release.yml

name: Release

on:
  schedule:
    - cron: '0 0 * * 0'
  workflow_dispatch:

jobs:
  update:
    name: Update
    runs-on: ubuntu-latest
    outputs:
      nix_release: ${{ steps.update.outputs.nix_release }}
      updated: ${{ steps.update.outputs.updated }}
    steps:
      - uses: cachix/install-nix-action@V27
        with:
          nix_path: nixpkgs=channel:nixpkgs-unstable

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Configure git
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'

      - name: Update from latest Hydra eval
        id: update
        run: ./update.rb

      - name: Push release tag
        if: steps.update.outputs.updated == 'true'
        env:
          NIX_RELEASE: ${{ steps.update.outputs.nix_release }}
        run: |
          [ -n "$NIX_RELEASE" ] || (echo 'NIX_RELEASE empty or undefined' >&2; exit 1)

          git tag "$NIX_RELEASE"
          git push origin "$NIX_RELEASE"

      - name: Create release
        if: steps.update.outputs.updated == 'true'
        uses: actions/github-script@v7
        env:
          NIX_RELEASE: ${{ steps.update.outputs.nix_release }}
        with:
          script: await require('.ci/create-prerelease.js')({require, context, core, github});

  test:
    name: Test
    needs: [update]
    if: needs.update.outputs.updated == 'true'
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: cachix/install-nix-action@V27
        with:
          install_url: ${{ github.server_url }}/${{ github.repository }}/releases/download/${{ needs.update.outputs.nix_release }}/install
          nix_path: nixpkgs=channel:nixpkgs-unstable

      - name: Run nix-info
        run: |
          nix run nixpkgs#nix-info -- -m

      - name: Pull container image
        if: runner.os == 'Linux'
        env:
          NIX_RELEASE: ${{ needs.update.outputs.nix_release }}
        run: |
          [ -n "$NIX_RELEASE" ] || (echo 'NIX_RELEASE empty or undefined' >&2; exit 1)

          curl -sfL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/download/$NIX_RELEASE/$NIX_RELEASE-$(uname -m)-linux-container.tar.gz" |
            docker load --quiet

      - name: Run nix-info in container image
        if: runner.os == 'Linux'
        env:
          NIX_RELEASE: ${{ needs.update.outputs.nix_release }}
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          docker run --rm -e GITHUB_TOKEN "nix:${NIX_RELEASE#nix-}" \
            sh -c 'echo "access-tokens = github.com=$GITHUB_TOKEN" >> /etc/nix/nix.conf && \
                   nix --extra-experimental-features "nix-command flakes" run nixpkgs#nix-info -- -m'

  release:
    name: Release
    needs: [update, test]
    if: needs.update.outputs.updated == 'true' && startsWith(github.ref, 'refs/heads/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Combine and push images to GitHub Container Registry
        env:
          NIX_RELEASE: ${{ needs.update.outputs.nix_release }}
        run: .ci/push-containers.sh

      - name: Mark full release
        uses: actions/github-script@v7
        env:
          NIX_RELEASE: ${{ needs.update.outputs.nix_release }}
        with:
          script: await require('.ci/mark-release.js')({require, context, core, github});