# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
#   https://github.com/cachix/install-nix-action
#   (README: "Flakes CI workflow with nix build and flake check")
# Every action used here (actions/checkout) is from an official GitHub repo.
#
# Adaptations for Gitea Actions:
#   * runs-on: native  - Gitea's self-hosted native runner. cachix/install-nix-action
#     explicitly supports self-hosted runners, and this runner's host already provides
#     Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG
#     (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
#   * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix.
#     Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto
#     PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
#     second Nix client that would mismatch the running Lix daemon.
#   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
#   * matrix over x86_64-linux + aarch64-linux.
#     All jobs use --no-build (eval-only) because the runner has 2 cores / 4GB RAM:
#     building nix derivations would exhaust memory and crash the server.
#     Pre-commit hooks run locally via git-hooks-nix on the developer's machine.
#   * aarch64 builds need QEMU binfmt (boot.binfmt.emulatedSystems) + nix extra-platforms,
#     which require a nixos-rebuild switch not yet applied. Flake-check for aarch64
#     runs eval-only (no build) and passes.

name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least-privilege by default; jobs opt into what they need.
permissions: {}

concurrency:
  group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  NIX_CONFIG: |
    experimental-features = nix-command flakes
    extra-platforms = aarch64-linux

jobs:
  flake-check:
    name: Flake check (${{ matrix.system }})
    runs-on: native
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Flake check (${{ matrix.system }})
        run: |
          export PATH=/run/current-system/sw/bin:$PATH
          nix flake check --no-build --system ${{ matrix.system }}