ci: use the same single branch-aware build workflow as dev

Replace the four per-variant prod workflows (and the leftover dev workflow)
with the shared .gitea/workflows/build.yml. Main builds on new tags or manual
dispatch; dev pushes build the dev channel. Identical file on both branches.

.gitea/workflows/build-dev.yml

@@ -1,91 +0,0 @@
-name: Build Dev ISOs
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - dev
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev
-    extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
-jobs:
-  build-dev-kiosk:
-    runs-on: orion-lxc
-    steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-      - name: Checkout dev branch
-        run: git checkout dev
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-      - name: Build dev kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
-      - name: Rename dev kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-kiosk-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-      - name: Copy dev kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-      - name: Cleanup
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-
-  build-dev-android:
-    runs-on: orion-lxc
-    steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-      - name: Checkout dev branch
-        run: git checkout dev
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-      - name: Build dev android ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
-      - name: Rename dev android ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-android-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-      - name: Copy dev android ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-      - name: Cleanup
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-
-  build-dev-commercial:
-    runs-on: orion-lxc
-    steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-      - name: Checkout dev branch
-        run: git checkout dev
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-      - name: Build dev commercial ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
-      - name: Rename dev commercial ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-commercial-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-      - name: Copy dev commercial ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-      - name: Cleanup
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"

.gitea/workflows/build-prod-android.yml

@@ -1,94 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
-
-jobs:
-  build-android:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Guard main branch is on the production channel
-        run: |
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          NAME=$(nix eval --impure --raw .#channelName)
-          if [ "$NAME" != "radiantwave" ]; then
-            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
-            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
-            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
-            exit 1
-          fi
-
-      # Fail fast unless the closure baked into the ISO is exactly what
-      # RadiantWave CI published to Attic. Otherwise the kiosk compiles
-      # RadiantWave from source (slow) and the live updater immediately swaps
-      # to the announced closure on first boot. See `channel` in flake.nix.
-      - name: Verify baked baseline matches the published channel
-        run: |
-          set -euo pipefail
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-
-          VERSION=$(nix eval --impure --raw .#channelVersion)
-          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
-          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json"
-          BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux)
-
-          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
-          PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
-          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
-
-          echo "channel version : $VERSION"
-          echo "manifest version: $PUB_VERSION"
-          echo "baseline path   : $BASELINE"
-          echo "manifest path   : $PUB_PATH"
-
-          if [ "$VERSION" != "$PUB_VERSION" ]; then
-            echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
-            echo "       Bump channel.appVersion (and the pinned radiantwave input) to match the release."
-            exit 1
-          fi
-
-          if [ "$BASELINE" != "$PUB_PATH" ]; then
-            echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
-            echo "       Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
-            exit 1
-          fi
-
-          HASH=$(basename "$BASELINE" | cut -d- -f1)
-          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
-            echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source."
-            exit 1
-          fi
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build android kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
-
-      - name: Rename android kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-android-iso-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "ANDROID_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy android kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup android kiosk ISO
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}"

.gitea/workflows/build-prod-commercial.yml

@@ -1,94 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
-
-jobs:
-  build-commercial:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Guard main branch is on the production channel
-        run: |
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          NAME=$(nix eval --impure --raw .#channelName)
-          if [ "$NAME" != "radiantwave" ]; then
-            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
-            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
-            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
-            exit 1
-          fi
-
-      # Fail fast unless the closure baked into the ISO is exactly what
-      # RadiantWave CI published to Attic. Otherwise the kiosk compiles
-      # RadiantWave from source (slow) and the live updater immediately swaps
-      # to the announced closure on first boot. See `channel` in flake.nix.
-      - name: Verify baked baseline matches the published channel
-        run: |
-          set -euo pipefail
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-
-          VERSION=$(nix eval --impure --raw .#channelVersion)
-          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
-          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json"
-          BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux)
-
-          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
-          PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
-          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
-
-          echo "channel version : $VERSION"
-          echo "manifest version: $PUB_VERSION"
-          echo "baseline path   : $BASELINE"
-          echo "manifest path   : $PUB_PATH"
-
-          if [ "$VERSION" != "$PUB_VERSION" ]; then
-            echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
-            echo "       Bump channel.appVersion (and the pinned radiantwave input) to match the release."
-            exit 1
-          fi
-
-          if [ "$BASELINE" != "$PUB_PATH" ]; then
-            echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
-            echo "       Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
-            exit 1
-          fi
-
-          HASH=$(basename "$BASELINE" | cut -d- -f1)
-          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
-            echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source."
-            exit 1
-          fi
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build commercial kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
-
-      - name: Rename commercial kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-commercial-iso-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "COMMERCIAL_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy commercial kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup commercial kiosk ISO
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}"

.gitea/workflows/build-prod-kiosk.yml

@@ -1,94 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
-
-jobs:
-  build-kiosk:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Guard main branch is on the production channel
-        run: |
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          NAME=$(nix eval --impure --raw .#channelName)
-          if [ "$NAME" != "radiantwave" ]; then
-            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
-            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
-            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
-            exit 1
-          fi
-
-      # Fail fast unless the closure baked into the ISO is exactly what
-      # RadiantWave CI published to Attic. Otherwise the kiosk compiles
-      # RadiantWave from source (slow) and the live updater immediately swaps
-      # to the announced closure on first boot. See `channel` in flake.nix.
-      - name: Verify baked baseline matches the published channel
-        run: |
-          set -euo pipefail
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-
-          VERSION=$(nix eval --impure --raw .#channelVersion)
-          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
-          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/manifest.json"
-          BASELINE=$(nix eval --impure --raw .#baselineOutPaths.x86_64-linux)
-
-          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
-          PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
-          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
-
-          echo "channel version : $VERSION"
-          echo "manifest version: $PUB_VERSION"
-          echo "baseline path   : $BASELINE"
-          echo "manifest path   : $PUB_PATH"
-
-          if [ "$VERSION" != "$PUB_VERSION" ]; then
-            echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
-            echo "       Bump channel.appVersion (and the pinned radiantwave input) to match the release."
-            exit 1
-          fi
-
-          if [ "$BASELINE" != "$PUB_PATH" ]; then
-            echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
-            echo "       Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
-            exit 1
-          fi
-
-          HASH=$(basename "$BASELINE" | cut -d- -f1)
-          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
-            echo "ERROR: $BASELINE is not in $ATTIC; the ISO would compile RadiantWave from source."
-            exit 1
-          fi
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
-
-      - name: Rename kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-home-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup kiosk ISO
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}"

.gitea/workflows/build-prod-rpi.yml

@@ -1,91 +0,0 @@
-on:
-  workflow_dispatch:
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave https://nixos-raspberrypi.cachix.org
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
-
-jobs:
-  build-rpi:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Guard main branch is on the production channel
-        run: |
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          NAME=$(nix eval --impure --raw .#channelName)
-          if [ "$NAME" != "radiantwave" ]; then
-            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
-            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
-            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod images."
-            exit 1
-          fi
-
-      # Fail fast unless the closure baked into the image is exactly what
-      # RadiantWave CI published to Attic (aarch64). Otherwise the Pi compiles
-      # RadiantWave from source (slow) unless RadiantWave CI has published both
-      # the aarch64 closure and aarch64-manifest.json. See `channel` in flake.nix.
-      - name: Verify baked baseline matches the published channel
-        run: |
-          set -euo pipefail
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-
-          VERSION=$(nix eval --impure --raw .#channelVersion)
-          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
-          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/aarch64-manifest.json"
-          BASELINE=$(nix eval --impure --raw .#baselineOutPaths.aarch64-linux)
-
-          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
-          PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
-          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
-
-          echo "channel version : $VERSION"
-          echo "manifest version: $PUB_VERSION"
-          echo "baseline path   : $BASELINE"
-          echo "manifest path   : $PUB_PATH"
-
-          if [ "$VERSION" != "$PUB_VERSION" ]; then
-            echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
-            echo "       Bump channel.appVersion (and the pinned radiantwave input) to match the release."
-            exit 1
-          fi
-
-          if [ "$BASELINE" != "$PUB_PATH" ]; then
-            echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
-            echo "       Run 'nix flake update radiantwave' so the pinned input resolves to the release the manifest was built from."
-            exit 1
-          fi
-
-          HASH=$(basename "$BASELINE" | cut -d- -f1)
-          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
-            echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source."
-            exit 1
-          fi
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build Raspberry Pi image
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.radiantwavekiosk-rpi.config.system.build.sdImage
-
-      - name: Rename Raspberry Pi image
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-rpi-${ISO_DATE}.img.zst"
-          cp -L result/sd-image/*.img.zst "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "RPI_IMAGE_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy Raspberry Pi image to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup Raspberry Pi image
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}"

.gitea/workflows/build.yml

@@ -0,0 +1,150 @@
+# One build workflow for every branch — do not add per-branch copies.
+#
+# The branch/ref selects the channel, nothing else does: the flake's `channel`
+# block picks the app input, Attic repo, and upgrade ref, so the same config
+# names build dev images on `dev` and prod images on `main`. This file itself
+# is identical on both branches.
+#
+# Trigger model:
+#   * push to `dev`   -> build every development image
+#   * new git tag     -> build every production image (tags live on main)
+#   * manual dispatch -> build the channel of the selected branch
+#
+# Hardware variants come from an include-matrix:
+#   ISO variants  -> .config.system.build.isoImage (storeContents pulls in the closure)
+#   Raspberry Pi  -> .config.system.build.sdImage
+# `orion-lxc` emulates aarch64-linux, so the Pi build runs alongside the rest.
+name: Build Kiosk Images
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev
+    tags:
+      - "*"
+
+env:
+  # Both channel caches plus the Raspberry Pi cachix, so a build can substitute
+  # from whichever channel the checked-out ref selects.
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev https://nixos-raspberrypi.cachix.org
+    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
+
+jobs:
+  build:
+    name: ${{ matrix.label }}
+    runs-on: orion-lxc
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: kiosk
+            system: kiosk-iso
+            target: isoImage
+            outdir: iso
+            ext: iso
+            arch: x86_64-linux
+            manifest: manifest.json
+          - label: commercial
+            system: commercial-iso
+            target: isoImage
+            outdir: iso
+            ext: iso
+            arch: x86_64-linux
+            manifest: manifest.json
+          - label: android
+            system: android-iso
+            target: isoImage
+            outdir: iso
+            ext: iso
+            arch: x86_64-linux
+            manifest: manifest.json
+          - label: rpi
+            system: radiantwavekiosk-rpi
+            target: sdImage
+            outdir: sd-image
+            ext: img.zst
+            arch: aarch64-linux
+            manifest: aarch64-manifest.json
+
+    steps:
+      - name: Clone repository
+        run: |
+          rm -rf ./* ./.[!.]* 2>/dev/null || true
+          ref="${GITHUB_REF#refs/heads/}"
+          ref="${ref#refs/tags/}"
+          git clone --depth 1 --branch "$ref" \
+            ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
+          git log --oneline -1
+
+      - name: Determine channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          CHANNEL=$(nix eval --impure --raw .#channelName)
+          if [ "$CHANNEL" = "radiantwave" ]; then LABEL=prod; else LABEL=dev; fi
+          echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
+          echo "CHANNEL_LABEL=$LABEL" >> "$GITHUB_ENV"
+          echo "Building the '$CHANNEL' channel ($LABEL)"
+
+      # Production only: fail fast unless the baked closure is exactly what
+      # RadiantWave CI published to Attic. The dev channel churns on every
+      # dispatch, so this is skipped there.
+      - name: Verify baked baseline matches the published channel
+        run: |
+          set -euo pipefail
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+
+          if [ "$CHANNEL" != "radiantwave" ]; then
+            echo "channel '$CHANNEL' is not production; skipping baseline preflight"
+            exit 0
+          fi
+
+          VERSION=$(nix eval --impure --raw .#channelVersion)
+          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
+          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/${{ matrix.manifest }}"
+          BASELINE=$(nix eval --impure --raw .#baselineOutPaths.${{ matrix.arch }})
+
+          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
+          PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
+          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
+
+          echo "channel version : $VERSION"
+          echo "manifest version: $PUB_VERSION"
+          echo "baseline path   : $BASELINE"
+          echo "manifest path   : $PUB_PATH"
+
+          if [ "$VERSION" != "$PUB_VERSION" ]; then
+            echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
+            exit 1
+          fi
+          if [ "$BASELINE" != "$PUB_PATH" ]; then
+            echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
+            echo "       Run 'nix flake update radiantwave' so the pinned input resolves to the released commit."
+            exit 1
+          fi
+          HASH=$(basename "$BASELINE" | cut -d- -f1)
+          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
+            echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source."
+            exit 1
+          fi
+
+      - name: Prepare output directory
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
+
+      - name: Build ${{ matrix.label }}
+        run: |
+          export NIXPKGS_ALLOW_UNFREE=1
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          nix build -L --impure \
+            ".#nixosConfigurations.${{ matrix.system }}.config.system.build.${{ matrix.target }}"
+
+      - name: Publish ${{ matrix.label }}
+        run: |
+          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
+          FILENAME="radiantwave-${{ matrix.label }}-${CHANNEL_LABEL}-${ISO_DATE}.${{ matrix.ext }}"
+          cp -L result/${{ matrix.outdir }}/*.${{ matrix.ext }} \
+            "/var/lib/gitea-runner/radiantwave/${FILENAME}"
+          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
+          rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"