name: Update Nix binary cache
on:
  push:
    branches:
      - "**"
  workflow_dispatch:
permissions:
  contents: write
concurrency:
  group: nix-release-cache-publisher
  cancel-in-progress: false
jobs:
  update:
    name: Build every host and publish new cache objects
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
            accept-flake-config = true
      - name: Build and publish new cache objects
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          NIX_CACHE_PRIVATE_KEY: ${{ secrets.NIX_CACHE_PRIVATE_KEY }}
          CACHE_MODE: update
          CACHE_REPOSITORY: moons-14/dotfiles
          CACHE_SERVER_URL: https://git.yutakobayashi.com
          CACHE_COMMIT: ${{ github.sha }}
          CACHE_REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          if [[ -z "${NIX_CACHE_PRIVATE_KEY:-}" ]]; then
            echo "Repository secret NIX_CACHE_PRIVATE_KEY is required." >&2
            exit 1
          fi

          key_file="${RUNNER_TEMP:-/tmp}/nix-cache-private-key"
          umask 077
          printf '%s\n' "$NIX_CACHE_PRIVATE_KEY" > "$key_file"
          unset NIX_CACHE_PRIVATE_KEY

          export NIX_CACHE_KEY_FILE="$key_file"
          trap 'rm -f "$key_file"' EXIT
          ./.gitea/scripts/publish-nix-cache.sh