name: vm-nightly

# Builds the `vmTests` flake output: tests that boot NixOS VMs and need KVM.
# They are not `checks`, so the per-PR `nix flake check` job never runs them.
# Nightly plus manual dispatch; a failing test fails the run, which the forge
# shows as a failed scheduled run.
#
# Run one by hand from the forge UI (Actions, vm-nightly, "Run workflow",
# `test` input) or locally with `nix build .#vmTests.x86_64-linux.<name>`.
#
# ⚠️ The hour is deliberate: at the default job capacity of 1
# (`services.hyperhive.deploy.ci-runner.concurrency`) this job holds the
# runner for its whole run and everything else queues behind it. It sits
# between coverage (02:00) and flake-update (03:00).
#
# Separate from ci.yml because a `workflow_dispatch` trigger there fires every
# job in that file, and this must not run per pull request.
on:
  workflow_dispatch:
    inputs:
      test:
        description: "vmTests attribute to build (empty builds all)"
        required: false
        default: ""
  schedule:
    - cron: "30 2 * * *"

jobs:
  vm-tests:
    name: nix build vmTests
    if: vars.PUBLIC_FORGE != 'true'
    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
    steps:
      - uses: actions/checkout@v3
      - name: build
        env:
          TEST: ${{ inputs.test }}
        run: |
          set -eu
          system=x86_64-linux
          tests="$TEST"
          if [ -z "$tests" ]; then
            tests="$(nix eval --raw ".#vmTests.$system" --apply 'ts: builtins.concatStringsSep " " (builtins.attrNames ts)')"
          fi
          set --
          for t in $tests; do
            set -- "$@" ".#vmTests.$system.$t"
          done
          nix build --no-link --keep-going --print-build-logs "$@"