name: Nix Build

on:
  push:
    branches: [main]
    paths:
      - "nix/**"
      - "flake.nix"
      - "flake.lock"
      - "package.json"
      - "package-lock.json"
      - "packages/highlight/**"
      - "packages/server/**"
      - "packages/relay/**"
      - "packages/cli/**"
      - "scripts/update-nix.sh"
      - "scripts/fix-lockfile.mjs"
      - ".github/workflows/nix-build.yml"
  pull_request:
    branches: [main]
    paths:
      - "nix/**"
      - "flake.nix"
      - "flake.lock"
      - "package.json"
      - "package-lock.json"
      - "packages/highlight/**"
      - "packages/server/**"
      - "packages/relay/**"
      - "packages/cli/**"
      - "scripts/update-nix.sh"
      - "scripts/fix-lockfile.mjs"
      - ".github/workflows/nix-build.yml"

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref || github.ref }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"

      - uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Update lockfile + Nix hash if stale
        run: ./scripts/update-nix.sh

      - name: Build Nix package
        run: nix build .#default -o result

      - name: Commit hash/lockfile updates (main push only)
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          git diff --quiet package-lock.json nix/package.nix && exit 0
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add package-lock.json nix/package.nix
          git commit -m "fix: update lockfile signatures and Nix hash"
          git push