check.yaml

name: check

on:
  push:
    branches: [main]
  pull_request:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: kleinbem/actions/nix-setup@f1b4f5fc52ea31b1f9e53ca29170570fe4651c7d # v1.7.1
      - name: Checks
        run: nix flake check
      - name: Formatting
        run: nix fmt -- --fail-on-change
      # The public cache users substitute from (cache.kleinbem.dev, shared
      # with other projects; kleinbem/nix infra/public-cache.tf): main's build
      # replaces the previous one. Skipped until vars.CACHE_STORE is set; set it
      # with the secrets (push-cache.sh names a missing one). No CUDA/ROCm variants:
      # they'd outgrow the free tier, and GPU users build them once.
      - name: Push to the public cache
        if: github.event_name == 'push' && vars.CACHE_STORE != ''
        env:
          CACHE_STORE: ${{ vars.CACHE_STORE }}
          CACHE_SIGNING_KEY: ${{ secrets.CACHE_SIGNING_KEY }}
          AWS_ACCESS_KEY_ID: ${{ secrets.CACHE_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.CACHE_SECRET_ACCESS_KEY }}
        run: |
          mapfile -t pkgs < <(nix eval --json .#packages.x86_64-linux --apply builtins.attrNames |
            jq -r '.[] | select(test("-(cuda|rocm)$") or . == "default" | not) | ".#\(.)"')
          nix shell --inputs-from . nixpkgs#awscli2 --command .github/scripts/push-cache.sh "${pkgs[@]}"

  # push-cache.sh deletes from a bucket other projects share: run it against a
  # throwaway SeaweedFS S3 on every change.
  push-cache:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: kleinbem/actions/nix-setup@f1b4f5fc52ea31b1f9e53ca29170570fe4651c7d # v1.7.1
      - name: push-cache.sh against a local S3
        run: nix shell --inputs-from . nixpkgs#seaweedfs nixpkgs#awscli2 nixpkgs#jq --command tests/push-cache.sh