ci.yml

name: Build and Publish

on:
  workflow_dispatch:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - labeled

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main

      - name: Check external links
        run: |
          nix develop --command \
            lychee README.md

  test-modules:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main
      - run: |
          set -eux

          cd tests
          rm -f flake.lock
          nix flake lock
          nix flake check
      - run: |
          set -eux

          nix flake lock
          git diff --exit-code

  publish:
    needs: [test-modules]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: "DeterminateSystems/flakehub-push@main"
        if: ${{ !github.repository.fork && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || startsWith(github.ref, 'refs/tags/')) }}
        with:
          rolling: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
          visibility: "unlisted"
          tag: "${{ github.ref_name }}"