Production builds failed CI's baseline preflight because flake.nix pinned
the app to tag 1.8 (channel.appVersion = "1.8") while the published
manifest had moved on to 1.9; dev was likewise pinned to a stale commit.
Stop pinning the app anywhere. flake.nix now fetches the channel's
published manifest at eval time (builtins.fetchurl) and bakes its
storePath verbatim, so every image carries exactly the closure RadiantWave
published to Attic and never compiles the app from source.
- flake.nix: drop the radiantwave/radiantwave-dev inputs, appInput,
appVersion, channelVersion and baselineOutPaths; add channelAtticUrl,
channelManifestDir and publishedApp; builders consume the published path.
- configuration.nix: wrap the published store path in a symlinkJoin so it
can live in environment.systemPackages; add --impure to autoUpgrade
flags and set tarball-ttl = 0 so eval reads the current manifest.
- radiantwave-updater.nix: baselinePackage (package) -> baselinePath (str),
seeded from the exact manifest path.
- CI (build.yml, build-rpi.yml): replace the version-equality preflight with
a fail-fast check that the announced closure is in the channel's Attic;
set tarball-ttl = 0.
- build-rpi.sh: pass --impure.
- AGENTS.md: document the manifest-driven baseline.
Gitea schedules matrix jobs in reverse definition order on the single
orion-lxc runner, so kiosk (previously defined first) built last. Reverse
the include list so kiosk builds first; order is rpi, android, commercial,
kiosk in the file.
Single .gitea/workflows/build.yml shared by both branches; the checked-out
ref selects the channel, so no per-branch copies.
- dev push -> builds all development images (kiosk, commercial, android, rpi)
- new tag -> builds all production images; manual dispatch also supported
- Raspberry Pi sdImage built on orion-lxc via aarch64 emulation
- production-only baseline preflight (skipped on the dev channel)
- artifact names standardized to radiantwave-<variant>-<prod|dev>-<timestamp>
Consolidates 8 closures to only 4 by using a git branch selector that sets
the values for -dev variants of each closure.
Reference the 'Verifying KioskConfig builds are in the right branch' note
in Obsidian for more reference.
The inline find -exec broke through the double shell hop (the remote
shell consumed the ; separator). The script pipes its payload to remote
bash via stdin, tolerates zero matches, and fails loudly on missing
directories or failed moves.
- Wire -dev variants to the radiantwave-dev input (?ref=dev); prod keeps main
- Fix android-dev upgradeFlakeRef (was upgrading into production config)
- Parameterize one installer module (zero-touch-installer.nix); replace the
four near-duplicate ISO configs; mkIso pairs each ISO with its closure +
disk layout, fixing commercial-dev/android-dev ISO eval errors
- Add missing packages outputs (commercial-dev, android-dev, rpi, rpi-dev)
- Set networking.hostName + system.configurationRevision per variant
- Remove gitea access token and dead netrc/JWT config (repos are public)
- Drop flake.lock update step from CI (lock updates are manual)
- Refresh AGENTS.md: variants/ISO tables, facter report procedure, gotchas
The build-prod and build-dev workflows wrote their ISO/image artifacts to paths tied to the old 'build-server' runner:
- build-prod.yml: /home/runner/radiantwave
- build-dev.yml: /mnt/actions_build_storage/outputs
Both now stage, copy, and clean up artifacts under the new runner's home directory instead:
- build-prod.yml: /home/user/radiantwave
- build-dev.yml: /home/usr/radiantwave
No other behavior changes; the output files are still scp'd to the fileserver and the flake.lock commit step is unchanged.
NeilClack