datapass 0.1.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  # Check formatting
  format:
    name: Format Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v15
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: cachix/cachix-action@v15
        with:
          name: datapass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Check formatting
        run: nix fmt -- --fail-on-change .

  # Nix-specific checks
  nix-checks:
    name: Nix Checks
    runs-on: ubuntu-latest
    strategy:
      matrix:
        check: [deadnix-check, statix-check]
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v15
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: cachix/cachix-action@v15
        with:
          name: datapass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Run ${{ matrix.check }}
        run: nix build .#checks.x86_64-linux.${{ matrix.check }} -L

  # Build and test
  build-and-test:
    name: Build and Test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest] # Temporarily disabled macOS due to nixpkgs darwin.apple_sdk_11_0 migration issue
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v15
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: cachix/cachix-action@v15
        with:
          name: datapass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Build
        run: nix build -L
      - name: Run tests
        run: nix develop --command cargo test

  # Clippy
  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v15
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: cachix/cachix-action@v15
        with:
          name: datapass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Run Clippy
        run: nix build .#checks.x86_64-linux.datapass-clippy -L

  # Documentation
  docs:
    name: Documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v15
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: cachix/cachix-action@v15
        with:
          name: datapass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Build documentation
        run: nix build .#checks.x86_64-linux.datapass-doc -L

  # Build for multiple platforms
  build-matrix:
    name: Build ${{ matrix.system }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - system: x86_64-linux
            os: ubuntu-latest
          - system: aarch64-linux
            os: ubuntu-latest
          # Temporarily disabled Darwin builds due to nixpkgs darwin.apple_sdk_11_0 migration issue
          # - system: x86_64-darwin
          #   os: macos-15-large
          # - system: aarch64-darwin
          #   os: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v15
        with:
          extra-conf: |
            extra-platforms = ${{ matrix.system == 'aarch64-linux' && 'aarch64-linux' || '' }}
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: cachix/cachix-action@v15
        with:
          name: datapass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Set up QEMU (for aarch64-linux)
        if: matrix.system == 'aarch64-linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y qemu-user-static
      - name: Build for ${{ matrix.system }}
        run: nix build .#packages.${{ matrix.system }}.datapass -L
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: datapass-${{ matrix.system }}
          path: result/bin/datapass
          if-no-files-found: error

  # Build and publish Docker image
  docker:
    name: Docker Image
    runs-on: ubuntu-latest
    needs: [build-and-test]
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v15
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: cachix/cachix-action@v15
        with:
          name: datapass
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Build Docker image
        run: nix build .#dockerImage -L
      - name: Push to Docker Hub
        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          IMAGE_SCRIPT=$(nix build .#dockerImage --no-link --print-out-paths)
          $IMAGE_SCRIPT | nix shell nixpkgs#skopeo -c skopeo copy \
            --dest-creds "$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN" \
            docker-archive:/dev/stdin \
            docker://docker.io/$DOCKERHUB_USERNAME/datapass:latest
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
            $IMAGE_SCRIPT | nix shell nixpkgs#skopeo -c skopeo copy \
              --dest-creds "$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN" \
              docker-archive:/dev/stdin \
              docker://docker.io/$DOCKERHUB_USERNAME/datapass:$VERSION
          fi

  # Create release on tag
  release:
    name: Create Release
    runs-on: ubuntu-latest
    needs:
      [format, nix-checks, build-and-test, clippy, docs, build-matrix, docker]
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          files: artifacts/**/*
          draft: false
          prerelease: false