# Verify that Nix dependency files (.nix/bun.nix) are in sync with lockfiles
# and that the flake evaluates successfully.
#
# This catches cases where a developer updated bun.lock but forgot to
# regenerate .nix/bun.nix (e.g., committed without running bun install,
# which triggers the postinstall hook).

name: "nix build check"
on: [pull_request]

jobs:
  nix-build:
    runs-on: ubuntu-24.04
    continue-on-error: false
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - uses: cachix/install-nix-action@v30
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      # Regenerate .nix/bun.nix from bun.lock and check if it matches
      # what's committed. A diff means the developer forgot to run
      # bun scripts/check-nix-deps.ts or bun install (which triggers it).
      - name: Check bun.nix is up to date
        id: bun-check
        run: |
          bunx bun2nix -o .nix/bun.nix
          if ! git diff --quiet .nix/bun.nix; then
            echo "outdated=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Hint on outdated bun.nix
        if: steps.bun-check.outputs.outdated == 'true'
        run: |
          echo ""
          echo "::warning::.nix/bun.nix is out of sync with bun.lock"
          echo ""
          echo "┌──────────────────────────────────────────────────────────────┐"
          echo "│  .nix/bun.nix is outdated. To fix, run:                      │"
          echo "│                                                              │"
          echo "│    bun scripts/check-nix-deps.ts                             │"
          echo "│                                                              │"
          echo "│  Or simply run 'bun install' — the postinstall hook will     │"
          echo "│  regenerate it automatically. Commit the resulting changes.  │"
          echo "└──────────────────────────────────────────────────────────────┘"
          echo ""
          echo "Diff:"
          git diff .nix/bun.nix
          exit 1

      # Evaluate the flake to catch issues with cargo git dependency hashes,
      # missing inputs, or other Nix expression errors.
      # Skip if bun.nix is already outdated — nix eval would fail with a
      # cryptic error, and the bun-check step already printed a clear message.
      - name: Check flake evaluation
        if: steps.bun-check.outputs.outdated != 'true'
        id: eval
        run: |
          if ! nix eval .#packages.x86_64-linux.handy.drvPath 2>eval_err.log; then
            echo "failed=true" >> "$GITHUB_OUTPUT"
            cat eval_err.log
          fi

      - name: Hint on evaluation failure
        if: steps.eval.outputs.failed == 'true'
        run: |
          echo ""
          echo "::warning::flake.nix evaluation failed"
          echo ""
          cat eval_err.log
          exit 1

      # Full build — catches runtime build errors (broken dependencies,
      # sandbox issues, compilation failures) that flake eval alone misses.
      - name: Build handy
        if: steps.bun-check.outputs.outdated != 'true' && steps.eval.outputs.failed != 'true'
        run: nix build .#handy -L --show-trace