name: Nix

on: [push, pull_request, workflow_dispatch]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  update-inputs:
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    uses: ./.github/workflows/nix-update-inputs.yml
    secrets: inherit

  build:
    if: always() && !cancelled() && !contains(needs.*.result, 'failure')
    needs: update-inputs
    uses: ./.github/workflows/nix-build.yml
    secrets: inherit