ci.yml

name: CI
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
jobs:
  flake:
    name: Flake checks
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - name: Run checks
        run: |
          nix flake check --print-build-logs --show-trace
  build:
    name: Build
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable
          install_url: https://releases.nixos.org/nix/nix-2.31.2/install
      - name: Build
        run: |
          # TODO: Create a CI output in flake to avoid setting it here
          nix build --option accept-flake-config true --print-build-logs .#nixosConfigurations.andesite.config.system.build.toplevel

          if [ -n "${{ secrets.NIX_CACHE_KEY }}" ]; then
            echo "${{ secrets.NIX_CACHE_KEY }}" > cache.key
            nix store sign --recursive --key-file cache.key "$(readlink ./result)"
          fi

          if [ -n "${{ secrets.AWS_ACCESS_KEY_ID }}" ] && [ -n "${{ secrets.AWS_SECRET_ACCESS_KEY }}" ]; then
            export AWS_ACCESS_KEY_ID="${{ secrets.AWS_ACCESS_KEY_ID }}"
            export AWS_SECRET_ACCESS_KEY="${{ secrets.AWS_SECRET_ACCESS_KEY }}"

            # Verify access
            aws s3 ls "s3://prismlauncher-nix-cache/nix-cache-info" --endpoint-url https://0b169a8eb4194bab65e0b6d900d02abb.eu.r2.cloudflarestorage.com

            nix copy \
              --to "s3://prismlauncher-nix-cache?endpoint=0b169a8eb4194bab65e0b6d900d02abb.eu.r2.cloudflarestorage.com&region=auto" \
              "$(readlink ./result)"
          fi