name: "Check shell"

on:
  pull_request_target:
    paths:
      - 'shell.nix'
      - 'ci/**'

permissions: {}

jobs:
  x86_64-linux:
    name: shell-check-x86_64-linux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
      - name: Build shell
        run: nix-build shell.nix

  aarch64-darwin:
    name: shell-check-aarch64-darwin
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
      - name: Build shell
        run: nix-build shell.nix