build.yaml

# © Crown Copyright GCHQ
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Build
on:
  pull_request:

jobs:
  build-nix-bootstrap:
    name: Build nix-bootstrap
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: cachix/install-nix-action@v18
        with:
          nix_path: "nixpkgs=channel:nixpkgs-unstable"
      - name: Check version number has been updated
        run: >
          (git fetch --all && git diff "$(git describe --tags --abbrev=0)" -- package.yaml | grep version) ||
          (echo "You must bump the nix-bootstrap version number in package.yaml!" && exit 1)
      - name: Run pre-commit hooks
        run: nix build '.#runChecks'
      - name: Build nix-bootstrap
        run: nix build
      - name: Check for vulnerabilities
        run: nix run .\#ciPackages.vulnix -- -C -w vulnerability-whitelist.toml result/