infra/.forgejo/workflows/check.yml

name: Flake checks
on: [pull_request]
env:
  PATH: /run/current-system/sw/bin
  HOME: /var/lib/gitea-runner/tankstelle

jobs:
  Check:
    runs-on: self-hosted
    steps:
      - name: Enter ci devshell
        run: |
          nix --accept-flake-config --access-tokens '' develop .#ci

      - name: Check out repository code
        uses: https://code.forgejo.org/actions/checkout@v4

      - name: Prepare cachix
        uses: https://github.com/cachix/cachix-action@v14
        with:
          name: pub-solar
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          useDaemon: false

      - name: Check formatting
        run: |
          nix --accept-flake-config --access-tokens '' develop --command treefmt --fail-on-change

      - name: Run flake checks
        run: |
          set -exuo pipefail
          # Prevent cache garbage collection by creating GC roots
          for target in $(nix flake show --json --all-systems | jq '
            .["nixosConfigurations"] |
            to_entries[] |
            .key
            ' | tr -d '"'
          ); do
            nix --print-build-logs --verbose --accept-flake-config --access-tokens '' \
              build --out-link ./result-"$target" ".#nixosConfigurations.${target}.config.system.build.toplevel"
          done

          nix --print-build-logs --verbose --accept-flake-config --access-tokens '' flake check