name: CI

on:
  push:
    branches: [master]
  pull_request:
  workflow_dispatch:

# A newer run for the same ref replaces a running one, its farm included.
# Runs for different refs queue for the farm, see the farm job.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# One job per check shows failing checks in the run overview. The NixOS
# machines are built by the farm, one job per machine.
jobs:
  list:
    runs-on: ubuntu-latest
    outputs:
      checks: ${{ steps.list.outputs.checks }}
    steps:
      - uses: actions/checkout@v4
        with:
          # Fetch all history for git-based operations
          fetch-depth: 0

      - uses: cachix/install-nix-action@v31

      - id: list
        run: |
          checks=$(nix eval --json .#checks.x86_64-linux --apply builtins.attrNames)
          echo "checks=$checks" >> "$GITHUB_OUTPUT"

  check:
    needs: list
    name: ${{ matrix.check }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        check: ${{ fromJSON(needs.list.outputs.checks) }}
    steps:
      - uses: actions/checkout@v4
        with:
          # Fetch all history for git-based operations
          fetch-depth: 0

      - uses: cachix/install-nix-action@v31

      - run: nix build -L --no-link '.#checks.x86_64-linux.${{ matrix.check }}'

  outputs:
    name: packages and devShells
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Fetch all history for git-based operations
          fetch-depth: 0

      - uses: cachix/install-nix-action@v31

      - run: |
          for output in packages devShells; do
            echo "$output:"
            # shellcheck disable=SC2016 # ${...} is Nix interpolation
            nix eval --raw ".#$output.x86_64-linux" --apply 'xs: builtins.deepSeq (builtins.mapAttrs (_: x: x.drvPath) xs) "${toString (builtins.length (builtins.attrNames xs))} evaluated\n"'
          done

  # Builds all NixOS machines (farm.yml). Its iroh endpoints are fixed, so one
  # farm at a time across all runs; the others wait FIFO. Without `queue: max`
  # GitHub keeps one pending run per group and cancels the one before.
  farm:
    uses: ./.github/workflows/farm.yml
    secrets: inherit
    permissions:
      contents: read
      id-token: write # niks3 push
      actions: read # the jobs watch each other
    concurrency:
      group: farm
      queue: max

  # Fixed-name summary of the jobs above, the required status check for
  # merging into master (the matrix job names change with the hosts).
  ci:
    needs: [list, check, outputs, farm]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          echo "results: $RESULTS"
          for r in $RESULTS; do
            [ "$r" = success ] || exit 1
          done