name: ci/gh-actions/guix

on:
  push:
    paths:
      - 'contrib/depends/**'
      - 'contrib/guix/**'
      - '!contrib/**.md'
      - 'external/**'
      - '.github/workflows/guix.yml'
      - '**/Cargo.lock'
  pull_request:
    paths:
      - 'contrib/depends/**'
      - 'contrib/guix/**'
      - '!contrib/**.md'
      - 'external/**'
      - '.github/workflows/guix.yml'
      - '**/Cargo.lock'

jobs:
  cache-sources:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: restore depends sources cache
        id: cache
        uses: actions/cache/restore@v5
        with:
          path: contrib/depends/sources
          key: sources-${{ hashFiles('contrib/depends/packages/*') }}
      - name: download depends sources
        if: steps.cache.outputs.cache-hit != 'true'
        run: make -C contrib/depends download
      - name: save depends sources cache
        uses: actions/cache/save@v5
        if: github.event_name != 'pull_request' && steps.cache.outputs.cache-hit != 'true'
        with:
          path: contrib/depends/sources
          key: ${{ steps.cache.outputs.cache-primary-key }}

  build-guix:
    runs-on: ubuntu-24.04
    needs: [cache-sources]
    strategy:
      fail-fast: false
      matrix:
        toolchain:
          - target: "x86_64-linux-gnu"
          - target: "aarch64-linux-gnu"
          - target: "riscv64-linux-gnu"
          - target: "x86_64-w64-mingw32"
          - target: "x86_64-unknown-freebsd"
          - target: "x86_64-apple-darwin"
          - target: "arm64-apple-darwin"
          - target: "aarch64-linux-android"

    name: ${{ matrix.toolchain.target }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
          submodules: recursive
      - name: remove bundled packages
        # This is faster than rm -rf
        run: |
          sudo mkdir /empty
          sudo rsync -a --delete /empty/ /usr/local
      - name: depends sources cache
        uses: actions/cache/restore@v5
        with:
          path: contrib/depends/sources
          key: sources-${{ hashFiles('contrib/depends/packages/*') }}
      - name: install dependencies
        run: sudo apt update; sudo apt -y install git ca-certificates
      - name: apparmor workaround
        # https://bugs.launchpad.net/ubuntu/+source/guix/+bug/2064115
        run: |
          sudo tee /etc/apparmor.d/guix << EOF
          abi <abi/3.0>,
          include <tunables/global>
          profile guix /gnu/store/{*-guix-command,*/bin/guix-daemon,*/bin/guix,*/bin/guile} flags=(unconfined) {
            userns,
            include if exists <local/guix>
          }
          EOF
          sudo /etc/init.d/apparmor reload
          sudo aa-enforce guix || true
          sudo apt purge apparmor
      - name: install guix
        run: |
          set -exo pipefail

          export ARCHIVE="guix-binary-1.5.0.x86_64-linux.tar.xz"
          export ARCHIVE_HASH=aa41025489c5061543e9c48873eaa829b900b2da75d40f9648913622f5f47817

          wget --tries=5 --waitretry=10 --no-verbose https://mirrors.ocf.berkeley.edu/gnu/guix/${ARCHIVE} -O /tmp/${ARCHIVE}
          echo "${ARCHIVE_HASH}  /tmp/${ARCHIVE}" | sha256sum -c -

          curl -fsSL https://raw.githubusercontent.com/monero-project/guix/7fd75725c5daf9d3bdfd9122dcdb37f650493d18/etc/guix-install.sh -o /tmp/guix-install.sh
          chmod +x /tmp/guix-install.sh

          { yes "" 2>/dev/null || true; } | sudo env GUIX_BINARY_FILE_NAME="/tmp/${ARCHIVE}" /tmp/guix-install.sh
          source /etc/profile.d/zzz-guix.sh
          /usr/local/bin/guix --version
      - name: build
        run: ADDITIONAL_GUIX_TIMEMACHINE_FLAGS="--disable-authentication" SUBSTITUTE_URLS='https://bordeaux.guix.gnu.org' GUIX_REPO='https://github.com/monero-project/guix.git' HOSTS="${{ matrix.toolchain.target }}" ./contrib/guix/guix-build
      - uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.toolchain.target }}
          path: |
            guix/guix-build-*/output/${{ matrix.toolchain.target }}/*
            guix/guix-build-*/logs/${{ matrix.toolchain.target }}/*

  bundle-logs:
    runs-on: ubuntu-24.04
    needs: [build-guix]
    steps:
      - uses: actions/download-artifact@v8
        with:
          merge-multiple: true
      - name: print hashes
        run: |
          echo '```' >> $GITHUB_STEP_SUMMARY
          find **/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
      - uses: actions/upload-artifact@v7
        with:
          name: "logs"
          path: '**/logs/**'