name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # The same complete offline gate is used locally and in CI.
  nix:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v31

      - name: Restore and save Nix store
        uses: nix-community/cache-nix-action@v7
        with:
          primary-key: nix-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.nix', 'flake.lock', 'Cargo.lock', 'Cargo.toml') }}-${{ hashFiles('crates/**', 'scripts/**', 'install.sh', 'README.md', 'LICENSE') }}
          restore-prefixes-first-match: |
            nix-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.nix', 'flake.lock', 'Cargo.lock', 'Cargo.toml') }}-
            nix-v2-${{ runner.os }}-${{ runner.arch }}-
          gc-max-store-size-linux: 8G

      - name: Flake check
        run: nix flake check -L

  # Keep native BSD/macOS tools in the installer portability check; the Linux
  # sh/dash scenarios and ShellCheck are covered by the flake.
  install-script:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-14]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Test install.sh with sh
        run: scripts/install-sh-test.sh