workflow.yml

on:
  workflow_call:
    inputs:
      visibility:
        required: false
        type: string
      default-branch:
        required: false
        default: ${{ github.event.repository.default_branch }}
        type: string
      enable-ssh-agent:
        required: false
        default: false
        type: boolean
      directory:
        required: false
        default: "."
        type: string
      runner-map:
        required: false
        type: string
        default: |
          {
            "aarch64-darwin": "macos-latest",
            "x86_64-darwin": "macos-latest",
            "x86_64-linux": "ubuntu-latest",
            "i686-linux": "ubuntu-latest",
            "aarch64-linux": "ubuntu-24.04-arm"
          }
    outputs:
      flake_name:
        value: ${{ jobs.success.outputs.flake_name }}
        description: |
          Name of the flake.

          Example: DeterminateSystems/flakehub-push
      flake_version:
        value: ${{ jobs.success.outputs.flake_version }}
        description: |
          Version of the published flake.

          Example: 0.1.99+rev-2075013a3f3544d45a96f4b35df4ed03cd53779c
      flakeref_exact:
        value: ${{ jobs.success.outputs.flakeref_exact }}
        description: |
          A precise reference that always resolves to this to this exact release.

          Example: DeterminateSystems/flakehub-push/=0.1.99+rev-2075013a3f3544d45a96f4b35df4ed03cd53779c
      flakeref_at_least:
        value: ${{ jobs.success.outputs.flakeref_at_least }}
        description: |
          A loose reference to this release.
          Depending on this reference will require at least this version, and will also resolve to newer releases.
          This output is not sufficient for deployment pipelines, use flake_exact instead.

          Example: DeterminateSystems/flakehub-push/0.1.99+rev-2075013a3f3544d45a96f4b35df4ed03cd53779c

    secrets:
      ssh-private-key:
        required: false

jobs:
  inventory:
    runs-on: ubuntu-latest

    outputs:
      systems: ${{ steps.inventory.outputs.systems }}

    permissions:
      id-token: "write"
      contents: "read"

    steps:
      - uses: actions/checkout@v4
      # disabled pending strategy discussion on exposing tunables
      # - uses: Determinatesystems/flake-checker-action@main
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          flakehub: true
      - uses: DeterminateSystems/flakehub-cache-action@main
      - uses: webfactory/ssh-agent@v0.9.0
        if: ${{ inputs.enable-ssh-agent }}
        with:
          ssh-private-key: ${{ secrets.ssh-private-key }}
      - name: Inventory the flake for targeted systems
        id: inventory
        env:
          FLAKE_ITER_RUNNER_MAP: ${{ toJson(fromJson(inputs.runner-map)) }}
        working-directory: ${{ inputs.directory }}
        run: |
          nix run "https://flakehub.com/f/DeterminateSystems/flake-iter/*" -- systems
  build:
    runs-on: ${{ matrix.systems.runner }}
    needs: inventory
    strategy:
      matrix:
        systems: ${{ fromJSON(needs.inventory.outputs.systems) }}

    permissions:
      id-token: "write"
      contents: "read"

    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: DeterminateSystems/flakehub-cache-action@main
      - uses: webfactory/ssh-agent@v0.9.0
        if: ${{ inputs.enable-ssh-agent }}
        with:
          ssh-private-key: ${{ secrets.ssh-private-key }}
      - name: Build for ${{ matrix.systems.nix-system }}
        env:
          FLAKE_ITER_NIX_SYSTEM: ${{ matrix.systems.nix-system }}
        working-directory: ${{ inputs.directory }}
        run: nix run 'https://flakehub.com/f/DeterminateSystems/flake-iter/*' -- --verbose build

  success:
    runs-on: ubuntu-latest
    needs: build
    if: ${{ always() }}
    permissions:
      id-token: "write"
      contents: "read"

    outputs:
      flake_name: ${{ steps.publish.outputs.flake_name }}
      flake_version: ${{ steps.publish.outputs.flake_version }}
      flakeref_exact: ${{ steps.publish.outputs.flakeref_exact }}
      flakeref_at_least: ${{ steps.publish.outputs.flakeref_at_least }}
    steps:
      - run: "true"
      - run: |
          echo "A dependent in the build matrix failed."
          exit 1
        if: |
          contains(needs.*.result, 'failure') ||
          contains(needs.*.result, 'cancelled')
      - uses: actions/checkout@main
        if: ${{ !github.repository.fork && inputs.visibility != '' && (github.ref == format('refs/heads/{0}', inputs.default-branch) || startsWith(github.ref, 'refs/tags/')) }}
      - uses: DeterminateSystems/nix-installer-action@main
        if: ${{ !github.repository.fork && inputs.visibility != '' && (github.ref == format('refs/heads/{0}', inputs.default-branch) || startsWith(github.ref, 'refs/tags/')) }}
        with:
          flakehub: true
      - uses: DeterminateSystems/flakehub-cache-action@main
        if: ${{ !github.repository.fork && inputs.visibility != '' && (github.ref == format('refs/heads/{0}', inputs.default-branch) || startsWith(github.ref, 'refs/tags/')) }}
      - uses: "DeterminateSystems/flakehub-push@main"
        if: ${{ !github.repository.fork && inputs.visibility != '' && (github.ref == format('refs/heads/{0}', inputs.default-branch) || startsWith(github.ref, 'refs/tags/')) }}
        id: publish
        with:
          rolling: ${{ github.ref == format('refs/heads/{0}', inputs.default-branch) }}
          visibility: ${{ inputs.visibility }}
          include-output-paths: true
          directory: ${{ inputs.directory }}