From 1e113a2bf055c74407eb5552a9e7dbb93c6bf860 Mon Sep 17 00:00:00 2001
From: moons14 <moons@moons14.com>
Date: Sun, 21 Jun 2026 03:23:23 +0900
Subject: [PATCH] ci: add nixos eval workflow

---
 .github/workflows/nixos-build.yml | 79 +++++++++++++++++++++++++++++++
 .github/workflows/nixos-eval.yml  | 78 ++++++++++++++++++++++++++++++
 .gitignore                        |  2 +
 3 files changed, 159 insertions(+)
 create mode 100644 .github/workflows/nixos-build.yml
 create mode 100644 .github/workflows/nixos-eval.yml

diff --git a/.github/workflows/nixos-build.yml b/.github/workflows/nixos-build.yml
new file mode 100644
index 0000000..65a8dcb
--- /dev/null
+++ b/.github/workflows/nixos-build.yml
@@ -0,0 +1,79 @@
+name: NixOS build
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/nixos-build.yml"
+      - "flake.lock"
+      - "flake.nix"
+      - "flake/**"
+      - "hosts/**"
+      - "modules/**"
+      - "overlays/**"
+      - "profiles/**"
+      - "shells/**"
+      - ".sops.yaml"
+      - "secrets/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  discover-hosts:
+    name: Discover NixOS hosts
+    runs-on: ubuntu-latest
+    outputs:
+      hosts: ${{ steps.hosts.outputs.hosts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Evaluate NixOS hosts
+        id: hosts
+        run: |
+          set -euo pipefail
+          hosts_json=$(nix eval --json '.#nixosConfigurations' --apply 'configs: builtins.attrNames configs')
+          echo "hosts=${hosts_json}" >> "$GITHUB_OUTPUT"
+          echo "Discovered hosts: ${hosts_json}"
+
+  build-host:
+    name: Build ${{ matrix.host }}
+    needs: discover-hosts
+    if: ${{ needs.discover-hosts.outputs.hosts != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        host: ${{ fromJSON(needs.discover-hosts.outputs.hosts) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Build NixOS system
+        run: |
+          set -euo pipefail
+          nix build ".#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel" \
+            --print-build-logs
diff --git a/.github/workflows/nixos-eval.yml b/.github/workflows/nixos-eval.yml
new file mode 100644
index 0000000..9f85994
--- /dev/null
+++ b/.github/workflows/nixos-eval.yml
@@ -0,0 +1,78 @@
+name: NixOS eval
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/nixos-eval.yml"
+      - "flake.lock"
+      - "flake.nix"
+      - "flake/**"
+      - "hosts/**"
+      - "modules/**"
+      - "overlays/**"
+      - "profiles/**"
+      - "shells/**"
+      - ".sops.yaml"
+      - "secrets/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  discover-hosts:
+    name: Discover NixOS hosts
+    runs-on: ubuntu-latest
+    outputs:
+      hosts: ${{ steps.hosts.outputs.hosts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Evaluate NixOS hosts
+        id: hosts
+        run: |
+          set -euo pipefail
+          hosts_json=$(nix eval --json '.#nixosConfigurations' --apply 'configs: builtins.attrNames configs')
+          echo "hosts=${hosts_json}" >> "$GITHUB_OUTPUT"
+          echo "Discovered hosts: ${hosts_json}"
+
+  eval-host:
+    name: Eval ${{ matrix.host }}
+    needs: discover-hosts
+    if: ${{ needs.discover-hosts.outputs.hosts != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        host: ${{ fromJSON(needs.discover-hosts.outputs.hosts) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+
+      - name: Evaluate NixOS system derivation
+        run: |
+          set -euo pipefail
+          nix eval ".#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel.drvPath"
diff --git a/.gitignore b/.gitignore
index ea12eb1..15ac5de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,8 @@
 !LICENSE
 !AGENTS.md
 
+!.github/
+
 !.envrc
 
 !.sops.yaml