test.yml

name: test
on:
  push:
    branches: [main]
    paths: ["**/*.nix"]
  pull_request:
    types: [labeled, opened, synchronize, reopened, review_requested, ready_for_review]
    paths: ["**/*.nix"]
  pull_request_review:
    types: [submitted]
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # never cancel main builds: back-to-back merges would leave main untested
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
env:
  NIX_PATH: "nixpkgs=https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
jobs:
  non-draft:
    runs-on: ubuntu-latest
    # review events: only approvals re-trigger CI; comment reviews would
    # otherwise produce skipped check runs that overwrite real test results
    if: ${{github.ref == 'refs/heads/main' || (github.event.pull_request.draft == false && (github.event_name != 'pull_request_review' || github.event.review.state == 'approved'))}}
    outputs:
      nix-changed: ${{ steps.diff.outputs.nix-changed }}
    steps:
      - uses: actions/checkout@v6
      - id: diff
        # pull_request_review has no paths filter, so docs-only PRs reach here;
        # downstream jobs skip on nix-changed=false (skipped required checks
        # count as passing, which is what lets docs-only PRs merge)
        run: |
          if [[ "${{github.ref}}" == "refs/heads/main" ]]; then
            echo "nix-changed=true" >> "$GITHUB_OUTPUT"
          else
            git fetch --depth 1 origin refs/heads/main
            if git diff --name-only origin/main..${{github.sha}} -- | grep -q '\.nix$'; then
              echo "nix-changed=true" >> "$GITHUB_OUTPUT"
            else
              echo "nix-changed=false" >> "$GITHUB_OUTPUT"
            fi
          fi
  allow-ci:
    needs: [non-draft]
    name: allow-ci
    runs-on: ubuntu-latest
    steps:
      - name: Check access
        if: ${{github.event_name == 'pull_request' || github.event_name == 'pull_request_review'}}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # labels are queried live, not from github.event: re-runs reuse the
        # payload frozen at trigger time, so a label added after a failure
        # would never be seen. auto-allow-ci's GITHUB_TOKEN labeling also does
        # not re-trigger workflows, hence the permission-check fallback.
        run: |
          if gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels --jq '.[].name' | grep -qx 'allow-ci'; then
            exit 0
          fi
          perm=$(gh api repos/${{ github.repository }}/collaborators/${{ github.event.pull_request.user.login }}/permission --jq '.permission') || perm=none
          if [[ "$perm" != "admin" && "$perm" != "write" ]]; then
            echo "::error::PR author does not have write access and PR is missing allow-ci label"
            exit 1
          fi
  ci-deep:
    needs: [non-draft, allow-ci]
    # runs even when allow-ci fails so the required check goes red instead of
    # skipped (skipped required checks count as passing and would allow merge)
    if: ${{!cancelled() && needs.non-draft.result == 'success' && needs.non-draft.outputs.nix-changed == 'true'}}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    name: Tests ${{matrix.os}}
    runs-on: ${{matrix.os}}
    steps:
      - name: Require allow-ci
        run: test "${{needs.allow-ci.result}}" == "success"
      - uses: wimpysworld/nothing-but-nix@v10
      - uses: cachix/install-nix-action@v31
      - uses: DeterminateSystems/magic-nix-cache-action@v13
      - uses: actions/checkout@v6
      - run: nix-shell --run 'just ci-deep'
  flake-check:
    needs: [non-draft, allow-ci]
    if: ${{!cancelled() && needs.non-draft.result == 'success' && needs.non-draft.outputs.nix-changed == 'true'}}
    name: nix flake check
    runs-on: ubuntu-latest
    steps:
      - name: Require allow-ci
        run: test "${{needs.allow-ci.result}}" == "success"
      - uses: cachix/install-nix-action@v31
      - run: nix flake check -L github:vic/checkmate --override-input target github:$GITHUB_REPOSITORY/$GITHUB_SHA
  noflake:
    needs: [non-draft, allow-ci]
    if: ${{needs.non-draft.outputs.nix-changed == 'true'}}
    name: noflake
    runs-on: ubuntu-latest
    steps:
      - uses: wimpysworld/nothing-but-nix@v10
      - uses: cachix/install-nix-action@v31
      - uses: DeterminateSystems/magic-nix-cache-action@v13
      - uses: actions/checkout@v6
      - run: sed -i 's@# den.outPath@den.outPath@' templates/noflake/default.nix
      - run: |
          cat <<-EOF > templates/noflake/modules/ci-runtime.nix
          {
            _module.args.CI = true;
          }
          EOF
          git add templates/noflake/modules/ci-runtime.nix
      - run: (cd templates/noflake && nix-build ./default.nix -A flake.nixosConfigurations.igloo.config.system.build.toplevel)
      - run: (cd templates/noflake && nix-shell ./default.nix -A den.sh --run 'igloo build --offline')
  template:
    needs: [non-draft, allow-ci]
    if: ${{needs.non-draft.outputs.nix-changed == 'true'}}
    # max-parallel: 2
    strategy:
      matrix:
        template: [bogus, minimal, microvm, nvf-standalone, flake-parts-modules]
        os: [ubuntu-latest]
    name: Check template ${{matrix.template}} ${{matrix.os}}
    runs-on: ${{matrix.os}}
    steps:
      - uses: wimpysworld/nothing-but-nix@v10
      - uses: cachix/install-nix-action@v31
      - uses: DeterminateSystems/magic-nix-cache-action@v13
      - uses: actions/checkout@v6
      - run: |
          cat <<-EOF > templates/${{matrix.template}}/modules/ci-runtime.nix
          {
            _module.args.CI = true;
          }
          EOF
          git add templates/${{matrix.template}}/modules/ci-runtime.nix
      - run: nix flake check -L ./templates/${{matrix.template}} --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA
      - run: (cd templates/nvf-standalone && nix build .#my-neovim --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA)
        if: matrix.template == 'nvf-standalone'
      - run: (cd templates/minimal && nix build .#.nixosConfigurations.igloo.config.system.build.toplevel --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA)
        if: matrix.template == 'minimal'
      - run: |
          cd templates/minimal
          sed -i "s#github:$GITHUB_REPOSITORY#github:$GITHUB_REPOSITORY/$GITHUB_SHA#" flake.nix
          nix flake update den
          nix run .#igloo -- build --offline
        if: matrix.template == 'minimal'
      - run: (cd templates/flake-parts-modules && nix develop .# --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA --command cowsay)
        if: matrix.template == 'flake-parts-modules'
  flake-file-template:
    needs: [non-draft, allow-ci]
    if: ${{needs.non-draft.outputs.nix-changed == 'true'}}
    strategy:
      matrix:
        os: [ubuntu-latest]
        template: [default, example]
    name: Check template ${{matrix.template}} ${{matrix.os}}
    runs-on: ${{matrix.os}}
    steps:
      - uses: wimpysworld/nothing-but-nix@v10
        if: matrix.os == 'ubuntu-latest'
      - uses: cachix/install-nix-action@v31
      - uses: DeterminateSystems/magic-nix-cache-action@v13
      - run: nix flake init -t github:$GITHUB_REPOSITORY/$GITHUB_SHA#${{matrix.template}}
      - run: |
          cat <<-EOF > modules/ci-runtime.nix
          { lib, ... }:
          {
            flake-file.inputs.den.url = lib.mkForce "github:$GITHUB_REPOSITORY/$GITHUB_SHA";
            _module.args.CI = true;
          }
          EOF
      - run: nix run .#write-flake --override-input den "github:$GITHUB_REPOSITORY/$GITHUB_SHA"
      - run: nix flake update den
      - run: nix run .#write-flake
      - run: nix flake metadata
      - run: nix flake check -L --no-build