name: build

on:
  pull_request: {}
  push:
    branches: [main]

jobs:
  build:
    runs-on: nixos
    strategy:
      matrix:
        # keep-sorted start
        host: [muede-lpt2, muede-pc2, hetzner-vpn2]
        # keep-sorted end
    steps:
      - uses: https://code.forgejo.org/actions/checkout@v4
      - run: nix build .#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel
      - run: |
          nix shell --inputs-from . nixpkgs#attic-client -c sh -c '
            attic login preem https://preem-bincache.trollhive.monster "$PREEM_PUSH_TOKEN"
            attic push preem:grid ./result
          '
        env:
          PREEM_PUSH_TOKEN: ${{ secrets.PREEM_PUSH_TOKEN }}

  # flake-update.yaml opens PRs from flake-update-* branches; if the
  # build fails on one of those, close it and delete the branch rather
  # than leaving a broken auto-generated PR around (and so a same-day
  # rerun can push the branch again). Scoped to that branch prefix so a
  # failing build on a human-authored PR is never auto-closed.
  close-on-failure:
    needs: build
    if: failure() && startsWith(github.head_ref, 'flake-update-')
    runs-on: nixos
    steps:
      - run: |
          curl -sf -X PATCH \
            -H "Authorization: token ${PR_BOT_TOKEN}" \
            -H "Content-Type: application/json" \
            -d '{"state": "closed"}' \
            "https://forge.darkest.space/api/v1/repos/mara/nixos-configs/pulls/${{ github.event.pull_request.number }}"
          curl -sf -X DELETE \
            -H "Authorization: token ${PR_BOT_TOKEN}" \
            "https://forge.darkest.space/api/v1/repos/mara/nixos-configs/branches/${HEAD_REF}"
        env:
          PR_BOT_TOKEN: ${{ secrets.PR_BOT_TOKEN }}
          HEAD_REF: ${{ github.head_ref }}