name: Nix Build

on:
  push:
    branches: [main]
    paths:
      - "nix/**"
      - "flake.nix"
      - "flake.lock"
      - "package.json"
      - "package-lock.json"
      - "packages/highlight/**"
      - "packages/server/**"
      - "packages/relay/**"
      - "packages/cli/**"
  pull_request:
    branches: [main]
    paths:
      - "nix/**"
      - "flake.nix"
      - "flake.lock"
      - "package.json"
      - "package-lock.json"
      - "packages/highlight/**"
      - "packages/server/**"
      - "packages/relay/**"
      - "packages/cli/**"

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    continue-on-error: false
    steps:
      - uses: actions/checkout@v4

      - uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Build Nix package
        run: nix build .#default -o result

      - name: Verify lockfile is complete
        # npm silently omits resolved/integrity fields in workspace monorepos.
        # Nix needs them for offline builds. See https://github.com/npm/cli/issues/4460
        run: |
          node scripts/fix-lockfile.mjs package-lock.json
          git diff --exit-code package-lock.json || {
            echo "ERROR: package-lock.json has missing resolved/integrity fields."
            echo "This is a known npm bug: https://github.com/npm/cli/issues/4460"
            echo "Run 'node scripts/fix-lockfile.mjs' and commit the result."
            exit 1
          }

      - name: Check npmDepsHash is up to date
        run: ./scripts/update-nix.sh --check