name: Cache GC

# Garbage collection for the hestia binary cache. Must run on the default
# branch: a PR job's cache scope is read-only towards the default branch and
# dies with the PR, but the default-branch scope grows forever without GC.

concurrency:
  group: hestia-gc
  cancel-in-progress: false

on:
  schedule:
    # Daily, off-peak (UTC).
    - cron: "23 3 * * *"
  workflow_dispatch:
    inputs:
      dry-run:
        description: Plan only; do not repack, touch, or delete anything.
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  gc:
    runs-on: ubuntu-latest
    permissions:
      # REST cache deletes need actions:write.
      actions: write
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: NixOS/nix-installer-action@62c1943b776c509394b550f3f983adc14e9212d6 # main
      - uses: Mic92/hestia@dfed9ced335d28978ba74e513939a10db1f71025 # v3.1.0
      - name: Run garbage collection
        run: '"${HESTIA_BIN}" gc ${{ inputs.dry-run && ''--dry-run'' || '''' }}'
        env:
          GITHUB_TOKEN: ${{ github.token }}