workflows/ci: Only build hosts if the derivation differs from previous run

.github/workflows/ci.yml

@@ -60,15 +60,46 @@ jobs:
         server: ${{ fromJson(needs.parse-flake.outputs.servers) }}
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
       - uses: cachix/install-nix-action@v31
         with:
           extra_nix_config: experimental-features = nix-command flakes pipe-operators
+      - name: Check if build can be skipped
+        id: skip-check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          last_sha=$(gh api \
+            "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?branch=main&status=success&per_page=1" \
+            --jq '.workflow_runs[0].head_sha // empty')
+
+          if [[ -z "$last_sha" ]]; then
+            echo "No previous successful run found, build required"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Comparing current (${{ github.sha }}) with last successful ($last_sha)"
+
+          current_drv=$(nix eval .#nixosConfigurations.${{ matrix.server }}.config.system.build.toplevel.drvPath --raw)
+          previous_drv=$(nix eval "git+file://$(pwd)?rev=$last_sha#nixosConfigurations.${{ matrix.server }}.config.system.build.toplevel.drvPath" --raw)
+
+          if [[ "$current_drv" == "$previous_drv" ]]; then
+            echo "Derivations match, skipping build"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Derivations differ, build required"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
       - uses: cachix/cachix-action@v15
+        if: steps.skip-check.outputs.skip != 'true'
         with:
           name: sebastian-stork
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
           useDaemon: false
       - name: Build server
+        if: steps.skip-check.outputs.skip != 'true'
         run: nix build .#nixosConfigurations.${{ matrix.server }}.config.system.build.toplevel --print-build-logs
   deploy:
     needs: [build-check, build-server]