nix-parse-v2.yml

name: "Check whether nix files are parseable v2"

on:
  pull_request_target:

permissions: {}

jobs:
  get-merge-commit:
    uses: ./.github/workflows/get-merge-commit.yml

  tests:
    name: nix-files-parseable-check
    runs-on: ubuntu-24.04
    needs: get-merge-commit
    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
    steps:
      - name: Get list of changed files from PR
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh api \
            repos/${{ github.repository }}/pulls/${{github.event.number}}/files --paginate \
            | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
            > "$HOME/changed_files"
          if [[ -s "$HOME/changed_files" ]]; then
            echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
          fi

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
        with:
          extra_nix_config: sandbox = true
          nix_path: nixpkgs=channel:nixpkgs-unstable

      - name: Parse all changed or added nix files
        run: |
          ret=0
          while IFS= read -r file; do
            out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
          done < "$HOME/changed_files"
          exit "$ret"
        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}