nix-actions/default.nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{
  sources ? import ./npins,
  pkgs ? import sources.nixpkgs { },
}:

let
  inherit (pkgs) mkShell;

  inherit (pkgs.lib) evalModules getExe recursiveUpdate;

  git-checks = (import sources.git-hooks).run {
    src = ./.;

    hooks = {
      statix = {
        enable = true;
        stages = [ "pre-push" ];
        settings.ignore = [ "npins" ];
      };

      deadnix = {
        enable = true;
        stages = [ "pre-push" ];
      };

      nixfmt-rfc-style = {
        enable = true;
        stages = [ "pre-push" ];
      };

      reuse = {
        enable = true;
        stages = [ "pre-push" ];
        package = pkgs.reuse;
      };

      actions-validator = workflows.gitHook { stages = [ "pre-push" ]; };

      commitizen.enable = true;
    };
  };

  reuse = (import sources.nix-reuse { inherit pkgs; }).install {
    defaultCopyright = "Tom Hubrecht <tom.hubrecht@dgnum.eu>";
    defaultLicense = "EUPL-1.2";

    downloadLicenses = true;

    generatedPaths = [
      ".envrc"
      ".forgejo/workflows/*.yaml"
      ".gitignore"
      "shell.nix"
    ];

    annotations = [
      # npins generated files
      {
        path = "**/npins/*";
        license = "EUPL-1.2";
        copyright = "The [npins](https://github.com/andir/npins) contributors";
      }
    ];
  };

  install =
    config:
    let
      project = evalModules {
        modules = [
          ./modules
          {
            config = config // {
              _module.args.pkgs = pkgs;
            };
          }
        ];
      };
    in
    {
      shellHook = project.config.installationScript;
      gitHook = recursiveUpdate {
        enable = true;
        name = "Actions validator";
        entry = getExe pkgs.action-validator;
        files = "\\.${project.config.platform}/workflows/.*\\.ya?ml";
      };
    };

  workflows = install {
    src = ./.;

    buildCheck = false;

    workflows.pre-commit = {
      name = "Run pre-commit on all files";
      on = [
        "pull_request"
        "push"
      ];

      jobs.pre-push = {
        runs-on = "nix";
        steps = [
          (lib.steps.checkout { })
          {
            name = "Run pre-commit on all files";
            run = lib.nix-shell {
              shell = "pre-commit";
              script = "pre-commit run --all-files --hook-stage pre-push --show-diff-on-failure";
            };
          }
        ];
      };
    };
  };

  lib = import ./lib { inherit (pkgs) lib; };
in

{
  devShell = mkShell {
    name = "nix-actions.dev";

    packages = git-checks.enabledPackages;

    shellHook = builtins.concatStringsSep "\n" [
      git-checks.shellHook
      reuse.shellHook
      workflows.shellHook
    ];

    passthru.pre-commit = mkShell {
      name = "pre-commit";
      inherit (git-checks) shellHook;
    };
  };

  inherit lib install;
}