# Nomarchy CI — the always-on net under direct-to-main pushes.
#
# Scope (deliberate): the EVAL tier only. The runner behind this Gitea
# instance is act_runner + docker containers (the legacy repo's check.yml
# ran 57 times on it) — no systemd, no /dev/kvm — so the checks.* VM
# tests and full toplevel builds can't run here. `nix flake check
# --no-build` still catches most breakage (type errors, missing options,
# bad merges, template/mkFlake drift — see docs/TESTING.md §1); the VM
# suite stays a local/promotion gate until a KVM-capable NixOS runner
# exists (see the commented vm-checks job at the bottom).
#
# Inherited-from-legacy gotchas (learned over 57 runs, kept verbatim):
#   - Single-user Nix (--no-daemon): no systemd in the container. The
#     installer runs as root and honours build-users-group=nixbld from
#     its bundled nix.conf, aborting unless the group exists AND has
#     members — create nixbld + users first.
#   - sandbox=false: Stylix/base16.nix do import-from-derivation; the
#     single-user Nix in this container can't set up the build sandbox
#     (no user namespaces), which otherwise surfaces as
#     "path '…-source' is not valid".
#   - Pin the Nix version: 2.34's lazy-trees git cache doesn't
#     materialise flake-input `-source` paths into the store, breaking
#     the same IFD reads. 2.31.5 matches what wrote flake.lock.
#   - Plain-shell Nix install, not a JS action: act_runner's bundled act
#     tops out at node20; a `run:` step has no node-runtime coupling.

name: Check

on:
  push:
    branches: [main, v1]
  workflow_dispatch:

jobs:
  eval:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      NIX_CONFIG: |
        max-jobs = 1
        cores = 1
        experimental-features = nix-command flakes
        sandbox = false
      NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Nix
        run: |
          NIX_VERSION=2.31.5
          groupadd -r nixbld 2>/dev/null || true
          for i in $(seq 1 10); do
            useradd -r -g nixbld -G nixbld -d /var/empty \
              -s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true
          done
          curl -L "https://releases.nixos.org/nix/nix-${NIX_VERSION}/install" | sh -s -- --no-daemon
          echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"

      - name: Evaluate every output (eval tier, memory-bounded)
        # Same coverage as `nix flake check --no-build` — both nixos
        # configs, the home config, the checks.* derivations (instantiated,
        # not run) and the downstream template through lib.mkFlake — but
        # ONE output per nix process. A single process walking everything
        # peaks at ~6.0 GB RSS (measured 2026-07-12): it OOM'd the 4 GB
        # VPS itself, and can never fit this runner's 2 GB container cap.
        # Per-output processes cap at the largest single output (~1 GB).
        run: bash tools/ci-eval.sh

      - name: Python syntax (all tracked scripts)
        # Every tracked *.py — theme-sync, the installer composers
        # (compose-lock, patch-template) and the maintainer tools
        # (tools/, tools/vm/). Via nix shell so the step doesn't depend on
        # the runner image preinstalling python3.
        run: |
          nix shell nixpkgs#python3 --command \
            bash -c 'git ls-files "*.py" | xargs -r python3 -m py_compile'

      - name: Shell syntax (tracked scripts)
        # The distro's user-facing scripts are generated by Nix (their
        # syntax is exercised by the eval + local builds); this covers the
        # hand-written .sh files: installer helpers and maintainer tools.
        run: |
          set -e
          fail=0
          while IFS= read -r script; do
            head -1 "$script" | grep -qE '^#!.*\b(bash|sh)\b' || continue
            if ! bash -n "$script"; then
              echo "::error file=$script::bash syntax error"
              fail=1
            fi
          done < <(git ls-files '*.sh')
          exit "$fail"

  # ── vm-checks (DISABLED — FUTURE #20, not NEXT) ─────────────────────
  # Eval-only CI is the standing decision: Gitea act_runner stays docker
  # compose (no /dev/kvm). Full checks.* VMs need a *separate* host with
  # nix + KVM (label nix-kvm); see agent/BACKLOG.md FUTURE #20. Do NOT
  # uncomment until that label is online — Gitea queues forever otherwise.
  #
  # vm-checks:
  #   runs-on: nix-kvm
  #   timeout-minutes: 120
  #   steps:
  #     - uses: actions/checkout@v4
  #     - run: nix flake check          # builds + runs the VM tests
  #     - run: nix build .#nixosConfigurations.nomarchy.config.system.build.toplevel --no-link
  #     - run: nix build .#homeConfigurations.nomarchy.activationPackage --no-link