binaries.yml

name: "Build and upload static Nix binaries"

on:
  push:
    paths:
      - flake.nix
      - flake.lock
      - 'static-bins/**'

jobs:
  build-macos:
    name: Build macOS binaries
    runs-on: macos-latest
    environment: Cachix
    if: github.ref == 'refs/heads/master'
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Set up Nix
        uses: cachix/install-nix-action@v20
      - name: Set up Cachix access
        uses: cachix/cachix-action@v12
        with:
          name: nix-wrap
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          pushFilter: "(-source|-man)$"
      - name: Build macOS binaries output
        run: |
          nix build .#static-bins.aarch64-darwin-nix-static
          nix build .#static-bins.x86_64-darwin-nix-static
          nix build .#static-bins.fakedir
          cachix push nix-wrap $(nix eval --raw .#static-bins.aarch64-darwin-nix-static)
          cachix push nix-wrap $(nix eval --raw .#static-bins.x86_64-darwin-nix-static)
          cachix push nix-wrap $(nix eval --raw .#static-bins.fakedir)

  assemble-linux:
    name: Build Linux binaries and merge derivation
    runs-on: ubuntu-latest
    needs: build-macos
    environment: Cachix
    if: github.ref == 'refs/heads/master'
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Set up Nix
        uses: cachix/install-nix-action@v20
      - name: Set up Cachix access
        uses: cachix/cachix-action@v12
        with:
          name: nix-wrap
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          pushFilter: "(-source|-man)$"
      - name: Install QEMU for AArch64 builds
        run: |
          sudo apt-get -q -y update
          sudo apt-get -q -y install qemu-user-static
      - name: Build and pin final output
        run: |
          nix --extra-platforms aarch64-linux build .#static-bins
          cachix push nix-wrap $(nix eval --raw .#static-bins)
          cachix pin nix-wrap binaries $(nix eval --raw .#static-bins) --keep-forever