name: Check that files are sorted

on:
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions: {}

jobs:
  get-merge-commit:
    uses: ./.github/workflows/get-merge-commit.yml

  nixos:
    name: keep-sorted
    runs-on: ubuntu-24.04
    needs: get-merge-commit
    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

      - name: Get Nixpkgs revision for keep-sorted
        run: |
          # Pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt from staging.
          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"

      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
        with:
          extra_nix_config: sandbox = true
          nix_path: nixpkgs=${{ env.url }}

      - name: Install keep-sorted
        run: "nix-env -f '<nixpkgs>' -iAP keep-sorted jq"

      - name: Check that Nix files are sorted
        run: |
          git ls-files | xargs keep-sorted --mode lint | jq --raw-output '.[] | "Please make sure any new entries in \(.path) are sorted alphabetically."'
