From d17def994fed71fe0eaa663549faa92f01ad4539 Mon Sep 17 00:00:00 2001 From: NeilClack Date: Sun, 4 Oct 2026 18:04:48 -0500 Subject: [PATCH] ci: use the same single branch-aware build workflow as dev Replace the four per-variant prod workflows (and the leftover dev workflow) with the shared .gitea/workflows/build.yml. Main builds on new tags or manual dispatch; dev pushes build the dev channel. Identical file on both branches. --- .gitea/workflows/build-dev.yml | 91 ------------- .gitea/workflows/build-prod-android.yml | 94 ------------- .gitea/workflows/build-prod-commercial.yml | 94 ------------- .gitea/workflows/build-prod-kiosk.yml | 94 ------------- .gitea/workflows/build-prod-rpi.yml | 91 ------------- .gitea/workflows/build.yml | 150 +++++++++++++++++++++ 6 files changed, 150 insertions(+), 464 deletions(-) delete mode 100644 .gitea/workflows/build-dev.yml delete mode 100644 .gitea/workflows/build-prod-android.yml delete mode 100644 .gitea/workflows/build-prod-commercial.yml delete mode 100644 .gitea/workflows/build-prod-kiosk.yml delete mode 100644 .gitea/workflows/build-prod-rpi.yml create mode 100644 .gitea/workflows/build.yml diff --git a/.gitea/workflows/build-dev.yml b/.gitea/workflows/build-dev.yml deleted file mode 100644 index 80337a3..0000000 --- a/.gitea/workflows/build-dev.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Build Dev ISOs -on: - workflow_dispatch: - push: - branches: - - dev -env: - NIX_CONFIG: | - extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev - extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= -jobs: - build-dev-kiosk: - runs-on: orion-lxc - steps: - - name: Clone Repository - run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . - - name: Checkout dev branch - run: git checkout dev - - name: Prepare output directory - run: mkdir -p /var/lib/gitea-runner/radiantwave - - name: Build dev kiosk ISO - run: | - export NIXPKGS_ALLOW_UNFREE=1 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage - - name: Rename dev kiosk ISO - run: | - ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) - FILENAME="radiantwave-kiosk-dev-${ISO_DATE}.iso" - cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}" - echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV" - - name: Copy dev kiosk ISO to fileserver - run: | - scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \ - 157.245.124.103:/mnt/infrastructure_data/files/images/ - - name: Cleanup - run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}" - - build-dev-android: - runs-on: orion-lxc - steps: - - name: Clone Repository - run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . - - name: Checkout dev branch - run: git checkout dev - - name: Prepare output directory - run: mkdir -p /var/lib/gitea-runner/radiantwave - - name: Build dev android ISO - run: | - export NIXPKGS_ALLOW_UNFREE=1 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage - - name: Rename dev android ISO - run: | - ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) - FILENAME="radiantwave-android-dev-${ISO_DATE}.iso" - cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}" - echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV" - - name: Copy dev android ISO to fileserver - run: | - scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \ - 157.245.124.103:/mnt/infrastructure_data/files/images/ - - name: Cleanup - run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}" - - build-dev-commercial: - runs-on: orion-lxc - steps: - - name: Clone Repository - run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . - - name: Checkout dev branch - run: git checkout dev - - name: Prepare output directory - run: mkdir -p /var/lib/gitea-runner/radiantwave - - name: Build dev commercial ISO - run: | - export NIXPKGS_ALLOW_UNFREE=1 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage - - name: Rename dev commercial ISO - run: | - ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) - FILENAME="radiantwave-commercial-dev-${ISO_DATE}.iso" - cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}" - echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV" - - name: Copy dev commercial ISO to fileserver - run: | - scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \ - 157.245.124.103:/mnt/infrastructure_data/files/images/ - - name: Cleanup - run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}" diff --git a/.gitea/workflows/build-prod-android.yml b/.gitea/workflows/build-prod-android.yml deleted file mode 100644 index 61f9905..0000000 --- a/.gitea/workflows/build-prod-android.yml +++ /dev/null @@ -1,94 +0,0 @@ -on: - workflow_dispatch: - push: - branches: - - main - -env: - NIX_CONFIG: | - extra-substituters = https://attic.radiantwavetech.com/radiantwave - extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= - -jobs: - build-android: - runs-on: orion-lxc - - steps: - - name: Checkout - run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . - - - name: Guard main branch is on the production channel - run: | - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - NAME=$(nix eval --impure --raw .#channelName) - if [ "$NAME" != "radiantwave" ]; then - echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." - echo " A dev->main merge brought a dev-pointing channel block into flake.nix." - echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs." - exit 1 - fi - - # Fail fast unless the closure baked into the ISO is exactly what - # RadiantWave CI published to Attic. Otherwise the kiosk compiles - # RadiantWave from source (slow) and the live updater immediately swaps - # to the announced closure on first boot. See `channel` in flake.nix. - - name: Verify baked baseline matches the published channel - run: | - set -euo pipefail - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - - VERSION=$(nix eval --impure --raw .#channelVersion) - ATTIC=$(nix eval --impure --raw .#channelAtticUrl) - MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json" - BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux) - - MANIFEST=$(curl -fsSL "$MANIFEST_URL") - PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version') - PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath') - - echo "channel version : $VERSION" - echo "manifest version: $PUB_VERSION" - echo "baseline path : $BASELINE" - echo "manifest path : $PUB_PATH" - - if [ "$VERSION" != "$PUB_VERSION" ]; then - echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'." - echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release." - exit 1 - fi - - if [ "$BASELINE" != "$PUB_PATH" ]; then - echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'." - echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from." - exit 1 - fi - - HASH=$(basename "$BASELINE" | cut -d- -f1) - if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then - echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source." - exit 1 - fi - - - name: Prepare output directory - run: mkdir -p /var/lib/gitea-runner/radiantwave - - - name: Build android kiosk ISO - run: | - export NIXPKGS_ALLOW_UNFREE=1 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage - - - name: Rename android kiosk ISO - run: | - ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) - FILENAME="radiantwave-android-iso-${ISO_DATE}.iso" - cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}" - echo "ANDROID_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV" - - - name: Copy android kiosk ISO to fileserver - run: | - scp "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}" \ - 157.245.124.103:/mnt/infrastructure_data/files/images/ - - - name: Cleanup android kiosk ISO - run: rm -f "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}" diff --git a/.gitea/workflows/build-prod-commercial.yml b/.gitea/workflows/build-prod-commercial.yml deleted file mode 100644 index dd0335a..0000000 --- a/.gitea/workflows/build-prod-commercial.yml +++ /dev/null @@ -1,94 +0,0 @@ -on: - workflow_dispatch: - push: - branches: - - main - -env: - NIX_CONFIG: | - extra-substituters = https://attic.radiantwavetech.com/radiantwave - extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= - -jobs: - build-commercial: - runs-on: orion-lxc - - steps: - - name: Checkout - run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . - - - name: Guard main branch is on the production channel - run: | - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - NAME=$(nix eval --impure --raw .#channelName) - if [ "$NAME" != "radiantwave" ]; then - echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." - echo " A dev->main merge brought a dev-pointing channel block into flake.nix." - echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs." - exit 1 - fi - - # Fail fast unless the closure baked into the ISO is exactly what - # RadiantWave CI published to Attic. Otherwise the kiosk compiles - # RadiantWave from source (slow) and the live updater immediately swaps - # to the announced closure on first boot. See `channel` in flake.nix. - - name: Verify baked baseline matches the published channel - run: | - set -euo pipefail - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - - VERSION=$(nix eval --impure --raw .#channelVersion) - ATTIC=$(nix eval --impure --raw .#channelAtticUrl) - MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json" - BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux) - - MANIFEST=$(curl -fsSL "$MANIFEST_URL") - PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version') - PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath') - - echo "channel version : $VERSION" - echo "manifest version: $PUB_VERSION" - echo "baseline path : $BASELINE" - echo "manifest path : $PUB_PATH" - - if [ "$VERSION" != "$PUB_VERSION" ]; then - echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'." - echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release." - exit 1 - fi - - if [ "$BASELINE" != "$PUB_PATH" ]; then - echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'." - echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from." - exit 1 - fi - - HASH=$(basename "$BASELINE" | cut -d- -f1) - if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then - echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source." - exit 1 - fi - - - name: Prepare output directory - run: mkdir -p /var/lib/gitea-runner/radiantwave - - - name: Build commercial kiosk ISO - run: | - export NIXPKGS_ALLOW_UNFREE=1 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage - - - name: Rename commercial kiosk ISO - run: | - ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) - FILENAME="radiantwave-commercial-iso-${ISO_DATE}.iso" - cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}" - echo "COMMERCIAL_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV" - - - name: Copy commercial kiosk ISO to fileserver - run: | - scp "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}" \ - 157.245.124.103:/mnt/infrastructure_data/files/images/ - - - name: Cleanup commercial kiosk ISO - run: rm -f "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}" diff --git a/.gitea/workflows/build-prod-kiosk.yml b/.gitea/workflows/build-prod-kiosk.yml deleted file mode 100644 index c473da9..0000000 --- a/.gitea/workflows/build-prod-kiosk.yml +++ /dev/null @@ -1,94 +0,0 @@ -on: - workflow_dispatch: - push: - branches: - - main - -env: - NIX_CONFIG: | - extra-substituters = https://attic.radiantwavetech.com/radiantwave - extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= - -jobs: - build-kiosk: - runs-on: orion-lxc - - steps: - - name: Checkout - run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . - - - name: Guard main branch is on the production channel - run: | - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - NAME=$(nix eval --impure --raw .#channelName) - if [ "$NAME" != "radiantwave" ]; then - echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." - echo " A dev->main merge brought a dev-pointing channel block into flake.nix." - echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs." - exit 1 - fi - - # Fail fast unless the closure baked into the ISO is exactly what - # RadiantWave CI published to Attic. Otherwise the kiosk compiles - # RadiantWave from source (slow) and the live updater immediately swaps - # to the announced closure on first boot. See `channel` in flake.nix. - - name: Verify baked baseline matches the published channel - run: | - set -euo pipefail - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - - VERSION=$(nix eval --impure --raw .#channelVersion) - ATTIC=$(nix eval --impure --raw .#channelAtticUrl) - MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json" - BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux) - - MANIFEST=$(curl -fsSL "$MANIFEST_URL") - PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version') - PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath') - - echo "channel version : $VERSION" - echo "manifest version: $PUB_VERSION" - echo "baseline path : $BASELINE" - echo "manifest path : $PUB_PATH" - - if [ "$VERSION" != "$PUB_VERSION" ]; then - echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'." - echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release." - exit 1 - fi - - if [ "$BASELINE" != "$PUB_PATH" ]; then - echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'." - echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from." - exit 1 - fi - - HASH=$(basename "$BASELINE" | cut -d- -f1) - if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then - echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source." - exit 1 - fi - - - name: Prepare output directory - run: mkdir -p /var/lib/gitea-runner/radiantwave - - - name: Build kiosk ISO - run: | - export NIXPKGS_ALLOW_UNFREE=1 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage - - - name: Rename kiosk ISO - run: | - ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) - FILENAME="radiantwave-home-${ISO_DATE}.iso" - cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}" - echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV" - - - name: Copy kiosk ISO to fileserver - run: | - scp "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}" \ - 157.245.124.103:/mnt/infrastructure_data/files/images/ - - - name: Cleanup kiosk ISO - run: rm -f "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}" diff --git a/.gitea/workflows/build-prod-rpi.yml b/.gitea/workflows/build-prod-rpi.yml deleted file mode 100644 index 7c3fcd9..0000000 --- a/.gitea/workflows/build-prod-rpi.yml +++ /dev/null @@ -1,91 +0,0 @@ -on: - workflow_dispatch: - -env: - NIX_CONFIG: | - extra-substituters = https://attic.radiantwavetech.com/radiantwave https://nixos-raspberrypi.cachix.org - extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI= - -jobs: - build-rpi: - runs-on: orion-lxc - - steps: - - name: Checkout - run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . - - - name: Guard main branch is on the production channel - run: | - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - NAME=$(nix eval --impure --raw .#channelName) - if [ "$NAME" != "radiantwave" ]; then - echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'." - echo " A dev->main merge brought a dev-pointing channel block into flake.nix." - echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod images." - exit 1 - fi - - # Fail fast unless the closure baked into the image is exactly what - # RadiantWave CI published to Attic (aarch64). Otherwise the Pi compiles - # RadiantWave from source (slow) unless RadiantWave CI has published both - # the aarch64 closure and aarch64-manifest.json. See `channel` in flake.nix. - - name: Verify baked baseline matches the published channel - run: | - set -euo pipefail - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - - VERSION=$(nix eval --impure --raw .#channelVersion) - ATTIC=$(nix eval --impure --raw .#channelAtticUrl) - MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/aarch64-manifest.json" - BASELINE=$(nix eval --impure --raw .#baselineOutPaths.aarch64-linux) - - MANIFEST=$(curl -fsSL "$MANIFEST_URL") - PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version') - PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath') - - echo "channel version : $VERSION" - echo "manifest version: $PUB_VERSION" - echo "baseline path : $BASELINE" - echo "manifest path : $PUB_PATH" - - if [ "$VERSION" != "$PUB_VERSION" ]; then - echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'." - echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release." - exit 1 - fi - - if [ "$BASELINE" != "$PUB_PATH" ]; then - echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'." - echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from." - exit 1 - fi - - HASH=$(basename "$BASELINE" | cut -d- -f1) - if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then - echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source." - exit 1 - fi - - - name: Prepare output directory - run: mkdir -p /var/lib/gitea-runner/radiantwave - - - name: Build Raspberry Pi image - run: | - export NIXPKGS_ALLOW_UNFREE=1 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix build -L --impure .#nixosConfigurations.radiantwavekiosk-rpi.config.system.build.sdImage - - - name: Rename Raspberry Pi image - run: | - ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) - FILENAME="radiantwave-rpi-${ISO_DATE}.img.zst" - cp -L result/sd-image/*.img.zst "/var/lib/gitea-runner/radiantwave/${FILENAME}" - echo "RPI_IMAGE_FILENAME=${FILENAME}" >> "$GITHUB_ENV" - - - name: Copy Raspberry Pi image to fileserver - run: | - scp "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}" \ - 157.245.124.103:/mnt/infrastructure_data/files/images/ - - - name: Cleanup Raspberry Pi image - run: rm -f "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}" diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml new file mode 100644 index 0000000..b4550b0 --- /dev/null +++ b/.gitea/workflows/build.yml @@ -0,0 +1,150 @@ +# One build workflow for every branch — do not add per-branch copies. +# +# The branch/ref selects the channel, nothing else does: the flake's `channel` +# block picks the app input, Attic repo, and upgrade ref, so the same config +# names build dev images on `dev` and prod images on `main`. This file itself +# is identical on both branches. +# +# Trigger model: +# * push to `dev` -> build every development image +# * new git tag -> build every production image (tags live on main) +# * manual dispatch -> build the channel of the selected branch +# +# Hardware variants come from an include-matrix: +# ISO variants -> .config.system.build.isoImage (storeContents pulls in the closure) +# Raspberry Pi -> .config.system.build.sdImage +# `orion-lxc` emulates aarch64-linux, so the Pi build runs alongside the rest. +name: Build Kiosk Images + +on: + workflow_dispatch: + push: + branches: + - dev + tags: + - "*" + +env: + # Both channel caches plus the Raspberry Pi cachix, so a build can substitute + # from whichever channel the checked-out ref selects. + NIX_CONFIG: | + extra-substituters = https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev https://nixos-raspberrypi.cachix.org + extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI= + +jobs: + build: + name: ${{ matrix.label }} + runs-on: orion-lxc + strategy: + fail-fast: false + matrix: + include: + - label: kiosk + system: kiosk-iso + target: isoImage + outdir: iso + ext: iso + arch: x86_64-linux + manifest: manifest.json + - label: commercial + system: commercial-iso + target: isoImage + outdir: iso + ext: iso + arch: x86_64-linux + manifest: manifest.json + - label: android + system: android-iso + target: isoImage + outdir: iso + ext: iso + arch: x86_64-linux + manifest: manifest.json + - label: rpi + system: radiantwavekiosk-rpi + target: sdImage + outdir: sd-image + ext: img.zst + arch: aarch64-linux + manifest: aarch64-manifest.json + + steps: + - name: Clone repository + run: | + rm -rf ./* ./.[!.]* 2>/dev/null || true + ref="${GITHUB_REF#refs/heads/}" + ref="${ref#refs/tags/}" + git clone --depth 1 --branch "$ref" \ + ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git . + git log --oneline -1 + + - name: Determine channel + run: | + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + CHANNEL=$(nix eval --impure --raw .#channelName) + if [ "$CHANNEL" = "radiantwave" ]; then LABEL=prod; else LABEL=dev; fi + echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV" + echo "CHANNEL_LABEL=$LABEL" >> "$GITHUB_ENV" + echo "Building the '$CHANNEL' channel ($LABEL)" + + # Production only: fail fast unless the baked closure is exactly what + # RadiantWave CI published to Attic. The dev channel churns on every + # dispatch, so this is skipped there. + - name: Verify baked baseline matches the published channel + run: | + set -euo pipefail + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + + if [ "$CHANNEL" != "radiantwave" ]; then + echo "channel '$CHANNEL' is not production; skipping baseline preflight" + exit 0 + fi + + VERSION=$(nix eval --impure --raw .#channelVersion) + ATTIC=$(nix eval --impure --raw .#channelAtticUrl) + MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/${{ matrix.manifest }}" + BASELINE=$(nix eval --impure --raw .#baselineOutPaths.${{ matrix.arch }}) + + MANIFEST=$(curl -fsSL "$MANIFEST_URL") + PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version') + PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath') + + echo "channel version : $VERSION" + echo "manifest version: $PUB_VERSION" + echo "baseline path : $BASELINE" + echo "manifest path : $PUB_PATH" + + if [ "$VERSION" != "$PUB_VERSION" ]; then + echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'." + exit 1 + fi + if [ "$BASELINE" != "$PUB_PATH" ]; then + echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'." + echo " Run 'nix flake update radiantwave' so the pinned input resolves to the released commit." + exit 1 + fi + HASH=$(basename "$BASELINE" | cut -d- -f1) + if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then + echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source." + exit 1 + fi + + - name: Prepare output directory + run: mkdir -p /var/lib/gitea-runner/radiantwave + + - name: Build ${{ matrix.label }} + run: | + export NIXPKGS_ALLOW_UNFREE=1 + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + nix build -L --impure \ + ".#nixosConfigurations.${{ matrix.system }}.config.system.build.${{ matrix.target }}" + + - name: Publish ${{ matrix.label }} + run: | + ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S) + FILENAME="radiantwave-${{ matrix.label }}-${CHANNEL_LABEL}-${ISO_DATE}.${{ matrix.ext }}" + cp -L result/${{ matrix.outdir }}/*.${{ matrix.ext }} \ + "/var/lib/gitea-runner/radiantwave/${FILENAME}" + scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \ + 157.245.124.103:/mnt/infrastructure_data/files/images/ + rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"