name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least-privilege by default; jobs opt into what they need.
permissions: {}

# Cancel superseded runs on the same ref.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  check:
    name: Flake check (${{ matrix.system }})
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    # Match the architecture to a native runner, exactly like nixpkgs
    # (its treefmt/parse/owners jobs run on ubuntu-24.04-arm).
    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes

      # Evaluate the flake for this system (incl. nixosConfigurations) without
      # building. Catches the class of break we hit with the duplicate module block.
      - name: Flake check (${{ matrix.system }})
        run: nix flake check --no-build --system ${{ matrix.system }}

  format:
    name: Formatting check (${{ matrix.system }})
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes

      # alejandra is the configured formatter (flake.nix perSystem.formatter).
      # Checked per-system so both architectures stay formatted.
      - name: Formatting check (${{ matrix.system }})
        run: nix run .#formatter.${{ matrix.system }} -- --check .