nixos-config/.github/workflows/ci.yml

name: "CI"
on:
  workflow_dispatch:
  push:
    branches: [main]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  parse-flake:
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.packages.outputs.packages }}
      checks: ${{ steps.checks.outputs.checks }}
      servers: ${{ steps.servers.outputs.servers }}
      workstations: ${{ steps.workstations.outputs.workstations }}
    steps:
      - uses: actions/checkout@v6
      - uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: experimental-features = nix-command flakes pipe-operators
      - name: Get packages
        id: packages
        run: |
          packages=$(nix flake show --json | jq -c '.packages."x86_64-linux" | keys')
          printf "packages=%s" "$packages" >> "$GITHUB_OUTPUT"
      - name: Get checks
        id: checks
        run: |
          checks=$(nix flake show --json | jq -c '.checks."x86_64-linux" | keys')
          printf "checks=%s" "$checks" >> "$GITHUB_OUTPUT"
      - name: Get servers
        id: servers
        run: |
          servers=$(nix eval .#nixosConfigurations --apply 'configs:
            configs
            |> builtins.attrNames
            |> builtins.filter (hostName: configs.${hostName}.config.custom.services.comin.enable)
          ' --json)
          printf "servers=%s" "$servers" >> "$GITHUB_OUTPUT"
      - name: Get workstations
        id: workstations
        run: |
          workstations=$(nix eval .#nixosConfigurations --apply 'configs:
            configs
            |> builtins.attrNames
            |> builtins.filter (hostName: !configs.${hostName}.config.custom.services.comin.enable)
          ' --json)
          printf "workstations=%s" "$workstations" >> "$GITHUB_OUTPUT"
  build-package:
    name: ${{ matrix.package }}
    needs: parse-flake
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.parse-flake.outputs.packages) }}
    steps:
      - uses: actions/checkout@v6
      - uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: experimental-features = nix-command flakes pipe-operators
      - uses: cachix/cachix-action@v16
        with:
          name: sebastian-stork
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          useDaemon: false
      - name: Build package
        run: nix build .#packages.x86_64-linux.${{ matrix.package }} --print-build-logs
  build-check:
    name: ${{ matrix.check }}
    needs: parse-flake
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        check: ${{ fromJson(needs.parse-flake.outputs.checks) }}
    steps:
      - uses: actions/checkout@v6
      - uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: experimental-features = nix-command flakes pipe-operators
      - uses: cachix/cachix-action@v16
        with:
          name: sebastian-stork
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          useDaemon: false
      - name: Build check
        run: nix build .#checks.x86_64-linux.${{ matrix.check }} --print-build-logs
  build-server:
    needs: parse-flake
    uses: ./.github/workflows/build-host.yml
    with:
      hosts: ${{ needs.parse-flake.outputs.servers }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
  build-workstation:
    needs: parse-flake
    uses: ./.github/workflows/build-host.yml
    with:
      hosts: ${{ needs.parse-flake.outputs.workstations }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
  trigger-deploy:
    needs: [build-check, build-server]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      - name: Push to deploy branch
        run: git push --force origin HEAD:refs/heads/deploy
  await-deploy:
    name: ${{ matrix.server }}
    needs: [parse-flake, trigger-deploy]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        server: ${{ fromJson(needs.parse-flake.outputs.servers) }}
    steps:
      - name: Wait for deployment
        timeout-minutes: 10
        run: |
          repo_url="https://github.com/${{ github.repository }}.git"
          expected_sha="${{ github.sha }}"
          branch="deployed/${{ matrix.server }}"

          while true; do
            deployed_sha=$(git ls-remote "$repo_url" "$branch" | cut -f1)

            if [[ "$deployed_sha" == "$expected_sha" ]]; then
              echo "✅ ${{ matrix.server }} deployed $expected_sha"
              exit 0
            fi

            echo "⏳ ${{ matrix.server }}: deployed ${deployed_sha::7}, waiting for ${expected_sha::7}..."
            sleep 5
          done
  notify:
    if: always()
    needs: [await-deploy]
    runs-on: ubuntu-latest
    steps:
      - name: Notify success
        if: needs.await-deploy.result == 'success'
        env:
          SHA: ${{ github.sha }}
          COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          body=$(printf 'Commit `%s` deployed successfully.\n> %s' "${SHA::7}" "$COMMIT_MSG")
          curl -s \
            -H "Title: CI: Deployment succeeded" \
            -H "Priority: low" \
            -H "Tags: white_check_mark" \
            -H "Actions: view, Open workflow run, ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            -H "Markdown: yes" \
            -d "$body" \
            https://ntfy.sh/splitleaf
      - name: Notify failure
        if: needs.await-deploy.result == 'failure'
        env:
          SHA: ${{ github.sha }}
          COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          body=$(printf 'Commit `%s` failed to deploy.\n> %s' "${SHA::7}" "$COMMIT_MSG")
          curl -s \
            -H "Title: CI: Deployment failed" \
            -H "Priority: default" \
            -H "Tags: rotating_light" \
            -H "Actions: view, Open workflow run, ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            -H "Markdown: yes" \
            -d "$body" \
            https://ntfy.sh/splitleaf