name: NixOS build
on:
  pull_request:
    branches:
      - main
    paths:
      - ".github/workflows/nixos-build.yml"
      - "flake.lock"
      - "flake.nix"
      - "flake/**"
      - "hosts/**"
      - "modules/**"
      - "overlays/**"
      - "profiles/**"
      - "shells/**"
      - ".sops.yaml"
      - "secrets/**"
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  discover-hosts:
    name: Discover NixOS hosts
    runs-on: ubuntu-latest
    outputs:
      hosts: ${{ steps.hosts.outputs.hosts }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
            accept-flake-config = true
            access-tokens = github.com=${{ github.token }}
      - name: Evaluate NixOS hosts
        id: hosts
        run: |
          set -euo pipefail
          hosts_json=$(nix eval --json '.#nixosConfigurations' --apply 'configs: builtins.attrNames configs')
          echo "hosts=${hosts_json}" >> "$GITHUB_OUTPUT"
          echo "Discovered hosts: ${hosts_json}"
  build-host:
    name: Build ${{ matrix.host }}
    needs: discover-hosts
    if: ${{ needs.discover-hosts.outputs.hosts != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        host: ${{ fromJSON(needs.discover-hosts.outputs.hosts) }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
            accept-flake-config = true
            access-tokens = github.com=${{ github.token }}
      - name: Build NixOS system
        run: |
          set -euo pipefail
          nix build ".#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel" \
            --print-build-logs