name: CI

on:
  push:
    branches-ignore:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    name: Nix Flake Check
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Nix
        uses: nixbuild/nix-quick-install-action@v30
        with:
          nix_conf: |
            experimental-features = nix-command flakes
            accept-flake-config = true
            keep-env-derivations = true
            keep-outputs = true

      - name: Restore and save Nix store
        uses: nix-community/cache-nix-action@v6
        with:
          primary-key: nix-${{ runner.os }}-${{ hashFiles('Cargo.toml', 'flake.nix', 'flake.lock', 'Cargo.lock') }}
          restore-prefixes-first-match: nix-${{ runner.os }}-
          gc-max-store-size-linux: 1G
          purge: true
          purge-prefixes: nix-${{ runner.os }}-
          purge-created: 0
          purge-primary-key: never

      # The single CI gate. `nix flake check` builds every check in flake.nix —
      # including cesr-nextest (the entire test suite) and
      # cesr-doctest (the doc-comment examples, which nextest does not run).
      # `-L` (--print-build-logs) streams FULL build logs instead of nix's
      # truncated "last 25 lines" on a failed derivation — essential for
      # diagnosing a failing test.
      - name: Flake Check
        run: nix flake check -L
