nightly.yml

name: Nightly

on:
  schedule:
    # Daily hermetic validation; off-minute to avoid the top-of-hour rush.
    - cron: "41 2 * * *"
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: oxid-nightly-${{ github.ref }}
  cancel-in-progress: true

jobs:
  flake-check:
    name: Hermetic nix flake check (full sandboxed test suite)
    runs-on: ubuntu-24.04
    # Builds every flake check cold: both checked package variants (with the
    # full sandboxed test suite the per-push builds skip), both Compact
    # artifact derivations, and the call composer.
    timeout-minutes: 120
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Record immutable source SHA
        run: |
          echo "Nightly source: \`${GITHUB_REF_NAME}@${GITHUB_SHA}\`" >> "$GITHUB_STEP_SUMMARY"

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: Cache the package-build Nix store
        uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7
        with:
          primary-key: nix7-build-${{ runner.os }}-${{ hashFiles('flake.lock', 'flake.nix', 'nix/**/*.nix', 'Cargo.lock') }}
          restore-prefixes-first-match: nix7-build-${{ runner.os }}-
          gc-max-store-size-linux: 6G
          # Scheduled validation restores the default-branch archive read-only.
          save: false

      - name: Run every flake check hermetically
        run: nix flake check --print-build-logs

  scorecard:
    name: Scorecard analysis
    if: github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/heads/milestone-')
    runs-on: ubuntu-24.04
    permissions:
      actions: read
      checks: read
      contents: read
      issues: read
      pull-requests: read
    steps:
      - name: Checkout selected milestone source
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: Install checksum-pinned Scorecard CLI
        env:
          SCORECARD_SHA256: 83b90a05c1540ef1390db1cd5711e5fd04be9c1d8537fb84d39d02092d6a8dff
        run: |
          curl --fail --location --retry 3 --retry-all-errors \
            https://github.com/ossf/scorecard/releases/download/v5.5.0/scorecard_5.5.0_linux_amd64.tar.gz \
            --output "$RUNNER_TEMP/scorecard.tar.gz"
          printf '%s  %s\n' "$SCORECARD_SHA256" "$RUNNER_TEMP/scorecard.tar.gz" | sha256sum --check -
          mkdir -p "$RUNNER_TEMP/scorecard-bin"
          tar -xzf "$RUNNER_TEMP/scorecard.tar.gz" -C "$RUNNER_TEMP/scorecard-bin" scorecard

      - name: Analyze the exact milestone commit
        env:
          GITHUB_AUTH_TOKEN: ${{ github.token }}
        run: |
          "$RUNNER_TEMP/scorecard-bin/scorecard" \
            --repo=github.com/MediaNoxLabs/oxid \
            --commit="$GITHUB_SHA" \
            --format=json \
            --output="$RUNNER_TEMP/scorecard.json"
          jq -e --arg sha "$GITHUB_SHA" '.repo.commit == $sha and (.checks | length > 0)' \
            "$RUNNER_TEMP/scorecard.json" >/dev/null
          echo "Scorecard source: \`${GITHUB_REF_NAME}@${GITHUB_SHA}\`" >> "$GITHUB_STEP_SUMMARY"

      - name: Retain Scorecard result
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: scorecard-${{ github.sha }}
          path: ${{ runner.temp }}/scorecard.json
          if-no-files-found: error
          retention-days: 90