rippled/.github/actions/setup-nix-env/action.yml

name: Setup Nix environment
description: "Build the flake's CI environment and put its tools on PATH."

# The environment from nix/ci-env.nix, the same one the Linux CI images bake in
# (see nix/docker). Exported onto PATH rather than entered with `nix develop`:
# the composite actions below run plain `bash` and would escape a dev shell.

runs:
  using: composite

  steps:
    - name: Build the CI environment
      id: build
      shell: bash
      env:
        # --out-link doubles as a GC root for the length of the job.
        OUT_LINK: ${{ runner.temp }}/xrpld-ci-env
      run: |
        # --extra-experimental-features: flakes may not be on in the runner's nix.conf.
        nix --extra-experimental-features "nix-command flakes" \
            build .#default --out-link "${OUT_LINK}" --print-build-logs
        echo "path=$(readlink -f "${OUT_LINK}")" >>"${GITHUB_OUTPUT}"

    - name: Export the environment
      shell: bash
      env:
        ENV_PATH: ${{ steps.build.outputs.path }}
      run: |
        echo "${ENV_PATH}/bin" >>"${GITHUB_PATH}"

        # Already KEY=VALUE per line. See `darwinEnv` in nix/ci-env.nix.
        ENV_FILE="${ENV_PATH}/share/xrpld-ci-env/env"
        if [ -f "${ENV_FILE}" ]; then
            cat "${ENV_FILE}" >>"${GITHUB_ENV}"
        fi

        # XrplSanity.cmake otherwise rejects a Nix compiler as one that leaked.
        echo "XRPL_DEVSHELL=ci-env" >>"${GITHUB_ENV}"

        # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
        # own trust store, and pinning would break TLS to hosts relying on it.

        # Workspace-local, so `cleanup-workspace` clears it, but not the
        # `.conan2` prepare-runner hands the system toolchain: that Conan is a
        # different version, and the two would migrate each other's cache.
        echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"

    # Config, profiles and remote, exactly as the dev shell sets them up on
    # entry; the `setup-conan` action is skipped for this toolchain.
    - name: Setup Conan
      shell: bash
      run: ./conan/init.sh

    # `Check tools` runs later but swallows failures; a bad export would just
    # build with the system toolchain.
    - name: Verify the toolchain resolves into the Nix store
      shell: bash
      run: |
        for tool in clang clang++ cmake ninja conan; do
            path="$(command -v "${tool}" || true)"
            echo "${tool} -> ${path:-<not found>}"
            case "${path}" in
                /nix/store/*) ;;
                *)
                    echo "::error::${tool} does not resolve into the Nix store"
                    exit 1
                    ;;
            esac
        done