set -eu
# ROOT's ~/.ssh, and this is the one thing that differs from the
# GitLab job. There the whole job runs as root in a nixos/nix image;
# here install-nix-action leaves a multi-user install, so the process
# that opens the SSH connection to the builder is nix-daemon running
# as root. A key under the runner user's home is a key it never
# reads, and the failure is a build that silently stays local —
# which on this graph means a runner trying to compile libcosmic.
sudo mkdir -p /root/.ssh
# base64 because a CI variable can only carry a single line.
printf '%s' "$NIXBUILD_SSH_KEY" | base64 -d | sudo tee /root/.ssh/nixbuild >/dev/null
sudo chmod 600 /root/.ssh/nixbuild
printf 'Host eu.nixbuild.net\n PubkeyAcceptedKeyTypes ssh-ed25519\n IdentityFile /root/.ssh/nixbuild\n IdentitiesOnly yes\n' | sudo tee /root/.ssh/config >/dev/null
printf 'eu.nixbuild.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIQCZc54poJ8vqawd8TraNryQeJnvH1eLpIDgbiqymM\n' | sudo tee /root/.ssh/known_hosts >/dev/null
# nixbuild's paths are signed, but the key is per-account and only
# readable from its web UI, so rather than carry a second secret we
# lean on the transport — the store is reached over SSH with our own
# key. cache.nixos.org is verified by its own key either way;
# require-sigs only relaxes nixbuild.
sudo tee -a /etc/nix/nix.conf >/dev/null <<EOF
builders = ssh-ng://eu.nixbuild.net x86_64-linux - 16 1 big-parallel,benchmark
builders-use-substitutes = true
substituters = https://cache.nixos.org ssh-ng://eu.nixbuild.net?priority=50
require-sigs = false
max-jobs = $(nproc)
EOF
# The daemon reads nix.conf at start, so settings appended after
# install-nix-action has already started it do nothing until it is
# restarted. Without this the job runs with none of the above and
# the first symptom is an hour of local compilation.
sudo systemctl restart nix-daemon
nix config show builders
nix config show max-jobs

nix flake check -L

set -eu
nix build -L --no-link --print-out-paths .#libs .#android > /tmp/outs
mkdir -p artifacts && xargs -a /tmp/outs -I{} cp -rL {}/. artifacts/
# Staged beside artifacts/ and not into it: libsPortable holds the
# same four sonames with a different RUNPATH, so merging the two
# trees would leave whichever was copied last under both names.
nix build -L --no-link --print-out-paths .#libsPortable > /tmp/portable
mkdir -p portable && xargs -a /tmp/portable -I{} cp -rL {}/. portable/

set -eu
tar czf x86_64-linux.tar.gz -C artifacts include \
  lib/libvidya.so lib/libjolttui.so lib/libjoltmoq.so lib/libjoltcosmic.so
# `-C portable lib include` and not a file list: the point of this one
# is the libraries that came along, and naming the four we know about
# would drop them.
tar czf x86_64-linux-portable.tar.gz -C portable lib include
tar czf android-arm64-v8a.tar.gz -C artifacts include lib/arm64-v8a