pr.yml

name: "Additional Info for PR"

permissions:
  pull-requests: write

on:
  pull_request

jobs:
  provide-data:
    runs-on: ubuntu-latest
    steps:
    - name: "Checkout"
      uses: actions/checkout@v4

    - name: Free Disk Space
      uses: insightsengineering/disk-space-reclaimer@v1
      with:
        swap-storage: false

    - name: Substituters
      id: substituters
      run: |
        echo "TRUSTED_PUBLIC_KEYS=$(./nix.sh ci_get trusted-public-keys)" >> "$GITHUB_OUTPUT"
        echo "SUBSTITUTERS=$(./nix.sh ci_get trusted-substituters)" >> "$GITHUB_OUTPUT"

    - uses: samueldr/lix-gha-installer-action@latest
      name: "Install Lix"
      with:
        extra_nix_config: |
          trusted-public-keys = ${{ steps.substituters.outputs.TRUSTED_PUBLIC_KEYS }}
          substituters = ${{ steps.substituters.outputs.SUBSTITUTERS }}
          experimental-features = flakes nix-command pipe-operator
          accept-flake-config = true

    - uses: DeterminateSystems/magic-nix-cache-action@main

    - name: "Build both closures"
      id: build
      env:
        CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
      run: |
        nix develop .#ci --command bash -euo pipefail <<'OUTER'
        nix-build-all --systems x86_64-linux --override-input flake . --out-link newFlake --cachix-cache spearman4157
        nix-build-all --systems x86_64-linux --override-input flake github:${{ github.repository }} --out-link oldFlake
        mv newFlake- newFlake
        mv oldFlake- oldFlake
        OUTER

    - name: "Diff Profile Closures"
      id: profile-diff
      run: |
        echo "Profile diff:" >> comment.txt
        echo "\`\`\`" >> comment.txt
        nix store diff-closures ./oldFlake ./newFlake 2>&1 | tee -a comment.txt
        echo "\`\`\`" >> comment.txt

    - name: "Generate Vulnix Report"
      id: vulnix
      run: |
        echo "Vulnerabilities in closure: " >> comment.txt
        nix shell nixpkgs#vulnix --command bash -c "vulnix ./newFlake 2>&1 | tee -a comment.txt"

    - name: PR comment with file
      uses: thollander/actions-comment-pull-request@v2
      with:
        filePath: ./comment.txt

# TODO: Flakes and Sources changelog from their respective git repositories.