test-and-publish.yaml

name: CI with NIX

on: [push]

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      id-token: write # This is required for requesting the JWT used by GCP auth step
      contents: read  # This is required for actions/checkout

    steps:
    - uses: actions/checkout@v3

    - id: auth
      name: Authenticate to Google Cloud
      uses: google-github-actions/auth@v0
      with:
        workload_identity_provider: projects/1000420590118/locations/global/workloadIdentityPools/github-workflows/providers/github-workflows
        service_account: github-workflows@dvf-deversifi-dev.iam.gserviceaccount.com

    - uses: cachix/install-nix-action@v19
      with:
        nix_path: nixpkgs=channel:nixos-unstable
        extra_nix_config: |
          experimental-features = nix-command

    - name: Bootstrap nix config
      run: echo ${{ secrets.CI_GITHUB_TOKEN }} | ./nix/netrc-create.sh

    - name: Run pr-step
      run: nix run --impure -f nix/pkgs-private.nix ci.pr-step

    - name: Run deploy-step
      run: |
        set -euo pipefail

        run_nix () {
          nix run --impure -f nix/pkgs-private.nix "${@}"
        }

        if [[ ${{ github.ref }} == refs/heads/master || ${{ github.ref }} == refs/heads/dev ]]
        then
          is_dev_release=true
          if [[ ${{ github.ref }} == refs/heads/master ]]
          then
            is_dev_release=false
          fi

          # NOTE: if this fails with a 403 it's most likely due to not bumping
          #   version in package.json
          run_nix ci.deploy-step -- "$is_dev_release"
        else
          echo skipping
        fi