# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
#   https://github.com/cachix/install-nix-action
#   (README: "Flakes CI workflow with nix build and flake check")
# Every action used here (actions/checkout) is from an official GitHub repo.
#
# Adaptations for Gitea Actions:
#   * runs-on: native  - Gitea's self-hosted native runner. cachix/install-nix-action
#     explicitly supports self-hosted runners, and this runner's host already provides
#     Nix, so the installer step is omitted and flakes are enabled via NIX_CONFIG
#     (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
#   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
#   * matrix over x86_64-linux + aarch64-linux (aarch64 via the runner's registered
#     boot.binfmt.emulatedSystems).

name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least-privilege by default; jobs opt into what they need.
permissions: {}

concurrency:
  group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  NIX_CONFIG: experimental-features = nix-command flakes

jobs:
  flake-check:
    name: Flake check (${{ matrix.system }})
    runs-on: native
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Flake check (${{ matrix.system }})
        run: nix flake check --no-build --system ${{ matrix.system }}

  pre-commit:
    name: Pre-commit checks (${{ matrix.system }})
    runs-on: native
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Pre-commit checks (${{ matrix.system }})
        run: nix build .#checks.${{ matrix.system }}.pre-commit