name: Check NixOS configurations

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  eval-hosts:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v19

      # Scoped to files changed since the PR base / previous push -- see
      # scripts/codex-maintenance.sh. CI never passes --full-check: that
      # full sweep is for local/manual use, since it's slow enough to time
      # out this runner.
      - name: Run maintenance checks (secrets, fmt, lint, eval -- changed files only)
        env:
          MAINT_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: bash scripts/codex-maintenance.sh