ci-pull-request.yml

name: Check extension

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

jobs:
  build:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: nix develop --command bash {0}
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Install Nix
      uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

    - name: Enable Nix cache
      uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
      with:
        use-flakehub: false

    - name: Login to Azure DevOps
      uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
      with:
        client-id: ${{ secrets.AZURE_APPLICATION_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

    - name: Get Azure DevOps access token
      id: devops_token
      # Use the runner's az (the one azure/login authenticated), not the nixpkgs az.
      shell: bash
      run: |
        TOKEN="$(az account get-access-token --resource "${{ secrets.AZURE_MARKETPLACE_ACCESS_SCOPE }}" --query accessToken -o tsv)"
        echo "::add-mask::$TOKEN"
        echo "azure_devops_access_token=$TOKEN" >> "$GITHUB_OUTPUT"

    - name: Build release
      run: |
        just build