cabal-audit.yml

name: nix checks and build

on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  build:
    name: Build cabal-audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v26

      - name: Set up cachix
        uses: cachix/cachix-action@v14
        with:
          name: cabal-audit
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Check flake 
        run: | 
          nix -Lv flake check

      - name: Build cabal-audit
        run: |
          nix -Lv build

      - name: Build cabal-audit static
        run: |
          nix -Lv build .#cabal-audit-static -o result-static

      - name: Create release artifacts
        run: | 
          mkdir -p artifacts

          cp result-static/bin/cabal-audit artifacts
          chmod +x artifacts/cabal-audit

      - name: check if binary is static
        run: | 
          if ldd result/bin/cabal-audit 2>&1 | grep -q "not a dynamic executable"; then
            echo "static executable"
          else
            echo "dynamic executable"
            exit 1

      - name: Upload static cabal-audit exe
        uses: actions/upload-artifact@v4
        with:
          name: cabal-audit
          path: artifacts/cabal-audit

      - name: Release nightly cabal-audit exe
        if: github.ref == 'refs/heads/main'
        uses: softprops/action-gh-release@v2
        with:
          prerelease: true
          tag_name: nightly
          files: |
            artifacts/cabal-audit
          fail_on_unmatched_files: true