guix-build.yml

name: Guix Build

permissions:
  packages: write
  id-token: write
  attestations: write

on:
  pull_request_target:
  push:

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        build_target: [x86_64-linux-gnu, arm-linux-gnueabihf, aarch64-linux-gnu, riscv64-linux-gnu, x86_64-w64-mingw32, x86_64-apple-darwin, arm64-apple-darwin]

    timeout-minutes: 480
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          path: dash
          fetch-depth: 0

      - name: Install Guix
        #        uses: PastaPastaPasta/guix-install-action@v1
        run: |
          sudo apt-get install -y guix


      - name: Cache Guix and depends
        id: guix-cache-restore
        uses: actions/cache@v3
        with:
          path: |
            /gnu/store
            /var/guix
            ~/.cache/guix
            ${{ github.workspace }}/dash/depends/built
            ${{ github.workspace }}/dash/depends/sources
            ${{ github.workspace }}/dash/depends/work
          key: ${{ runner.os }}-guix-${{ matrix.build_target }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-guix-${{ matrix.build_target }}
            ${{ runner.os }}-guix-

      - name: Guix Pull
        #        uses: PastaPastaPasta/guix-install-action@v1
        run: |
          guix pull

      - name: Set up macOS SDK
        if: contains(matrix.build_target, 'apple-darwin')
        run: |
          set -eo pipefail
          WORKSPACE_PATH="${{ github.workspace }}/dash"
          XCODE_VERSION="12.2"
          XCODE_RELEASE="12B45b"
          XCODE_ARCHIVE="Xcode-${XCODE_VERSION}-${XCODE_RELEASE}-extracted-SDK-with-libcxx-headers"

          if [ ! -d "${WORKSPACE_PATH}/depends/SDKs/${XCODE_ARCHIVE}" ]; then
            mkdir -p "${WORKSPACE_PATH}/depends/SDKs"
            curl -L https://bitcoincore.org/depends-sources/sdks/${XCODE_ARCHIVE}.tar.gz | tar -xz -C "${WORKSPACE_PATH}/depends/SDKs"
          fi
        shell: bash

      - name: Run Guix build
        timeout-minutes: 480
        working-directory: ./dash
        run: |
          HOSTS=${{ matrix.build_target }} ./contrib/guix/guix-build

      - name: Ensure build passes
        run: |
          if [[ $? != 0 ]]; then
            echo "Guix build failed!"
            exit 1
          fi

      - name: Compute SHA256 checksums
        continue-on-error: true
        working-directory: ./dash
        run: |
          HOSTS=${{ matrix.build_target }} ./contrib/guix/guix-verify

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: guix-artifacts-${{ matrix.build_target }}
          path: |
            ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/*