ci.yml

name: 'Trustless Sidechain CI'
on:
  pull_request:
  push:
    branches:
      - master
      - develop
  workflow_dispatch:

env:
  AWS_DEFAULT_REGION: eu-central-1

jobs:
  build-x64-linux:
    permissions:
      id-token: write
      contents: read
    runs-on: [ self-hosted, Linux ]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          token: ${{ github.token }}

      - name: Add signing key for nix
        run: echo "${{ secrets.NIX_SIGNING_KEY }}" > "${{ runner.temp }}/nix-key"

      - name: Run nixci to build all outputs
        run: nix run github:srid/nixci -- -v build > /tmp/outputs

      - name: Acquire AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}

      - name: Copy nix scopes to nix cache
        run: |
          nix-store --stdin -q --deriver < /tmp/outputs | nix-store --stdin -qR --include-outputs \
          | nix copy --stdin --to \
          "s3://cache.sc.iog.io?secret-key=${{ runner.temp }}/nix-key&region=$AWS_DEFAULT_REGION" \
          && rm /tmp/outputs

  test-x64-linux:
    permissions:
      id-token: write
      contents: read
    runs-on: [ self-hosted, Linux ]
    needs:
      - build-x64-linux
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          token: ${{ github.token }}
      - name: Run tests
        run: nix build .#check.x86_64-linux -L

  build-arm64-darwin:
    permissions:
      id-token: write
      contents: read
    runs-on: [ self-hosted, macOS ]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          token: ${{ github.token }}

      - name: Add signing key for nix
        run: echo "${{ secrets.NIX_SIGNING_KEY }}" > "${{ runner.temp }}/nix-key"

      - name: Run nixci to build all outputs
        run: nix run github:srid/nixci -- -v build > /tmp/outputs

      - name: Acquire AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}

      - name: Copy nix scopes to nix cache
        run: |
          nix-store --stdin -q --deriver < /tmp/outputs | nix-store --stdin -qR --include-outputs \
          | nix copy --stdin --to \
          "s3://cache.sc.iog.io?secret-key=${{ runner.temp }}/nix-key&region=$AWS_DEFAULT_REGION" \
          && rm /tmp/outputs

  test-arm64-darwin:
    permissions:
      id-token: write
      contents: read
    runs-on: [ self-hosted, macOS ]
    needs:
      - build-arm64-darwin
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          token: ${{ github.token }}
      - name: Run tests
        run: nix build .#check.aarch64-darwin -L