name: "Build NixOS manual v2"

on:
  pull_request_target:
    branches:
      - master
    paths:
      - "nixos/**"
      # Also build when the nixpkgs doc changed, since we take things like
      # the release notes and some css and js files from there.
      # See nixos/doc/manual/default.nix
      - "doc/**"
      # Build when something in lib changes
      # Since the lib functions are used to 'massage' the options before producing the manual
      - "lib/**"

permissions: {}

jobs:
  nixos:
    name: nixos-manual-build
    strategy:
      fail-fast: false
      matrix:
        system:
          - x86_64-linux
          - aarch64-linux
    runs-on: >-
      ${{ (matrix.system == 'x86_64-linux' && 'ubuntu-24.04')
      || (matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm') }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
        with:
          extra_nix_config: sandbox = true

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
        if: github.repository_owner == 'NixOS'
        with:
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
          name: nixpkgs-ci
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build NixOS manual
        id: build-manual
        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.${{ matrix.system }}

      - name: Upload NixOS manual
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: nixos-manual-${{ matrix.system }}
          path: result/
          if-no-files-found: error