cachix.yml

name: Populate Cachix

on:
  push:
    branches:
      - main
    paths:
      - flake.nix
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: populate-cachix-${{ github.ref }}
  cancel-in-progress: false

env:
  CACHIX_CACHE_NAME: codex-desktop-linux
  CARGO_TERM_COLOR: always
  NIX_CONFIG: experimental-features = nix-command flakes

jobs:
  detect-codex-dmg-hash:
    name: Detect Codex DMG hash change
    if: github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    outputs:
      changed: ${{ steps.codex-dmg-hash.outputs.changed }}
      current: ${{ steps.codex-dmg-hash.outputs.current }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 2
          persist-credentials: false

      - name: Compare Codex DMG hashes
        id: codex-dmg-hash
        env:
          EVENT_NAME: ${{ github.event_name }}
          BEFORE_SHA: ${{ github.event.before }}
        run: |
          set -euo pipefail

          current_hash="$(
            scripts/ci/update-nix-hashes.sh \
              read-flake-hash "codexDmg = pkgs.fetchurl {" "hash = "
          )"
          previous_flake="$(mktemp)"
          trap 'rm -f "$previous_flake"' EXIT

          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            changed=true
            previous_hash=manual-backfill
          elif [ "$BEFORE_SHA" = "0000000000000000000000000000000000000000" ]; then
            changed=true
            previous_hash=missing
          else
            if ! git cat-file -e "$BEFORE_SHA:flake.nix" 2>/dev/null; then
              git fetch --no-tags --depth=1 origin "$BEFORE_SHA"
            fi
            git show "$BEFORE_SHA:flake.nix" > "$previous_flake"
            previous_hash="$(
              FLAKE_FILE="$previous_flake" scripts/ci/update-nix-hashes.sh \
                read-flake-hash "codexDmg = pkgs.fetchurl {" "hash = "
            )"
            if [ "$current_hash" = "$previous_hash" ]; then
              changed=false
            else
              changed=true
            fi
          fi

          {
            echo "changed=$changed"
            echo "current=$current_hash"
          } >> "$GITHUB_OUTPUT"
          {
            echo "## Codex DMG hash"
            echo
            echo "- Previous: \`$previous_hash\`"
            echo "- Current: \`$current_hash\`"
            echo "- Populate Cachix: \`$changed\`"
          } >> "$GITHUB_STEP_SUMMARY"

  populate:
    name: Build Nix flake outputs
    needs: detect-codex-dmg-hash
    if: needs.detect-codex-dmg-hash.outputs.changed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 150
    env:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31

      - name: Configure Cachix for explicit uploads
        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ${{ env.CACHIX_CACHE_NAME }}
          authToken: ${{ env.CACHIX_AUTH_TOKEN }}
          skipPush: true

      - name: Warn when Cachix push token is missing
        if: env.CACHIX_AUTH_TOKEN == ''
        run: |
          cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
          ## Cachix

          `CACHIX_AUTH_TOKEN` is not configured, so this run will build without pushing to Cachix.
          Add a write token for the `codex-desktop-linux` Cachix cache as a repository secret to populate it automatically.
          EOF

      - name: Build, upload, and collect cacheable Nix outputs
        run: |
          set -euo pipefail

          outputs=(
            .#codex-desktop
            .#codex-desktop-computer-use-ui
            .#codex-desktop-remote-mobile-control
            .#codex-desktop-computer-use-ui-remote-mobile-control
            .#checks.x86_64-linux.watchdog-linux-features
            .#installer
          )

          for output in "${outputs[@]}"; do
            echo "Building $output"
            store_paths_file="$RUNNER_TEMP/cachix-store-paths"
            nix build "$output" \
              --no-link \
              --print-build-logs \
              --print-out-paths > "$store_paths_file"
            mapfile -t store_paths < "$store_paths_file"
            if [ "${#store_paths[@]}" -eq 0 ]; then
              echo "Nix did not return a store path for $output." >&2
              exit 1
            fi
            if [ -n "$CACHIX_AUTH_TOKEN" ]; then
              printf '%s\n' "${store_paths[@]}" | cachix push "$CACHIX_CACHE_NAME"
            fi
            nix store gc
          done

          {
            echo "## Cachix population"
            echo
            echo "- Triggering Codex DMG hash: \`${{ needs.detect-codex-dmg-hash.outputs.current }}\`"
            echo "- Cache: \`$CACHIX_CACHE_NAME\`"
            printf -- '- Built and collected: `%s`\n' "${outputs[@]}"
          } >> "$GITHUB_STEP_SUMMARY"