name: release-5-verify-run-nix

on:
  workflow_dispatch:
    inputs:
      ref:
        description: "The ref (branch or SHA) to obtain the tag"
        required: false
        type: string
  workflow_run:
    workflows:
      - release-2-cargo-publish
    types:
      - completed

defaults:
  run:
    shell: bash -xe {0}

jobs:
  check-run-nix:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: default
            os: ubuntu-24.04
          - target: default
            os: ubuntu-24.04-arm

    runs-on: ${{ matrix.os }}
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
        with:
          # Use the ref if provided, otherwise obtain the parent workflow branch, defaults to main.
          ref: ${{ github.event.inputs.ref || github.event.workflow_run.head_branch }}

      - id: git-info
        run: |
          VERSION="$(grep -m1 '^version = "' Cargo.toml | cut -d'"' -f2)"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=v$VERSION" >> $GITHUB_OUTPUT
          echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

      - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Populate the nix store without Obelisk # Workaround for slow garnix cache
        run: |
          nix develop --command echo
      - name: Add garnix cache
        run: |
          echo "extra-substituters = https://cache.garnix.io" >> ~/.config/nix/nix.conf
          echo "extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g" >> ~/.config/nix/nix.conf

      - name: Create temp directory
        run: mkdir temp

      - name: Build the binary
        working-directory: temp
        run: |
          full_target="github:obeli-sk/obelisk/${TAG}#${{ matrix.target }}"
          nix run $full_target -- --version
          nix run $full_target -- server generate-config
          nix run $full_target -- server verify
        env:
          TAG: ${{ steps.git-info.outputs.tag }}
