ci: use the same single branch-aware build workflow as dev
Replace the four per-variant prod workflows (and the leftover dev workflow) with the shared .gitea/workflows/build.yml. Main builds on new tags or manual dispatch; dev pushes build the dev channel. Identical file on both branches.
This commit is contained in:
NeilClack
@@ -1,91 +0,0 @@
|
|||||||
name: Build Dev ISOs
|
|
||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- dev
|
|
||||||
env:
|
|
||||||
NIX_CONFIG: |
|
|
||||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev
|
|
||||||
extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
|
|
||||||
jobs:
|
|
||||||
build-dev-kiosk:
|
|
||||||
runs-on: orion-lxc
|
|
||||||
steps:
|
|
||||||
- name: Clone Repository
|
|
||||||
run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
|
||||||
- name: Checkout dev branch
|
|
||||||
run: git checkout dev
|
|
||||||
- name: Prepare output directory
|
|
||||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
|
||||||
- name: Build dev kiosk ISO
|
|
||||||
run: |
|
|
||||||
export NIXPKGS_ALLOW_UNFREE=1
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
|
|
||||||
- name: Rename dev kiosk ISO
|
|
||||||
run: |
|
|
||||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
|
||||||
FILENAME="radiantwave-kiosk-dev-${ISO_DATE}.iso"
|
|
||||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
|
||||||
- name: Copy dev kiosk ISO to fileserver
|
|
||||||
run: |
|
|
||||||
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
|
||||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
|
||||||
- name: Cleanup
|
|
||||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
|
|
||||||
build-dev-android:
|
|
||||||
runs-on: orion-lxc
|
|
||||||
steps:
|
|
||||||
- name: Clone Repository
|
|
||||||
run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
|
||||||
- name: Checkout dev branch
|
|
||||||
run: git checkout dev
|
|
||||||
- name: Prepare output directory
|
|
||||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
|
||||||
- name: Build dev android ISO
|
|
||||||
run: |
|
|
||||||
export NIXPKGS_ALLOW_UNFREE=1
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
|
|
||||||
- name: Rename dev android ISO
|
|
||||||
run: |
|
|
||||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
|
||||||
FILENAME="radiantwave-android-dev-${ISO_DATE}.iso"
|
|
||||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
|
||||||
- name: Copy dev android ISO to fileserver
|
|
||||||
run: |
|
|
||||||
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
|
||||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
|
||||||
- name: Cleanup
|
|
||||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
|
|
||||||
build-dev-commercial:
|
|
||||||
runs-on: orion-lxc
|
|
||||||
steps:
|
|
||||||
- name: Clone Repository
|
|
||||||
run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
|
||||||
- name: Checkout dev branch
|
|
||||||
run: git checkout dev
|
|
||||||
- name: Prepare output directory
|
|
||||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
|
||||||
- name: Build dev commercial ISO
|
|
||||||
run: |
|
|
||||||
export NIXPKGS_ALLOW_UNFREE=1
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
|
|
||||||
- name: Rename dev commercial ISO
|
|
||||||
run: |
|
|
||||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
|
||||||
FILENAME="radiantwave-commercial-dev-${ISO_DATE}.iso"
|
|
||||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
|
||||||
- name: Copy dev commercial ISO to fileserver
|
|
||||||
run: |
|
|
||||||
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
|
||||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
|
||||||
- name: Cleanup
|
|
||||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
@@ -1,94 +0,0 @@
|
|||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
|
|
||||||
env:
|
|
||||||
NIX_CONFIG: |
|
|
||||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave
|
|
||||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
build-android:
|
|
||||||
runs-on: orion-lxc
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
|
||||||
|
|
||||||
- name: Guard main branch is on the production channel
|
|
||||||
run: |
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
NAME=$(nix eval --impure --raw .#channelName)
|
|
||||||
if [ "$NAME" != "radiantwave" ]; then
|
|
||||||
echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
|
|
||||||
echo " A dev->main merge brought a dev-pointing channel block into flake.nix."
|
|
||||||
echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Fail fast unless the closure baked into the ISO is exactly what
|
|
||||||
# RadiantWave CI published to Attic. Otherwise the kiosk compiles
|
|
||||||
# RadiantWave from source (slow) and the live updater immediately swaps
|
|
||||||
# to the announced closure on first boot. See `channel` in flake.nix.
|
|
||||||
- name: Verify baked baseline matches the published channel
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
|
|
||||||
VERSION=$(nix eval --impure --raw .#channelVersion)
|
|
||||||
ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
|
|
||||||
MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json"
|
|
||||||
BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux)
|
|
||||||
|
|
||||||
MANIFEST=$(curl -fsSL "$MANIFEST_URL")
|
|
||||||
PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
|
|
||||||
PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
|
|
||||||
|
|
||||||
echo "channel version : $VERSION"
|
|
||||||
echo "manifest version: $PUB_VERSION"
|
|
||||||
echo "baseline path : $BASELINE"
|
|
||||||
echo "manifest path : $PUB_PATH"
|
|
||||||
|
|
||||||
if [ "$VERSION" != "$PUB_VERSION" ]; then
|
|
||||||
echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
|
|
||||||
echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$BASELINE" != "$PUB_PATH" ]; then
|
|
||||||
echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
|
|
||||||
echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
HASH=$(basename "$BASELINE" | cut -d- -f1)
|
|
||||||
if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
|
|
||||||
echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Prepare output directory
|
|
||||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
|
||||||
|
|
||||||
- name: Build android kiosk ISO
|
|
||||||
run: |
|
|
||||||
export NIXPKGS_ALLOW_UNFREE=1
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
|
|
||||||
|
|
||||||
- name: Rename android kiosk ISO
|
|
||||||
run: |
|
|
||||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
|
||||||
FILENAME="radiantwave-android-iso-${ISO_DATE}.iso"
|
|
||||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
echo "ANDROID_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
|
||||||
|
|
||||||
- name: Copy android kiosk ISO to fileserver
|
|
||||||
run: |
|
|
||||||
scp "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}" \
|
|
||||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
|
||||||
|
|
||||||
- name: Cleanup android kiosk ISO
|
|
||||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}"
|
|
||||||
@@ -1,94 +0,0 @@
|
|||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
|
|
||||||
env:
|
|
||||||
NIX_CONFIG: |
|
|
||||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave
|
|
||||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
build-commercial:
|
|
||||||
runs-on: orion-lxc
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
|
||||||
|
|
||||||
- name: Guard main branch is on the production channel
|
|
||||||
run: |
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
NAME=$(nix eval --impure --raw .#channelName)
|
|
||||||
if [ "$NAME" != "radiantwave" ]; then
|
|
||||||
echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
|
|
||||||
echo " A dev->main merge brought a dev-pointing channel block into flake.nix."
|
|
||||||
echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Fail fast unless the closure baked into the ISO is exactly what
|
|
||||||
# RadiantWave CI published to Attic. Otherwise the kiosk compiles
|
|
||||||
# RadiantWave from source (slow) and the live updater immediately swaps
|
|
||||||
# to the announced closure on first boot. See `channel` in flake.nix.
|
|
||||||
- name: Verify baked baseline matches the published channel
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
|
|
||||||
VERSION=$(nix eval --impure --raw .#channelVersion)
|
|
||||||
ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
|
|
||||||
MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json"
|
|
||||||
BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux)
|
|
||||||
|
|
||||||
MANIFEST=$(curl -fsSL "$MANIFEST_URL")
|
|
||||||
PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
|
|
||||||
PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
|
|
||||||
|
|
||||||
echo "channel version : $VERSION"
|
|
||||||
echo "manifest version: $PUB_VERSION"
|
|
||||||
echo "baseline path : $BASELINE"
|
|
||||||
echo "manifest path : $PUB_PATH"
|
|
||||||
|
|
||||||
if [ "$VERSION" != "$PUB_VERSION" ]; then
|
|
||||||
echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
|
|
||||||
echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$BASELINE" != "$PUB_PATH" ]; then
|
|
||||||
echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
|
|
||||||
echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
HASH=$(basename "$BASELINE" | cut -d- -f1)
|
|
||||||
if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
|
|
||||||
echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Prepare output directory
|
|
||||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
|
||||||
|
|
||||||
- name: Build commercial kiosk ISO
|
|
||||||
run: |
|
|
||||||
export NIXPKGS_ALLOW_UNFREE=1
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
|
|
||||||
|
|
||||||
- name: Rename commercial kiosk ISO
|
|
||||||
run: |
|
|
||||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
|
||||||
FILENAME="radiantwave-commercial-iso-${ISO_DATE}.iso"
|
|
||||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
echo "COMMERCIAL_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
|
||||||
|
|
||||||
- name: Copy commercial kiosk ISO to fileserver
|
|
||||||
run: |
|
|
||||||
scp "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}" \
|
|
||||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
|
||||||
|
|
||||||
- name: Cleanup commercial kiosk ISO
|
|
||||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}"
|
|
||||||
@@ -1,94 +0,0 @@
|
|||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
|
|
||||||
env:
|
|
||||||
NIX_CONFIG: |
|
|
||||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave
|
|
||||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
build-kiosk:
|
|
||||||
runs-on: orion-lxc
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
|
||||||
|
|
||||||
- name: Guard main branch is on the production channel
|
|
||||||
run: |
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
NAME=$(nix eval --impure --raw .#channelName)
|
|
||||||
if [ "$NAME" != "radiantwave" ]; then
|
|
||||||
echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
|
|
||||||
echo " A dev->main merge brought a dev-pointing channel block into flake.nix."
|
|
||||||
echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Fail fast unless the closure baked into the ISO is exactly what
|
|
||||||
# RadiantWave CI published to Attic. Otherwise the kiosk compiles
|
|
||||||
# RadiantWave from source (slow) and the live updater immediately swaps
|
|
||||||
# to the announced closure on first boot. See `channel` in flake.nix.
|
|
||||||
- name: Verify baked baseline matches the published channel
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
|
|
||||||
VERSION=$(nix eval --impure --raw .#channelVersion)
|
|
||||||
ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
|
|
||||||
MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json"
|
|
||||||
BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux)
|
|
||||||
|
|
||||||
MANIFEST=$(curl -fsSL "$MANIFEST_URL")
|
|
||||||
PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
|
|
||||||
PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
|
|
||||||
|
|
||||||
echo "channel version : $VERSION"
|
|
||||||
echo "manifest version: $PUB_VERSION"
|
|
||||||
echo "baseline path : $BASELINE"
|
|
||||||
echo "manifest path : $PUB_PATH"
|
|
||||||
|
|
||||||
if [ "$VERSION" != "$PUB_VERSION" ]; then
|
|
||||||
echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
|
|
||||||
echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$BASELINE" != "$PUB_PATH" ]; then
|
|
||||||
echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
|
|
||||||
echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
HASH=$(basename "$BASELINE" | cut -d- -f1)
|
|
||||||
if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
|
|
||||||
echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Prepare output directory
|
|
||||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
|
||||||
|
|
||||||
- name: Build kiosk ISO
|
|
||||||
run: |
|
|
||||||
export NIXPKGS_ALLOW_UNFREE=1
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
|
|
||||||
|
|
||||||
- name: Rename kiosk ISO
|
|
||||||
run: |
|
|
||||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
|
||||||
FILENAME="radiantwave-home-${ISO_DATE}.iso"
|
|
||||||
cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
|
||||||
|
|
||||||
- name: Copy kiosk ISO to fileserver
|
|
||||||
run: |
|
|
||||||
scp "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}" \
|
|
||||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
|
||||||
|
|
||||||
- name: Cleanup kiosk ISO
|
|
||||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}"
|
|
||||||
@@ -1,91 +0,0 @@
|
|||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
env:
|
|
||||||
NIX_CONFIG: |
|
|
||||||
extra-substituters = https://attic.radiantwavetech.com/radiantwave https://nixos-raspberrypi.cachix.org
|
|
||||||
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
build-rpi:
|
|
||||||
runs-on: orion-lxc
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
|
||||||
|
|
||||||
- name: Guard main branch is on the production channel
|
|
||||||
run: |
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
NAME=$(nix eval --impure --raw .#channelName)
|
|
||||||
if [ "$NAME" != "radiantwave" ]; then
|
|
||||||
echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
|
|
||||||
echo " A dev->main merge brought a dev-pointing channel block into flake.nix."
|
|
||||||
echo " Set channel.appInput/atticRepo/gitRef back to main values before building prod images."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Fail fast unless the closure baked into the image is exactly what
|
|
||||||
# RadiantWave CI published to Attic (aarch64). Otherwise the Pi compiles
|
|
||||||
# RadiantWave from source (slow) unless RadiantWave CI has published both
|
|
||||||
# the aarch64 closure and aarch64-manifest.json. See `channel` in flake.nix.
|
|
||||||
- name: Verify baked baseline matches the published channel
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
|
|
||||||
VERSION=$(nix eval --impure --raw .#channelVersion)
|
|
||||||
ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
|
|
||||||
MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/aarch64-manifest.json"
|
|
||||||
BASELINE=$(nix eval --impure --raw .#baselineOutPaths.aarch64-linux)
|
|
||||||
|
|
||||||
MANIFEST=$(curl -fsSL "$MANIFEST_URL")
|
|
||||||
PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
|
|
||||||
PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
|
|
||||||
|
|
||||||
echo "channel version : $VERSION"
|
|
||||||
echo "manifest version: $PUB_VERSION"
|
|
||||||
echo "baseline path : $BASELINE"
|
|
||||||
echo "manifest path : $PUB_PATH"
|
|
||||||
|
|
||||||
if [ "$VERSION" != "$PUB_VERSION" ]; then
|
|
||||||
echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
|
|
||||||
echo " Bump channel.appVersion (and the pinned radiantwave input) to match the release."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$BASELINE" != "$PUB_PATH" ]; then
|
|
||||||
echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
|
|
||||||
echo " Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
HASH=$(basename "$BASELINE" | cut -d- -f1)
|
|
||||||
if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
|
|
||||||
echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Prepare output directory
|
|
||||||
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
|
||||||
|
|
||||||
- name: Build Raspberry Pi image
|
|
||||||
run: |
|
|
||||||
export NIXPKGS_ALLOW_UNFREE=1
|
|
||||||
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
||||||
nix build -L --impure .#nixosConfigurations.radiantwavekiosk-rpi.config.system.build.sdImage
|
|
||||||
|
|
||||||
- name: Rename Raspberry Pi image
|
|
||||||
run: |
|
|
||||||
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
|
||||||
FILENAME="radiantwave-rpi-${ISO_DATE}.img.zst"
|
|
||||||
cp -L result/sd-image/*.img.zst "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
|
||||||
echo "RPI_IMAGE_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
|
|
||||||
|
|
||||||
- name: Copy Raspberry Pi image to fileserver
|
|
||||||
run: |
|
|
||||||
scp "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}" \
|
|
||||||
157.245.124.103:/mnt/infrastructure_data/files/images/
|
|
||||||
|
|
||||||
- name: Cleanup Raspberry Pi image
|
|
||||||
run: rm -f "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}"
|
|
||||||
@@ -0,0 +1,150 @@
|
|||||||
|
# One build workflow for every branch — do not add per-branch copies.
|
||||||
|
#
|
||||||
|
# The branch/ref selects the channel, nothing else does: the flake's `channel`
|
||||||
|
# block picks the app input, Attic repo, and upgrade ref, so the same config
|
||||||
|
# names build dev images on `dev` and prod images on `main`. This file itself
|
||||||
|
# is identical on both branches.
|
||||||
|
#
|
||||||
|
# Trigger model:
|
||||||
|
# * push to `dev` -> build every development image
|
||||||
|
# * new git tag -> build every production image (tags live on main)
|
||||||
|
# * manual dispatch -> build the channel of the selected branch
|
||||||
|
#
|
||||||
|
# Hardware variants come from an include-matrix:
|
||||||
|
# ISO variants -> .config.system.build.isoImage (storeContents pulls in the closure)
|
||||||
|
# Raspberry Pi -> .config.system.build.sdImage
|
||||||
|
# `orion-lxc` emulates aarch64-linux, so the Pi build runs alongside the rest.
|
||||||
|
name: Build Kiosk Images
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- dev
|
||||||
|
tags:
|
||||||
|
- "*"
|
||||||
|
|
||||||
|
env:
|
||||||
|
# Both channel caches plus the Raspberry Pi cachix, so a build can substitute
|
||||||
|
# from whichever channel the checked-out ref selects.
|
||||||
|
NIX_CONFIG: |
|
||||||
|
extra-substituters = https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev https://nixos-raspberrypi.cachix.org
|
||||||
|
extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build:
|
||||||
|
name: ${{ matrix.label }}
|
||||||
|
runs-on: orion-lxc
|
||||||
|
strategy:
|
||||||
|
fail-fast: false
|
||||||
|
matrix:
|
||||||
|
include:
|
||||||
|
- label: kiosk
|
||||||
|
system: kiosk-iso
|
||||||
|
target: isoImage
|
||||||
|
outdir: iso
|
||||||
|
ext: iso
|
||||||
|
arch: x86_64-linux
|
||||||
|
manifest: manifest.json
|
||||||
|
- label: commercial
|
||||||
|
system: commercial-iso
|
||||||
|
target: isoImage
|
||||||
|
outdir: iso
|
||||||
|
ext: iso
|
||||||
|
arch: x86_64-linux
|
||||||
|
manifest: manifest.json
|
||||||
|
- label: android
|
||||||
|
system: android-iso
|
||||||
|
target: isoImage
|
||||||
|
outdir: iso
|
||||||
|
ext: iso
|
||||||
|
arch: x86_64-linux
|
||||||
|
manifest: manifest.json
|
||||||
|
- label: rpi
|
||||||
|
system: radiantwavekiosk-rpi
|
||||||
|
target: sdImage
|
||||||
|
outdir: sd-image
|
||||||
|
ext: img.zst
|
||||||
|
arch: aarch64-linux
|
||||||
|
manifest: aarch64-manifest.json
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Clone repository
|
||||||
|
run: |
|
||||||
|
rm -rf ./* ./.[!.]* 2>/dev/null || true
|
||||||
|
ref="${GITHUB_REF#refs/heads/}"
|
||||||
|
ref="${ref#refs/tags/}"
|
||||||
|
git clone --depth 1 --branch "$ref" \
|
||||||
|
ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
|
||||||
|
git log --oneline -1
|
||||||
|
|
||||||
|
- name: Determine channel
|
||||||
|
run: |
|
||||||
|
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||||
|
CHANNEL=$(nix eval --impure --raw .#channelName)
|
||||||
|
if [ "$CHANNEL" = "radiantwave" ]; then LABEL=prod; else LABEL=dev; fi
|
||||||
|
echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
|
||||||
|
echo "CHANNEL_LABEL=$LABEL" >> "$GITHUB_ENV"
|
||||||
|
echo "Building the '$CHANNEL' channel ($LABEL)"
|
||||||
|
|
||||||
|
# Production only: fail fast unless the baked closure is exactly what
|
||||||
|
# RadiantWave CI published to Attic. The dev channel churns on every
|
||||||
|
# dispatch, so this is skipped there.
|
||||||
|
- name: Verify baked baseline matches the published channel
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||||
|
|
||||||
|
if [ "$CHANNEL" != "radiantwave" ]; then
|
||||||
|
echo "channel '$CHANNEL' is not production; skipping baseline preflight"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
VERSION=$(nix eval --impure --raw .#channelVersion)
|
||||||
|
ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
|
||||||
|
MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/${{ matrix.manifest }}"
|
||||||
|
BASELINE=$(nix eval --impure --raw .#baselineOutPaths.${{ matrix.arch }})
|
||||||
|
|
||||||
|
MANIFEST=$(curl -fsSL "$MANIFEST_URL")
|
||||||
|
PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
|
||||||
|
PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
|
||||||
|
|
||||||
|
echo "channel version : $VERSION"
|
||||||
|
echo "manifest version: $PUB_VERSION"
|
||||||
|
echo "baseline path : $BASELINE"
|
||||||
|
echo "manifest path : $PUB_PATH"
|
||||||
|
|
||||||
|
if [ "$VERSION" != "$PUB_VERSION" ]; then
|
||||||
|
echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if [ "$BASELINE" != "$PUB_PATH" ]; then
|
||||||
|
echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
|
||||||
|
echo " Run 'nix flake update radiantwave' so the pinned input resolves to the released commit."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
HASH=$(basename "$BASELINE" | cut -d- -f1)
|
||||||
|
if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
|
||||||
|
echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
- name: Prepare output directory
|
||||||
|
run: mkdir -p /var/lib/gitea-runner/radiantwave
|
||||||
|
|
||||||
|
- name: Build ${{ matrix.label }}
|
||||||
|
run: |
|
||||||
|
export NIXPKGS_ALLOW_UNFREE=1
|
||||||
|
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
||||||
|
nix build -L --impure \
|
||||||
|
".#nixosConfigurations.${{ matrix.system }}.config.system.build.${{ matrix.target }}"
|
||||||
|
|
||||||
|
- name: Publish ${{ matrix.label }}
|
||||||
|
run: |
|
||||||
|
ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
|
||||||
|
FILENAME="radiantwave-${{ matrix.label }}-${CHANNEL_LABEL}-${ISO_DATE}.${{ matrix.ext }}"
|
||||||
|
cp -L result/${{ matrix.outdir }}/*.${{ matrix.ext }} \
|
||||||
|
"/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||||
|
scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
|
||||||
|
157.245.124.103:/mnt/infrastructure_data/files/images/
|
||||||
|
rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
|
||||||
Reference in New Issue
Block a user