runecontext/.github/workflows/ci.yml at main · runecode-systems/runecontext · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: CI

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  nix:
    name: Nix (${{ matrix.runner }} - ${{ matrix.system }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    env:
      NIX_CONFIG: |
        substituters = https://cache.nixos.org
        trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            system: x86_64-linux
          - runner: ubuntu-24.04-arm
            system: aarch64-linux
          - runner: macos-14
            system: aarch64-darwin
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.1.7
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
        with:
          # Keep PR CI on upstream Nix + cache.nixos.org to avoid flaky
          # third-party cache fetches during routine branch validation.
          determinate: false

      - name: Verify flake.lock preflight
        run: git diff --exit-code -- flake.lock

      - name: Validate flake.lock metadata
        run: nix flake lock --no-update-lock-file

      - name: Log Nix version
        run: nix --version

      - name: Run flake checks
        run: nix flake check --no-write-lock-file

      - name: Run CI command in dev shell
        run: nix develop --no-write-lock-file -c just nix-ci

      - name: Verify flake.lock unchanged
        run: git diff --exit-code -- flake.lock

      - name: Verify repository unchanged after CI command
        run: |
          git diff --exit-code
          untracked="$(git ls-files --others --exclude-standard)"
          if [ -n "$untracked" ]; then
            echo "Untracked files found after CI command:"
            echo "$untracked"
            exit 1
          fi

  windows:
    name: Windows portability
    runs-on: windows-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.1.7
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version: "1.25.7"

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "22.22.1"

      - name: Install just
        uses: taiki-e/install-action@a37010ded18ff788be4440302bd6830b1ae50d8b # v2.68.25
        with:
          tool: just@1.43.1

      - name: Install gopls
        shell: pwsh
        run: |
          go install golang.org/x/tools/gopls@v0.20.0
          "$env:USERPROFILE\go\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Install baseline CLI tools
        shell: pwsh
        run: |
          choco install -y ripgrep --version=14.1.0 --allow-downgrade
          choco install -y fd --version=10.3.0 --allow-downgrade
          choco install -y jq --version=1.8.1 --allow-downgrade

      - name: Run portability checks
        run: just ci

      - name: Verify repository unchanged after portability checks
        shell: pwsh
        run: |
          git diff --exit-code
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

          $untracked = git ls-files --others --exclude-standard
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          if ($untracked) {
            Write-Host "Untracked files found after portability checks:"
            $untracked
            exit 1
          }