deploy.yml

name: Deploy
on:
  workflow_dispatch:
    inputs:
      commit-x86_64-linux-failures:
        description: Commit X86-64 Linux failures.nix
        required: false
        default: true
        type: boolean
      commit-aarch64-linux-failures:
        description: Commit Aarch64 Linux failures.nix
        required: false
        default: true
        type: boolean
      commit-aarch64-darwin-failures:
        description: Commit Aarch64 Darwin failures.nix
        required: false
        default: true
        type: boolean
      force:
        description: Force deploy (skip sync check)
        required: false
        default: false
        type: boolean
  schedule:
    - cron: "0 8,16 * * *"

permissions:
  contents: write
  # requirements for docs:
  pages: write
  id-token: write
  actions: read
  # requirement for the workflow building other systems:
  pull-requests: write

jobs:
  check-sync:
    name: Check if deployment is needed
    runs-on: ubuntu-latest
    outputs:
      should_run: ${{ steps.check.outputs.should_run }}
      old_sha: ${{ steps.check.outputs.old_sha }}
    steps:
      - id: check
        run: |
          if [ "${{ inputs.force }}" = "true" ]; then
            echo "should_run=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          UNSTABLE_SHA=$(git ls-remote https://github.com/${{ github.repository }} nyxpkgs-unstable | awk '{print $1}')
          printf "Current is '%s', deployed is %s\n" '${{ github.sha }}' "$UNSTABLE_SHA"
          echo "old_sha=$UNSTABLE_SHA" >> "$GITHUB_OUTPUT"
          if [ "$UNSTABLE_SHA" = "${{ github.sha }}" ]; then
            echo "should_run=false" >> "$GITHUB_OUTPUT"
          else
            echo "should_run=true" >> "$GITHUB_OUTPUT"
          fi
  deploy-build:
    name: Build-all x86-64 Linux (to deploy)
    needs: check-sync
    if: needs.check-sync.outputs.should_run == 'true'
    uses: ./.github/workflows/garuda-build-all-x86_64-linux.yml
    secrets: inherit
    with:
      commit-failures: ${{ inputs.commit-x86_64-linux-failures || false }}
      pin: "missing"
  deploy-check:
    name: Run flake check
    needs: deploy-build
    if: needs.deploy-build.outputs.built == 'true'
    continue-on-error: true
    runs-on: ubuntu-latest
    timeout-minutes: 70
    outputs:
      checked: ${{ steps.check.outcome == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            accept-flake-config = true
            sandbox-fallback = false
            system-features = big-parallel gccarch-x86-64-v3 kvm nixos-test
      - name: Run flake check
        id: check
        run: |
          NIXPKGS_ALLOW_UNFREE=1 nix flake check --impure
      - name: Send Telegram Failure Notification
        if: failure()
        uses: appleboy/telegram-action@master
        with:
          to: ${{ secrets.TELEGRAM_TO }}
          token: ${{ secrets.TELEGRAM_TOKEN }}
          message: |
            ❌ Flake check failed while deploying!
            Run: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
      - name: Send Matrix Failure Notification
        if: failure()
        run: |
          jq -n --arg msg "$MSG" '{"msgtype": "m.notice", "body": $msg}' | \
          curl --fail -sS -X PUT -H "Content-Type: application/json" \
            "https://${{ secrets.MATRIX_SERVER }}/_matrix/client/v3/rooms/${{ secrets.MATRIX_TO }}/send/m.room.message/${TXN_ID}?access_token=${{ secrets.MATRIX_TOKEN }}" \
            -d @-
        env:
          TXN_ID: ${{ github.run_id }}-${{ github.job }}-failure
          MSG: |
            ❌ Flake check failed while deploying!
            Run: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
  deploy-push:
    name: Push to nyxpkgs-unstable
    needs: deploy-build
    if: needs.deploy-build.outputs.built == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    outputs:
      pushed: ${{ steps.push.outcome == 'success' }}
    steps:
      # Checkout the main branch
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-tags: true
      - name: Update nyxpkgs-unstable
        id: push
        run: |
          git push origin HEAD:nyxpkgs-unstable --force
  notify-socials-deployment:
    name: Notify Socials Deployment
    needs: [check-sync, deploy-push]
    if: needs.deploy-push.outputs.pushed == 'true'
    continue-on-error: true
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Collect changes
        id: collect_changes
        run: |
          COMMITS=$(git log --pretty=format:"- %s" --reverse --no-merges ${{ needs.check-sync.outputs.old_sha }}..HEAD || echo "- Multiple updates")
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          echo "commits<<$EOF" >> "$GITHUB_OUTPUT"
          echo "$COMMITS" >> "$GITHUB_OUTPUT"
          echo "$EOF" >> "$GITHUB_OUTPUT"

          # Extract keys using awk by splitting on quotes, and sort them for comparison
          OLD_KEYS=$(git show ${{ needs.check-sync.outputs.old_sha }}:maintenance/failures.x86_64-linux.nix 2>/dev/null | awk -F'"' '/=/ {print $2}' | sort || true)
          NEW_KEYS=$(awk -F'"' '/=/ {print $2}' ./maintenance/failures.x86_64-linux.nix 2>/dev/null | sort || true)

          # Use comm to find added (-13) and removed (-23) lines, appending prefixes
          ADDED_FAILURES=$(comm -13 <(echo "$OLD_KEYS") <(echo "$NEW_KEYS") | awk 'NF {print "+ " $0}')
          REMOVED_FAILURES=$(comm -23 <(echo "$OLD_KEYS") <(echo "$NEW_KEYS") | awk 'NF {print "- " $0}')

          echo "added_failures<<$EOF" >> "$GITHUB_OUTPUT"
          echo "${ADDED_FAILURES:-None}" >> "$GITHUB_OUTPUT"
          echo "$EOF" >> "$GITHUB_OUTPUT"
          echo "removed_failures<<$EOF" >> "$GITHUB_OUTPUT"
          echo "${REMOVED_FAILURES:-None}" >> "$GITHUB_OUTPUT"
          echo "$EOF" >> "$GITHUB_OUTPUT"
      - name: Send Telegram Message
        uses: appleboy/telegram-action@master
        with:
          to: ${{ secrets.TELEGRAM_TO }}
          token: ${{ secrets.TELEGRAM_TOKEN }}
          message: |
            New update deployed!

            New commits:
            ${{ steps.collect_changes.outputs.commits }}

            Fixed:
            ${{ steps.collect_changes.outputs.removed_failures }}

            New failures:
            ${{ steps.collect_changes.outputs.added_failures }}
      - name: Send Matrix Notification
        run: |
          jq -n --arg msg "$MSG" '{"msgtype": "m.notice", "body": $msg}' | \
          curl --fail -sS -X PUT -H "Content-Type: application/json" \
            "https://${{ secrets.MATRIX_SERVER }}/_matrix/client/v3/rooms/${{ secrets.MATRIX_TO }}/send/m.room.message/${TXN_ID}?access_token=${{ secrets.MATRIX_TOKEN }}" \
            -d @-
        env:
          TXN_ID: ${{ github.run_id }}-${{ github.job }}
          MSG: |
            New update deployed!

            New commits:
            ${{ steps.collect_changes.outputs.commits }}

            Fixed:
            ${{ steps.collect_changes.outputs.removed_failures }}

            New failures:
            ${{ steps.collect_changes.outputs.added_failures }}
  deploy-docs:
    needs: deploy-push
    uses: ./.github/workflows/document.yml
    if: needs.deploy-push.outputs.pushed == 'true'
  flakehub:
    needs: deploy-docs
    uses: ./.github/workflows/flakehub-publish-rolling.yml
    if: needs.deploy-docs.outputs.built == 'true'
  deploy-build-aarch64-linux:
    needs: deploy-build
    uses: ./.github/workflows/build-all-aarch64-linux.yml
    if: needs.deploy-build.outputs.built == 'true'
    secrets: inherit
    with:
      commit-failures: ${{ inputs.commit-aarch64-linux-failures || false }}
      pin: "missing"
  deploy-build-aarch64-darwin:
    needs: deploy-build
    uses: ./.github/workflows/build-all-aarch64-darwin.yml
    if: needs.deploy-build.outputs.built == 'true'
    secrets: inherit
    with:
      commit-failures: ${{ inputs.commit-aarch64-darwin-failures || false }}
      pin: "missing"