name: Nix
permissions:
  contents: write
on:
  pull_request: null
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  nix-flake-check:
    name: nix flake check
    strategy:
      matrix:
        RUNNER:
          # - macos-latest
          # - ubuntu-24.04-arm
          # - ubuntu-latest
          - ubicloud-standard-2
          - warp-macos-26-arm64-6x
    runs-on: ${{ matrix.RUNNER }}
    steps:
      - uses: actions/checkout@v7
      # The default image contains dozens of gigabytes of tools. NixOS builds get big. Thus, remove
      # unused tools (Nix provides for all we need!) to get some space.
      - uses: wimpysworld/nothing-but-nix@main
      - uses: cachix/install-nix-action@v31
      - uses: cachix/cachix-action@v17
        with:
          name: rosenpass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - run: nix flake check
  nix-fast-build:
    name: Build everything in `.#ciJobs`
    strategy:
      matrix:
        RUNNER:
          # - macos-latest
          # - ubuntu-24.04-arm
          # - ubuntu-latest
          - ubicloud-standard-2
          - warp-macos-26-arm64-6x
    runs-on: ${{ matrix.RUNNER }}
    steps:
      - uses: actions/checkout@v7
      - uses: wimpysworld/nothing-but-nix@main
      - uses: cachix/install-nix-action@v31
      - uses: cachix/cachix-action@v17
        with:
          name: rosenpass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --flake .#ciJobs --no-nom --skip-cached --result-file result-junit.xml --result-format junit # TODO add --fail-fast once we get a newer nix-fast-build
      - name: Test Summary
        uses: test-summary/action@v2
        with:
          paths: "result-junit.xml"
        if: always()
  whitepaper-upload:
    name: Upload whitepaper
    runs-on: ubicloud-standard-2
    if: ${{ github.ref == 'refs/heads/main' }}
    steps:
      - uses: actions/checkout@v7
      - uses: cachix/install-nix-action@v30
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@v17
        with:
          name: rosenpass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Git add git sha and commit
        run: cd papers && ./tex/gitinfo2.sh && git add gitHeadInfo.gin
      - name: Build
        run: nix build .#packages.x86_64-linux.whitepaper --print-build-logs
      - name: Deploy PDF artifacts
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: result/
          publish_branch: papers-pdf
          force_orphan: true