nixos-config/.github/workflows/ci.yml

name: "CI"
on:
  workflow_dispatch:
  push:
    branches: [main]
jobs:
  parse-flake:
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.packages.outputs.packages }}
      checks: ${{ steps.checks.outputs.checks }}
      servers: ${{ steps.servers.outputs.servers }}
      workstations: ${{ steps.workstations.outputs.workstations }}
    steps:
      - uses: actions/checkout@v5
      - uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: experimental-features = nix-command flakes pipe-operators
      - name: Get checks
        id: checks
        run: |
          checks=$(nix flake show --json | jq -c '.checks."x86_64-linux" | keys')
          printf "checks=%s" "$checks" >> "$GITHUB_OUTPUT"
      - name: Get servers
        id: servers
        run: |
          servers=$(nix eval .#nixosConfigurations --apply 'configs:
            configs
            |> builtins.attrNames
            |> builtins.filter (hostName: configs.${hostName}.config.custom.services.comin.enable)
          ' --json)
          printf "servers=%s" "$servers" >> "$GITHUB_OUTPUT"
  build-check:
    name: ${{ matrix.check }}
    needs: parse-flake
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        check: ${{ fromJson(needs.parse-flake.outputs.checks) }}
    steps:
      - uses: actions/checkout@v5
      - uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: experimental-features = nix-command flakes pipe-operators
      - uses: cachix/cachix-action@v15
        with:
          name: sebastian-stork
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          useDaemon: false
      - name: Build check
        run: nix build .#checks.x86_64-linux.${{ matrix.check }} --print-build-logs
  build-server:
    name: ${{ matrix.server }}
    needs: parse-flake
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        server: ${{ fromJson(needs.parse-flake.outputs.servers) }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: experimental-features = nix-command flakes pipe-operators
      - name: Check if build can be skipped
        id: skip-check
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          last_sha=$(gh api \
            "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?branch=main&status=success&per_page=1" \
            --jq '.workflow_runs[0].head_sha // empty')

          if [[ -z "$last_sha" ]]; then
            echo "No previous successful run found, build required"
            echo "skip=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "Comparing current (${{ github.sha }}) with last successful ($last_sha)"

          current_drv=$(nix eval .#nixosConfigurations.${{ matrix.server }}.config.system.build.toplevel.drvPath --raw)
          previous_drv=$(nix eval "git+file://$(pwd)?rev=$last_sha#nixosConfigurations.${{ matrix.server }}.config.system.build.toplevel.drvPath" --raw)

          if [[ "$current_drv" == "$previous_drv" ]]; then
            echo "Derivations match, skipping build"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "Derivations differ, build required"
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi
      - uses: cachix/cachix-action@v15
        if: steps.skip-check.outputs.skip != 'true'
        with:
          name: sebastian-stork
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          useDaemon: false
      - name: Build server
        if: steps.skip-check.outputs.skip != 'true'
        run: nix build .#nixosConfigurations.${{ matrix.server }}.config.system.build.toplevel --print-build-logs
  deploy:
    needs: [build-check, build-server]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
      - name: Push to deploy branch
        run: git push origin HEAD:deploy --force
  notify:
    if: always()
    needs: [deploy]
    runs-on: ubuntu-latest
    steps:
      - name: Notify success
        if: needs.deploy.result == 'success'
        run: |
          curl -s \
            -H "Title: CI: Deploy succeeded" \
            -H "Priority: low" \
            -H "Tags: white_check_mark" \
            -H "Actions: view, Open workflow run, ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            -H "Markdown: yes" \
            -d "Commit \`${GITHUB_SHA::7}\` deployed successfully." \
            https://ntfy.sh/splitleaf
      - name: Notify failure
        if: needs.deploy.result != 'success'
        run: |
          curl -s \
            -H "Title: CI: Deploy failed" \
            -H "Priority: default" \
            -H "Tags: rotating_light" \
            -H "Actions: view, Open workflow run, ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            -H "Markdown: yes" \
            -d "Commit \`${GITHUB_SHA::7}\` failed to deploy." \
            https://ntfy.sh/splitleaf