From 6e446893f3e5c6ffe602ebbb3b34ede70f8a385c Mon Sep 17 00:00:00 2001 From: NeilClack Date: Tue, 1 Sep 2026 09:25:03 -0500 Subject: [PATCH] Point main at the production RadiantWave channel and guard it in CI The dev->main merge left the channel block in flake.nix pointing at radiantwave-dev, so prod ISOs built from main shipped the dev app (which versions itself by short git hash) and the updater polled the dev Attic manifest. Restore the channel block to main values, re-pin flake.lock to the latest radiantwave main revision, and expose channelName so the prod build workflows can fail fast if main ever resolves to the dev channel. --- .gitea/workflows/build-prod-android.yml | 11 +++++++++++ .gitea/workflows/build-prod-commercial.yml | 11 +++++++++++ .gitea/workflows/build-prod-kiosk.yml | 11 +++++++++++ .gitea/workflows/build-prod-rpi.yml | 11 +++++++++++ flake.lock | 8 ++++---- flake.nix | 16 +++++++++++++--- 6 files changed, 61 insertions(+), 7 deletions(-) diff --git a/.gitea/workflows/build-prod-android.yml b/.gitea/workflows/build-prod-android.yml index 3770704..b17894a 100644 --- a/.gitea/workflows/build-prod-android.yml +++ b/.gitea/workflows/build-prod-android.yml @@ -17,6 +17,17 @@ jobs: - name: Checkout run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . + - name: Guard main branch is on the production channel + run: | + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + NAME=$(nix eval --impure --raw .#channelName) + if [ "$NAME" != "radiantwave" ]; then + echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." + echo " A dev->main merge brought a dev-pointing channel block into flake.nix." + echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs." + exit 1 + fi + - name: Prepare output directory run: mkdir -p /home/user/radiantwave diff --git a/.gitea/workflows/build-prod-commercial.yml b/.gitea/workflows/build-prod-commercial.yml index 59134d1..75beb40 100644 --- a/.gitea/workflows/build-prod-commercial.yml +++ b/.gitea/workflows/build-prod-commercial.yml @@ -17,6 +17,17 @@ jobs: - name: Checkout run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . + - name: Guard main branch is on the production channel + run: | + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + NAME=$(nix eval --impure --raw .#channelName) + if [ "$NAME" != "radiantwave" ]; then + echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." + echo " A dev->main merge brought a dev-pointing channel block into flake.nix." + echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs." + exit 1 + fi + - name: Prepare output directory run: mkdir -p /home/user/radiantwave diff --git a/.gitea/workflows/build-prod-kiosk.yml b/.gitea/workflows/build-prod-kiosk.yml index e5e89ef..94c72a6 100644 --- a/.gitea/workflows/build-prod-kiosk.yml +++ b/.gitea/workflows/build-prod-kiosk.yml @@ -17,6 +17,17 @@ jobs: - name: Checkout run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . + - name: Guard main branch is on the production channel + run: | + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + NAME=$(nix eval --impure --raw .#channelName) + if [ "$NAME" != "radiantwave" ]; then + echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." + echo " A dev->main merge brought a dev-pointing channel block into flake.nix." + echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs." + exit 1 + fi + - name: Prepare output directory run: mkdir -p /home/user/radiantwave diff --git a/.gitea/workflows/build-prod-rpi.yml b/.gitea/workflows/build-prod-rpi.yml index 609ac5e..34ba8bb 100644 --- a/.gitea/workflows/build-prod-rpi.yml +++ b/.gitea/workflows/build-prod-rpi.yml @@ -14,6 +14,17 @@ jobs: - name: Checkout run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . + - name: Guard main branch is on the production channel + run: | + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + NAME=$(nix eval --impure --raw .#channelName) + if [ "$NAME" != "radiantwave" ]; then + echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." + echo " A dev->main merge brought a dev-pointing channel block into flake.nix." + echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod images." + exit 1 + fi + - name: Prepare output directory run: mkdir -p /home/user/radiantwave diff --git a/flake.lock b/flake.lock index 8cbaeca..e77929b 100644 --- a/flake.lock +++ b/flake.lock @@ -220,11 +220,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1787675420, - "narHash": "sha256-2Hq9IcgdDXQc2uQ4yC/5NZVjcZaFCcVS78vj+ee+y/Q=", + "lastModified": 1787953913, + "narHash": "sha256-6M0xyNIwhGiOiOyS+URYzhKdV69fRgifXYqoGmHrmaY=", "ref": "main", - "rev": "43cd93bbd7dde69c55c00a28c1691e1a192eda39", - "revCount": 47, + "rev": "fee31c87b8ece4bb025e7ec10aed03c9794e2143", + "revCount": 56, "type": "git", "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git" }, diff --git a/flake.nix b/flake.nix index cbddecc..b3082c4 100644 --- a/flake.nix +++ b/flake.nix @@ -68,11 +68,19 @@ # # To flip branches, change ONLY these three values (then push/merge). channel = { - appInput = radiantwave-dev; # dev - atticRepo = "radiantwave-dev"; # dev - gitRef = "?ref=dev"; # dev + appInput = radiantwave; # main + atticRepo = "radiantwave"; # main + gitRef = ""; # main }; + # Exposed so CI (see .gitea/workflows/build-prod-*.yml) and humans can + # verify which channel this checkout resolves to. On `main` this must be + # "radiantwave"; on `dev` it must be "radiantwave-dev". The prod + # workflows fail fast if this isn't the production channel, so a merge + # that brings a dev-pointing channel block into `main` breaks the build + # instead of silently shipping dev builds as prod ISOs. + channelName = if channel.appInput == radiantwave then "radiantwave" else "radiantwave-dev"; + # Live app-update side channel. The manifest is served by the # fileserver; closures are fetched (never built) from the channel's # Attic cache. `repo` selects the channel — "radiantwave" (main) or @@ -200,6 +208,8 @@ }; in { + inherit channelName; + packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel; packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel; packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;