nix-actions/default.nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{
  sources ? import ./npins,
  pkgs ? import sources.nixpkgs { },
}:

let
  inherit (pkgs) mkShell;

  inherit (pkgs.lib) evalModules getExe recursiveUpdate;

  inherit (pkgs.lib.fileset) gitTracked toSource;

  git-checks = (import sources.git-hooks).run {
    src = ./.;

    hooks = {
      statix = {
        enable = true;
        stages = [ "pre-push" ];
        settings.ignore = [ "npins" ];
      };

      deadnix = {
        enable = true;
        stages = [ "pre-push" ];
      };

      nixfmt-rfc-style = {
        enable = true;
        stages = [ "pre-push" ];
      };

      reuse = {
        enable = true;
        stages = [ "pre-push" ];
        package = pkgs.reuse;
      };

      actions-validator = workflows.gitHook { stages = [ "pre-push" ]; };

      commitizen.enable = true;
    };
  };

  reuse = (import sources.nix-reuse { inherit pkgs; }).install {
    defaultCopyright = "Tom Hubrecht <tom.hubrecht@dgnum.eu>";
    defaultLicense = "EUPL-1.2";

    downloadLicenses = true;

    generatedPaths = [
      ".envrc"
      ".forgejo/workflows/*.yaml"
      ".gitignore"
      "shell.nix"
    ];

    annotations = [
      # npins generated files
      {
        path = "**/npins/*";
        license = "EUPL-1.2";
        copyright = "The [npins](https://github.com/andir/npins) contributors";
      }
    ];
  };

  install =
    { src, ... }@config:
    let
      project = evalModules {
        modules = [
          ./modules
          {
            config = (removeAttrs config [ "src" ]) // {
              _module.args.pkgs = pkgs;
              rootSrc = toSource {
                root = src;
                fileset = gitTracked src;
              };
            };
          }
        ];
      };
    in
    {
      shellHook = project.config.installationScript;
      gitHook = recursiveUpdate {
        enable = true;
        name = "Actions validator";
        entry = getExe pkgs.action-validator;
        files = "\\.${project.config.platform}/workflows/.*\\.ya?ml";
      };
    };

  workflows = install {
    src = ./.;

    buildCheck = false;

    workflows.pre-commit = {
      name = "Run pre-commit on all files";
      on = [
        "pull_request"
        "push"
      ];

      jobs.pre-push = {
        runs-on = "nix";
        steps = [
          { uses = "actions/checkout@v3"; }
          {
            name = "Run pre-commit on all files";
            run = "nix-shell -A pre-commit --run 'pre-commit run --all-files --hook-stage pre-push --show-diff-on-failure'";
          }
        ];
      };
    };
  };
in

{
  devShell = mkShell {
    name = "nix-actions.dev";

    packages = git-checks.enabledPackages;

    shellHook = builtins.concatStringsSep "\n" [
      git-checks.shellHook
      reuse.shellHook
      workflows.shellHook
    ];

    passthru.pre-commit = mkShell {
      name = "pre-commit";
      inherit (git-checks) shellHook;
    };
  };

  inherit install;

  lib = rec {
    expr = repr: "\${{ ${repr} }}";
    secret = name: expr "secrets.${name}";
  };

  steps =
    {
      __functor =
        self:
        {
          name,
          url,
          defaultVersion,
        }:
        self
        // {
          ${name} =
            {
              __version ? defaultVersion,
              ...
            }@args:
            {
              uses = "${url}@${__version}";
              "with" = builtins.removeAttrs args [ "__version" ];
            };
        };
    }
      {
        name = "checkout";
        defaultVersion = "v3";
        url = "actions/checkout";
      };
}