ci.yaml

on:
  pull_request:
  push:
    branches:
      - main
      - develop
  workflow_dispatch:

env:
  REPO_USERNAME: ${{ github.actor }}
  REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

permissions:
  contents: read
  packages: write
  actions: write

jobs:
  # Build and push all components
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@main

      - name: Setup Nix environment
        uses: ./.github/actions/setup-nix
        with:
          nixbuild_key: ${{ secrets.NIXBUILD_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          cache_key: build

      - name: Build and push environments
        run: |
          nix build --file . push --out-link nix-envs
          ./nix-envs/bin/push

      # Build and push all components sequentially to reuse Nix store
      - name: Build and push Lix image
        run: |
          nix build --file . lixImage.push --out-link nix-images
          ./nix-images/bin/push

      - name: Build and push scratch image
        run: |
          nix build --file . scratchImage.push --out-link nix-scratches
          ./nix-scratches/bin/push

  test-kind-cache:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@main

      - name: Setup Nix environment
        uses: ./.github/actions/setup-nix
        with:
          nixbuild_key: ${{ secrets.NIXBUILD_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          cache_key: test-kind-cache

      - name: Create Kind cluster
        uses: helm/kind-action@main

      - name: Clean runner
        run: |
          # Remove cache because permissions can get fucked up preventing kluctl from creating it's cache directory
          sudo rm --recursive --force /home/runner/.cache

      - name: Deploy nix-csi
        run: |
          nix build --file . kubenixCI1.deploymentScript
          ./result/bin/kubenixDeploy --yes

      - name: Wait for nix-csi node daemonset
        run: |
          kubectl rollout status daemonset/nix-node -n nix-csi --timeout=60s

      - name: Wait for nix-csi cache pod
        run: |
          kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=cache -n nix-csi --timeout=60s

      - name: Wait for test workload
        run: |
          kubectl wait --for=condition=complete job/flake-hello job/expr-hello job/path-hello -n nix-csi --timeout=120s

      - name: Delete jobs and verify CSI cleanup
        run: |
          kubectl delete job flake-hello expr-hello path-hello -n nix-csi
          kubectl wait --for=delete pod -l "job-name in (flake-hello,expr-hello,path-hello)" -n nix-csi --timeout=60s

      - name: Print node logs
        run: |
          echo "=== Node pod logs ==="
          kubectl logs -l app.kubernetes.io/name=csi -n nix-csi --tail -1

      - name: Debug on failure
        if: failure()
        run: |
          echo "=== Cluster state ==="
          kubectl get all -A

          echo "=== Cache pod logs ==="
          kubectl logs -l app.kubernetes.io/name=cache -n nix-csi --tail -1 || true

          echo "=== Node pod logs ==="
          kubectl logs -l app.kubernetes.io/name=csi -n nix-csi --tail -1 || true

          echo "=== Init pod logs ==="
          kubectl logs -l app.kubernetes.io/name=init -n nix-csi --tail -1 || true

          echo "=== Events ==="
          kubectl get events -n nix-csi --sort-by='.lastTimestamp'

  test-kind-nocache:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@main

      - name: Setup Nix environment
        uses: ./.github/actions/setup-nix
        with:
          nixbuild_key: ${{ secrets.NIXBUILD_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          cache_key: test-kind-nocache

      - name: Create Kind cluster
        uses: helm/kind-action@main

      - name: Clean runner
        run: |
          sudo rm --recursive --force /home/runner/.cache

      - name: Deploy nix-csi
        run: |
          nix build --file . kubenixCI2.deploymentScript
          ./result/bin/kubenixDeploy --yes

      - name: Wait for nix-csi node daemonset
        run: |
          kubectl rollout status daemonset/nix-node -n nix-csi --timeout=60s

      - name: Wait for test workload
        run: |
          kubectl wait --for=condition=complete job/flake-hello job/expr-hello job/path-hello -n nix-csi --timeout=120s

      - name: Delete jobs and verify CSI cleanup
        run: |
          kubectl delete job flake-hello expr-hello path-hello -n nix-csi
          kubectl wait --for=delete pod -l "job-name in (flake-hello,expr-hello,path-hello)" -n nix-csi --timeout=60s

      - name: Print node logs
        run: |
          echo "=== Node pod logs ==="
          kubectl logs -l app.kubernetes.io/name=csi -n nix-csi --tail -1

      - name: Debug on failure
        if: failure()
        run: |
          echo "=== Cluster state ==="
          kubectl get all -A

          echo "=== Cache pod logs ==="
          kubectl logs -l app.kubernetes.io/name=cache -n nix-csi --tail -1 || true

          echo "=== Node pod logs ==="
          kubectl logs -l app.kubernetes.io/name=csi -n nix-csi --tail -1 || true

          echo "=== Init pod logs ==="
          kubectl logs -l app.kubernetes.io/name=init -n nix-csi --tail -1 || true

          echo "=== Events ==="
          kubectl get events -n nix-csi --sort-by='.lastTimestamp'