name: Nix CI

# Evaluate every advertised Flake output, then build and test the package on
# both supported Linux architectures. Dependency graph and packaging changes
# run immediately on PRs; the weekly build catches source-only integration
# drift without adding a full Nix rebuild to every Rust change.
#
# flake.lock pins nixpkgs exactly; update-flake-lock.yml advances it in a tested
# PR instead of allowing an unreviewed upstream channel to drift under builds.
on:
  schedule:
    # Mondays, 04:17 UTC. Off-peak, and far from the release cadence.
    - cron: "17 4 * * 1"
  workflow_dispatch:
  pull_request:
    paths:
      - "Cargo.lock"
      - "Cargo.toml"
      - "crates/**/Cargo.toml"
      - "crates/**/build.rs"
      - "design/icon/**"
      - "docs/config.example.toml"
      - "flake.nix"
      - "flake.lock"
      - "packaging/linux/package.nix"
      - "packaging/linux/nixos-module.nix"
      - "packaging/linux/desktop/**"
      - "packaging/linux/systemd/**"
      - "packaging/linux/udev/**"
      - ".github/workflows/nix.yml"
      - ".github/workflows/update-flake-lock.yml"

permissions:
  contents: read

concurrency:
  group: nix-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  evaluate:
    name: flake evaluation and formatting
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install upstream Nix
        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
      - name: Check Nix formatting
        run: >-
          nix fmt -- --check
          flake.nix
          devenv.nix
          packaging/linux/package.nix
          packaging/linux/nixos-module.nix
      - name: Evaluate all Flake outputs
        run: nix flake check --all-systems --no-build --show-trace

  build:
    name: nix build (${{ matrix.system }})
    needs: evaluate
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - system: x86_64-linux
            machine: x86_64
            runner: ubuntu-24.04
          - system: aarch64-linux
            machine: aarch64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Verify runner architecture
        run: test "$(uname -m)" = "${{ matrix.machine }}"
      - name: Install upstream Nix
        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
      - name: Restore and save Nix store paths
        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
        with:
          use-gha-cache: enabled
          use-flakehub: disabled
      - name: Build package and NixOS module check
        run: |
          nix build \
            ".#checks.${{ matrix.system }}.package" \
            ".#checks.${{ matrix.system }}.nixos-module" \
            -L