ci.yml

name: CI

on:
  workflow_dispatch:
  pull_request:
  push:
    branches: [main]

permissions:
  id-token: "write"
  contents: "read"

jobs:
  build-x86_64-linux:
    uses: ./.github/workflows/build-x86_64-linux.yml

  build-x86_64-darwin:
    uses: ./.github/workflows/build-x86_64-darwin.yml

  build-aarch64-linux:
    uses: ./.github/workflows/build-aarch64-linux.yml

  build-aarch64-darwin:
    uses: ./.github/workflows/build-aarch64-darwin.yml

  lints:
    name: Lints
    runs-on: UbuntuLatest32Cores128G
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v3
      - name: Check Nixpkgs input
        uses: DeterminateSystems/flake-checker-action@main
        with:
          fail-mode: true
          check-outdated: false # PRs shouldn't fail because main's nixpkgs is out of date
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
      - uses: DeterminateSystems/magic-nix-cache-action@main
        with:
          use-gha-cache: false
      - name: Check rustfmt
        run: nix develop --command check-rustfmt
      - name: Check Clippy
        run: nix develop --command check-clippy
      - name: Check Spelling
        run: nix develop --command check-spelling
      - name: Check nixpkgs-fmt formatting
        run: nix develop --command check-nixpkgs-fmt
      - name: Check EditorConfig conformance
        run: nix develop --command check-editorconfig
      - name: Shell check for nix-installer.sh
        run: nix develop --command shellcheck ./nix-installer.sh

  run-x86_64-linux:
    name: Run x86_64 Linux
    runs-on: UbuntuLatest32Cores128G
    needs: [lints, build-x86_64-linux]
    strategy:
      matrix:
        extra-args: ["--determinate", ""]
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v3
      - name: Restore Github cache artifacts
        uses: actions/cache/restore@v3
        with:
          path: nix-installer
          key: x86_64-linux-artifacts-${{ github.sha }}
      - name: Move & set executable
        run: |
          mkdir install-root
          cp nix-installer.sh install-root/nix-installer.sh
          mv ./nix-installer install-root/nix-installer-x86_64-linux
          chmod +x install-root/nix-installer-x86_64-linux install-root/nix-installer.sh
      - run: sudo apt install fish zsh
      - name: Initial install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          extra-args: ${{ matrix.extra-args }}
          local-root: install-root/
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Initial uninstall (without a `nix run` first)
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Ensure `nix` is removed
        run: |
          if systemctl is-active nix-daemon.socket; then
            echo "nix-daemon.socket was still running"
            exit 1
          fi
          if systemctl is-active nix-daemon.service; then
            echo "nix-daemon.service was still running"
            exit 1
          fi
          if [ -e /nix ]; then
            echo "/nix exists"
            exit 1
          fi
      - name: Repeated install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          extra-args: ${{ matrix.extra-args }}
          local-root: install-root/
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: echo $PATH
        run: echo $PATH
      - name: Test `nix` with `$GITHUB_PATH`
        if: success() || failure()
        run: |
          nix run nixpkgs#hello
          nix profile install nixpkgs#hello
          hello
          nix store gc
          nix run nixpkgs#hello
      - name: Test bash
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: bash --login {0}
      - name: Test sh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: sh -l {0}
      - name: Test zsh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: zsh --login --interactive {0}
      - name: Test fish
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: fish --login {0}
      - name: Repeated uninstall
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Ensure `nix` is removed
        run: |
          if systemctl is-active nix-daemon.socket; then
            echo "nix-daemon.socket was still running"
            exit 1
          fi
          if systemctl is-active nix-daemon.service; then
            echo "nix-daemon.service was still running"
            exit 1
          fi
          if [ -e /nix ]; then
            echo "/nix exists"
            exit 1
          fi

  run-x86_64-linux-no-init:
    name: Run x86_64 Linux (No init)
    runs-on: UbuntuLatest32Cores128G
    needs: [lints, build-x86_64-linux]
    strategy:
      matrix:
        extra-args: ["--determinate", ""]
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v3
      - name: Restore Github cache artifacts
        uses: actions/cache/restore@v3
        with:
          path: nix-installer
          key: x86_64-linux-artifacts-${{ github.sha }}
      - name: Move & set executable
        run: |
          mkdir install-root
          cp nix-installer.sh install-root/nix-installer.sh
          mv ./nix-installer install-root/nix-installer-x86_64-linux
          chmod +x install-root/nix-installer-x86_64-linux install-root/nix-installer.sh
      - run: sudo apt install fish zsh
      - name: Initial install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          init: none
          extra-args: ${{ matrix.extra-args }}
          planner: linux
          local-root: install-root/
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Ensure daemon was not configured with init
        run: |
          if systemctl is-active nix-daemon.socket; then
            echo "nix-daemon.socket was running"
            exit 1
          fi
          if systemctl is-active nix-daemon.service; then
            echo "nix-daemon.service was running"
            exit 1
          fi
      - name: Initial uninstall (without a `nix run` first)
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Ensure `nix` is removed
        run: |
          if [ -e /nix ]; then
            echo "/nix exists"
            exit 1
          fi
      - name: Repeated install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          init: none
          planner: linux
          extra-args: ${{ matrix.extra-args }}
          local-root: install-root/
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: echo $PATH
        run: echo $PATH
      - name: Test `nix` with `$GITHUB_PATH`
        if: success() || failure()
        run: |
          sudo -i nix run nixpkgs#hello
          sudo -i nix profile install nixpkgs#hello
          hello
          sudo -i nix store gc
          sudo -i nix run nixpkgs#hello
      - name: Test bash
        run: sudo -i nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: bash --login {0}
      - name: Test sh
        run: sudo -i nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: sh -l {0}
      - name: Test zsh
        run: sudo -i nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: zsh --login --interactive {0}
      - name: Test fish
        run: sudo -i nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: fish --login {0}
      - name: Repeated uninstall
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Ensure `nix` is removed
        run: |
          if systemctl is-active nix-daemon.socket; then
            echo "nix-daemon.socket was running"
            exit 1
          fi
          if systemctl is-active nix-daemon.service; then
            echo "nix-daemon.service was running"
            exit 1
          fi
          if [ -e /nix ]; then
            echo "/nix exists"
            exit 1
          fi

  run-x86_64-darwin:
    name: Run x86_64 Darwin
    runs-on: macos-13
    needs: [lints, build-x86_64-darwin]
    strategy:
      matrix:
        extra-args: ["--determinate", ""]
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v3
      - name: Restore Github cache artifacts
        uses: actions/cache/restore@v3
        with:
          path: nix-installer
          key: x86_64-darwin-artifacts-${{ github.sha }}
      - name: Move & set executable
        run: |
          mkdir install-root
          cp nix-installer.sh install-root/nix-installer.sh
          mv ./nix-installer install-root/nix-installer-x86_64-darwin
          chmod +x install-root/nix-installer-x86_64-darwin install-root/nix-installer.sh
      - run: brew install fish coreutils
      - name: Initial install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          extra-args: ${{ matrix.extra-args }}
          local-root: install-root/
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
          extra-conf: |
            trusted-users = root runner
      - name: Initial uninstall (without a `nix run` first)
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Repeated install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          extra-args: ${{ matrix.extra-args }}
          local-root: install-root/
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
          extra-conf: trusted-users = root runner
      - name: echo $PATH
        run: echo $PATH
      - name: Test `nix` with `$GITHUB_PATH`
        if: success() || failure()
        run: |
          nix run nixpkgs#hello
          nix profile install nixpkgs#hello
          hello
          nix store gc
          nix run nixpkgs#hello
      - name: Test bash
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: bash --login {0}
      - name: Test sh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: sh -l {0}
      - name: Test zsh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: zsh --login --interactive {0}
      - name: Test fish
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: fish --login {0}
      - name: Repeated uninstall
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full

  run-aarch64-linux:
    name: Run aarch64 Linux
    runs-on: namespace-profile-default-arm64
    needs: [lints, build-aarch64-linux]
    strategy:
      matrix:
        extra-args: ["--determinate", ""]
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v3
      - name: Restore Github cache artifacts
        uses: actions/cache/restore@v3
        with:
          path: nix-installer
          key: aarch64-linux-artifacts-${{ github.sha }}
      - name: Move & set executable
        run: |
          mkdir install-root
          cp nix-installer.sh install-root/nix-installer.sh
          mv ./nix-installer install-root/nix-installer-aarch64-linux
          chmod +x install-root/nix-installer-aarch64-linux install-root/nix-installer.sh
      - run: sudo apt install -y fish zsh
      - name: Initial install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          local-root: install-root/
          extra-args: ${{ matrix.extra-args }}
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Initial uninstall (without a `nix run` first)
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Ensure `nix` is removed
        run: |
          if systemctl is-active nix-daemon.socket; then
            echo "nix-daemon.socket was still running"
            exit 1
          fi
          if systemctl is-active nix-daemon.service; then
            echo "nix-daemon.service was still running"
            exit 1
          fi
          if [ -e /nix ]; then
            echo "/nix exists"
            exit 1
          fi
      - name: Repeated install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          local-root: install-root/
          logger: pretty
          extra-args: ${{ matrix.extra-args }}
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: echo $PATH
        run: echo $PATH
      - name: Test `nix` with `$GITHUB_PATH`
        if: success() || failure()
        run: |
          nix run nixpkgs#hello
          nix profile install nixpkgs#hello
          hello
          nix store gc
          nix run nixpkgs#hello
      - name: Test bash
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: bash --login {0}
      - name: Test sh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: sh -l {0}
      - name: Test zsh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: zsh --login --interactive {0}
      - name: Test fish
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: fish --login {0}
      - name: Repeated uninstall
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Ensure `nix` is removed
        run: |
          if systemctl is-active nix-daemon.socket; then
            echo "nix-daemon.socket was still running"
            exit 1
          fi
          if systemctl is-active nix-daemon.service; then
            echo "nix-daemon.service was still running"
            exit 1
          fi
          if [ -e /nix ]; then
            echo "/nix exists"
            exit 1
          fi

  run-aarch64-darwin:
    name: Run aarch64 Darwin
    runs-on: macos-latest-xlarge
    needs: [lints, build-aarch64-darwin]
    strategy:
      matrix:
        extra-args: ["--determinate", ""]
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v3
      - name: Restore Github cache artifacts
        uses: actions/cache/restore@v3
        with:
          path: nix-installer
          key: aarch64-darwin-artifacts-${{ github.sha }}
      - name: Move & set executable
        run: |
          mkdir install-root
          cp nix-installer.sh install-root/nix-installer.sh
          mv ./nix-installer install-root/nix-installer-aarch64-darwin
          chmod +x install-root/nix-installer-aarch64-darwin install-root/nix-installer.sh
      - run: brew install fish coreutils
      - name: Initial install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          local-root: install-root/
          extra-args: ${{ matrix.extra-args }}
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
          extra-conf: |
            trusted-users = root runner
      - name: Initial uninstall (without a `nix run` first)
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full
      - name: Repeated install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          local-root: install-root/
          extra-args: ${{ matrix.extra-args }}
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
          github-token: ${{ secrets.GITHUB_TOKEN }}
          extra-conf: trusted-users = root runner
      - name: echo $PATH
        run: echo $PATH
      - name: Test `nix` with `$GITHUB_PATH`
        if: success() || failure()
        run: |
          nix run nixpkgs#hello
          nix profile install nixpkgs#hello
          hello
          nix store gc
          nix run nixpkgs#hello
      # NOTE(cole-h): GHA pushed a weird image that breaks this test for whatever reason, so ignore
      # the failure for now
      - name: Test bash
        run: nix-instantiate -E 'builtins.currentTime' --eval || true
        if: success() || failure()
        shell: bash --login {0}
      - name: Test sh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: sh -l {0}
      - name: Test zsh
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: zsh --login --interactive {0}
      - name: Test fish
        run: nix-instantiate -E 'builtins.currentTime' --eval
        if: success() || failure()
        shell: fish --login {0}
      - name: Repeated uninstall
        run: sudo -E /nix/nix-installer uninstall
        env:
          NIX_INSTALLER_NO_CONFIRM: true
          NIX_INSTALLER_LOGGER: pretty
          NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
          RUST_BACKTRACE: full

  run-x86_64-linux-release-checks:
    name: Run x86_64 Linux release checks
    runs-on: UbuntuLatest64Cores256GX86
    needs: [lints, build-x86_64-linux]
    if: contains(github.ref, 'release-') || contains(github.head_ref, 'release-')
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@v3
      - name: Restore Github cache artifacts
        uses: actions/cache/restore@v3
        with:
          path: nix-installer
          key: x86_64-linux-artifacts-${{ github.sha }}
      - name: Move & set executable
        run: |
          mkdir install-root
          cp nix-installer.sh install-root/nix-installer.sh
          mv ./nix-installer install-root/nix-installer-x86_64-linux
          chmod +x install-root/nix-installer-x86_64-linux install-root/nix-installer.sh
      - name: Initial install
        uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
          local-root: install-root/
          logger: pretty
          log-directives: nix_installer=debug
          backtrace: full
      - uses: DeterminateSystems/magic-nix-cache-action@main
        with:
          use-gha-cache: false

      - run: nix flake check -L
      - run: |
          nix build \
            -L --tarball-ttl 0 --keep-going \
            .#hydraJobs.container-test.all.x86_64-linux.all \
            .#hydraJobs.vm-test.all.x86_64-linux.all