }}
      - uses: cachix/cachix-action@v15
        with:
          name: nixbuild
          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
          skipPush: true
      - name: Verify nix config
        run: |
          if ! egrep -q "^substituters = https://cache.nixos.org https://nixbuild.cachix.org$" "$HOME/.config/nix/nix.conf"; then
            echo "Invalid substituters config"
            exit 1
          fi
      - name: Push to Cachix
        if: github.event_name == 'push' && github.repository_owner == 'nixbuild'
        run: |
          dd if=/dev/urandom of=random count=1
          cachix push nixbuild "$(nix add-to-store random)"

  release:
    runs-on: ubuntu-latest
    needs:
      - build
      - test
      - test-cachix
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: nix-archives-Linux
          path: /tmp/archives
      - uses: actions/download-artifact@v4
        with:
          name: nix-archives-macOS
          path: /tmp/archives
      - uses: ./
        with:
          nix_archives_url: file:///tmp/archives
          nix_version: 2.24.9
      - uses: cachix/cachix-action@v15
        with:
          name: nixbuild
          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
      - name: Build release script
        run: nix build .#release
      - name: Release if needed
        run: ./result/bin/release /tmp/archives ./RELEASE
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}