name: Nix

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: nix-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

# All third-party Actions are pinned to a 40-char commit SHA with a trailing
# '# vX.Y.Z' comment so a compromised maintainer or moved tag cannot silently
# execute attacker code in CI. Bump the SHA + comment together when updating.

jobs:
  nix:
    name: Nix build & check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: nix flake check
        run: nix flake check --print-build-logs

      - name: nix build
        run: nix build .#default --print-build-logs

      - name: Smoke test binary
        run: |
          ./result/bin/pad --version
          ./result/bin/pad --help

      # The Go toolchain here exists only to install govulncheck for the
      # scan step below — the pad binary under test was built by Nix above.
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"

      - name: Scan Nix-built binary with govulncheck
        # CI's main govulncheck job scans a `go build` binary, which honours
        # go.mod's `toolchain go1.26.6` line — but nixpkgs pins
        # GOTOOLCHAIN=local, so the Nix artifact is built with whatever Go
        # patch the nixos-26.05 channel ships and can carry stdlib advisories
        # the main gate can no longer see (BUG-2567). This scans the artifact
        # that actually ships via Nix, against nix/accepted-advisories.txt:
        # known-accepted advisories stay green and visible, any NEW advisory
        # fails the job, and a warning fires when an accepted advisory clears
        # (the signal to prune the list and eventually close BUG-2567).
        #
        # govulncheck pinned to the same release as ci.yml — bump the two
        # together. GOTOOLCHAIN=auto on the install mirrors ci.yml's
        # rationale: setup-go exports GOTOOLCHAIN=local, and if govulncheck's
        # own go.mod ever requires a patch newer than setup-go's resolved
        # one, `auto` lets Go fetch it instead of failing the install.
        run: |
          GOTOOLCHAIN=auto go install golang.org/x/vuln/cmd/govulncheck@v1.2.0
          GOVULNCHECK="$(go env GOPATH)/bin/govulncheck" nix/vulnscan.sh result/bin/pad