name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  # Everything that compiles Rust runs as a `nix flake check` derivation
  # (fmt, clippy, tests, package verify, build, offline smoke). Crane splits
  # the crate dependency build into its own derivation, and the Nix store is
  # restored from the GitHub Actions cache, so unchanged derivations are
  # substituted instead of rebuilt.
  nix:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v31

      - name: Restore and save Nix store
        uses: nix-community/cache-nix-action@v7
        with:
          primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock', 'Cargo.lock', 'Cargo.toml') }}
          restore-prefixes-first-match: nix-${{ runner.os }}-
          gc-max-store-size-linux: 8G

      - name: Flake check
        run: nix flake check -L

      - name: Run default app
        run: nix run .#default -- version

      - name: Publish ownership snapshot tests
        run: scripts/publish-ownership-snapshot-test.sh

      - name: Build ownership publisher
        run: |
          nix build .#ownership-publisher
          ./result/bin/idx-ownership-publish --help

  install-script:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-14]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: ShellCheck
        if: runner.os == 'Linux'
        run: |
          shellcheck -s sh install.sh
          shellcheck scripts/install-sh-test.sh

      - name: Test install.sh with sh
        run: scripts/install-sh-test.sh

      - name: Test install.sh with dash
        if: runner.os == 'Linux'
        run: INSTALL_SH_SHELL=dash scripts/install-sh-test.sh