name: Build

on:
  workflow_call:
    inputs:
      artifact-prefix:
        required: true
        type: string
      baseBranch:
        required: true
        type: string
      mergedSha:
        required: true
        type: string
      targetSha:
        required: true
        type: string
    secrets:
      # Should only be provided in the merge queue, not in pull requests,
      # where we're evaluating untrusted code.
      CACHIX_AUTH_TOKEN_GHA:
        required: false

permissions: {}

defaults:
  run:
    shell: bash

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            name: x86_64-linux
            systems: x86_64-linux
            builds: [shell, manual-nixos, lib-tests, tarball]
            desc: shell, docs, lib, tarball
          - runner: ubuntu-24.04-arm
            name: aarch64-linux
            systems: aarch64-linux
            builds: [shell, manual-nixos, manual-nixpkgs]
            desc: shell, docs
          - runner: macos-14
            name: darwin
            systems: aarch64-darwin x86_64-darwin
            builds: [shell]
            desc: shell
    name: '${{ matrix.name }}: ${{ matrix.desc }}'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
      - name: Checkout the merge commit
        uses: ./.github/actions/checkout
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
        with:
          # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
          name: ${{ vars.CACHIX_NAME || 'nixpkgs-gha' }}
          extraPullNames: nixpkgs-gha
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
          pushFilter: '(-source$|-nixpkgs-tarball-)'

      - run: nix-env --install -f nixpkgs/trusted-pinned -A nix-build-uncached

      - name: Build shell
        if: contains(matrix.builds, 'shell')
        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system

      - name: Build NixOS manual
        if: |
          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
          (contains(fromJSON(inputs.baseBranch).type, 'primary')
            || startsWith(fromJSON(inputs.baseBranch).branch, 'staging-nixos')
          )
        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixos --out-link nixos-manual

      - name: Build Nixpkgs manual
        if: contains(matrix.builds, 'manual-nixpkgs') && !cancelled()
        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixpkgs

      - name: Build lib tests
        if: contains(matrix.builds, 'lib-tests') && !cancelled()
        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A lib-tests

      - name: Build tarball
        if: contains(matrix.builds, 'tarball') && !cancelled()
        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A tarball

      - name: Upload NixOS manual
        if: |
          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
          contains(fromJSON(inputs.baseBranch).type, 'primary')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
          path: nixos-manual