From 46384e6cf750f03869288783e2b15c919c514c1f Mon Sep 17 00:00:00 2001
From: NeilClack <cnclack@pm.me>
Date: Sun, 23 Aug 2026 15:07:22 -0500
Subject: [PATCH] Fix attic upload

---
 .gitea/workflows/build-dev.yml | 96 +++++++++++++++++++++-------------
 1 file changed, 60 insertions(+), 36 deletions(-)

diff --git a/.gitea/workflows/build-dev.yml b/.gitea/workflows/build-dev.yml
index d81f216..e603c25 100644
--- a/.gitea/workflows/build-dev.yml
+++ b/.gitea/workflows/build-dev.yml
@@ -1,44 +1,68 @@
-name: Build Dev ISO
-
+name: build-dev
 on:
-  workflow_dispatch:
-
+  # Every push to dev: build, run the offline test suite, publish to the
+  # dev Attic cache.
+  push:
+    branches: [dev]
 jobs:
-  build-dev-iso:
+  nix-build:
     runs-on: build-server
-
     steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Checkout dev branch
-        run: git checkout dev
-
-      - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
-
-      # --- Kiosk ISO ---
-      - name: Build kiosk ISO
+      # actions/checkout@v4 is unreliable on host-mode runners (its files are
+      # copied into the workspace instead of the repo), so clone explicitly.
+      - name: Checkout
         run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.dev-iso.config.system.build.isoImage
-
-      - name: Rename kiosk ISO
+          rm -rf ./* ./.[!.]* 2>/dev/null || true
+          git config --global http.extraheader "Authorization: token ${{ github.token }}"
+          git clone --branch "${{ gitea.ref_name }}" \
+            "${{ gitea.server_url }}/${{ gitea.repository }}.git" .
+          test -f flake.nix
+          git log --oneline -1
+      - name: Inspect workspace
         run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-kiosk-dev-iso-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
-          echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Move old dev images to archive
+          pwd
+          ls -la
+          git rev-parse --show-toplevel 2>&1 || true
+          git remote -v 2>&1 || true
+          git describe --tags --always 2>&1 || true
+          test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
+      # Dev builds fingerprint as the short commit hash.
+      # Persisted via GITHUB_ENV so the impure nix eval below reads it via
+      # builtins.getEnv.
+      - name: Compute version
         run: |
-          ssh nclack@157.245.124.103 'find /mnt/infrastructure_data/files/images -maxdepth 1 -name "radiantwave-kiosk-dev*" -exec mv {} /mnt/infrastructure_data/files/images/archives/ ;'
-
-      - name: Copy kiosk ISO to fileserver
+          echo "APP_VERSION=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
+      # checks is keyed per-system (checks.<system>.default); nix build's
+      # #attr shorthand can't resolve it, so resolve the current system inline.
+      # --impure lets the flake read APP_VERSION via builtins.getEnv
+      # (pure evals always get the package defaults).
+      - name: Build package
         run: |
-          scp "/home/user/radiantwave/${KIOSK_ISO_FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup kiosk ISO
-        run: rm -f "/home/user/radiantwave/${KIOSK_ISO_FILENAME}"
+          nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-pkg
+      # The offline test suite runs in the check derivation's checkPhase.
+      # This is a separate build/output from the package itself.
+      - name: Build + offline test suite
+        run: |
+          nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-checks
+      - name: Live portal tests
+        env:
+          RWT_LIVE_ACCOUNT_EMAIL: ${{ secrets.RWT_LIVE_ACCOUNT_EMAIL }}
+          RWT_LIVE_LICENSE_EMAIL: ${{ secrets.RWT_LIVE_LICENSE_EMAIL }}
+          RWT_LIVE_LICENSE_KEY: ${{ secrets.RWT_LIVE_LICENSE_KEY }}
+        run: |
+          nix develop --command bash -c '
+            cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
+            cmake --build build --target test_api_client test_license_service
+            ./build/test_api_client
+            ./build/test_license_service
+          '
+      # Dev closure (the actual package, not the check output) lands in the
+      # dev cache.
+      - name: Push to Attic dev cache
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
+        run: |
+          attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
+          attic push radiantwave:radiantwave-dev ./result-pkg