name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least-privilege by default; jobs opt into what they need.
permissions: {}

# Cancel superseded runs on the same ref.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  check:
    name: Flake check (${{ matrix.system }})
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    # Match the architecture to a native runner, exactly like nixpkgs
    # (its treefmt/parse/owners jobs run on ubuntu-24.04-arm).
    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes

      # Evaluate the flake for this system (incl. nixosConfigurations) without
      # building. Catches the class of break we hit with the duplicate module block.
      - name: Flake check (${{ matrix.system }})
        run: nix flake check --no-build --system ${{ matrix.system }}

  pre-commit:
    name: Pre-commit checks (${{ matrix.system }})
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes

      # Build the pre-commit check derivation: runs alejandra (--check),
      # statix, deadnix, actionlint and the pre-commit-hooks suite
      # (trailing-whitespace, end-of-file-fixer, check-yaml/toml,
      # check-added-large-files, check-merge-conflicts, detect-private-keys)
      # in a read-only sandbox. Fails the build on any reported problem.
      - name: Pre-commit checks (${{ matrix.system }})
        run: nix build .#checks.${{ matrix.system }}.pre-commit