ci: restore dev ISO workflow, auto-build on dev push, use Attic

.gitea/workflows/build-dev.yml

@@ -1,68 +1,52 @@
-name: build-dev
+name: Build Dev ISO
+
 on:
-  # Every push to dev: build, run the offline test suite, publish to the
+  workflow_dispatch:
-  # dev Attic cache.
   push:
-    branches: [dev]
+    branches:
+      - dev
+
+env:
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev
+    extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
+
 jobs:
-  nix-build:
+  build-dev-iso:
     runs-on: build-server
+
     steps:
-      # actions/checkout@v4 is unreliable on host-mode runners (its files are
+      - name: Clone Repository
-      # copied into the workspace instead of the repo), so clone explicitly.
+        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-      - name: Checkout
+
+      - name: Checkout dev branch
+        run: git checkout dev
+
+      - name: Prepare output directory
+        run: mkdir -p /home/user/radiantwave
+
+      # --- Kiosk ISO ---
+      - name: Build kiosk ISO
         run: |
-          rm -rf ./* ./.[!.]* 2>/dev/null || true
+          export NIXPKGS_ALLOW_UNFREE=1
-          git config --global http.extraheader "Authorization: token ${{ github.token }}"
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          git clone --branch "${{ gitea.ref_name }}" \
+          nix build -L --impure .#nixosConfigurations.dev-iso.config.system.build.isoImage
-            "${{ gitea.server_url }}/${{ gitea.repository }}.git" .
+
-          test -f flake.nix
+      - name: Rename kiosk ISO
-          git log --oneline -1
-      - name: Inspect workspace
         run: |
-          pwd
+          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          ls -la
+          FILENAME="radiantwave-kiosk-dev-iso-${ISO_DATE}.iso"
-          git rev-parse --show-toplevel 2>&1 || true
+          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
-          git remote -v 2>&1 || true
+          echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-          git describe --tags --always 2>&1 || true
+
-          test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
+      - name: Move old dev images to archive
-      # Dev builds fingerprint as the short commit hash.
-      # Persisted via GITHUB_ENV so the impure nix eval below reads it via
-      # builtins.getEnv.
-      - name: Compute version
         run: |
-          echo "APP_VERSION=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
+          ssh nclack@157.245.124.103 'find /mnt/infrastructure_data/files/images -maxdepth 1 -name "radiantwave-kiosk-dev*" -exec mv {} /mnt/infrastructure_data/files/images/archives/ ;'
-      # checks is keyed per-system (checks.<system>.default); nix build's
+
-      # #attr shorthand can't resolve it, so resolve the current system inline.
+      - name: Copy kiosk ISO to fileserver
-      # --impure lets the flake read APP_VERSION via builtins.getEnv
-      # (pure evals always get the package defaults).
-      - name: Build package
         run: |
-          nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+          scp "/home/user/radiantwave/${KIOSK_ISO_FILENAME}" \
-            --impure --out-link result-pkg
+            radiantwave-infra:/mnt/infrastructure_data/files/images/
-      # The offline test suite runs in the check derivation's checkPhase.
+
-      # This is a separate build/output from the package itself.
+      - name: Cleanup kiosk ISO
-      - name: Build + offline test suite
+        run: rm -f "/home/user/radiantwave/${KIOSK_ISO_FILENAME}"
-        run: |
-          nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
-            --impure --out-link result-checks
-      - name: Live portal tests
-        env:
-          RWT_LIVE_ACCOUNT_EMAIL: ${{ secrets.RWT_LIVE_ACCOUNT_EMAIL }}
-          RWT_LIVE_LICENSE_EMAIL: ${{ secrets.RWT_LIVE_LICENSE_EMAIL }}
-          RWT_LIVE_LICENSE_KEY: ${{ secrets.RWT_LIVE_LICENSE_KEY }}
-        run: |
-          nix develop --command bash -c '
-            cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
-            cmake --build build --target test_api_client test_license_service
-            ./build/test_api_client
-            ./build/test_license_service
-          '
-      # Dev closure (the actual package, not the check output) lands in the
-      # dev cache.
-      - name: Push to Attic dev cache
-        env:
-          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
-        run: |
-          attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave-dev ./result-pkg