The radiantwave 1.8 tag was force-moved from 34c72b5 to a5a6b5b while
flake.lock still pinned the old commit, so the ISO baked a baseline that
was not the closure RadiantWave CI published to Attic. With version 1.8
overridden this could still compile RadiantWave from source instead of
substituting it.
- Update flake.lock so radiantwave?ref=refs/tags/1.8 resolves to a5a6b5b.
- Expose channelVersion/channelAtticUrl/channelManifestDir/baselineOutPaths
from flake.nix for CI verification.
- Prod workflows: fail fast unless channel.appVersion equals the channel
manifest version, baselineOutPaths.<system> equals the manifest storePath,
and that store path exists in the channel's Attic cache.
The dev->main merge left the channel block in flake.nix pointing at
radiantwave-dev, so prod ISOs built from main shipped the dev app (which
versions itself by short git hash) and the updater polled the dev Attic
manifest. Restore the channel block to main values, re-pin flake.lock to
the latest radiantwave main revision, and expose channelName so the prod
build workflows can fail fast if main ever resolves to the dev channel.
Consolidates 8 closures to only 4 by using a git branch selector that sets
the values for -dev variants of each closure.
Reference the 'Verifying KioskConfig builds are in the right branch' note
in Obsidian for more reference.
The inline find -exec broke through the double shell hop (the remote
shell consumed the ; separator). The script pipes its payload to remote
bash via stdin, tolerates zero matches, and fails loudly on missing
directories or failed moves.
- Wire -dev variants to the radiantwave-dev input (?ref=dev); prod keeps main
- Fix android-dev upgradeFlakeRef (was upgrading into production config)
- Parameterize one installer module (zero-touch-installer.nix); replace the
four near-duplicate ISO configs; mkIso pairs each ISO with its closure +
disk layout, fixing commercial-dev/android-dev ISO eval errors
- Add missing packages outputs (commercial-dev, android-dev, rpi, rpi-dev)
- Set networking.hostName + system.configurationRevision per variant
- Remove gitea access token and dead netrc/JWT config (repos are public)
- Drop flake.lock update step from CI (lock updates are manual)
- Refresh AGENTS.md: variants/ISO tables, facter report procedure, gotchas
The build-prod and build-dev workflows wrote their ISO/image artifacts to paths tied to the old 'build-server' runner:
- build-prod.yml: /home/runner/radiantwave
- build-dev.yml: /mnt/actions_build_storage/outputs
Both now stage, copy, and clean up artifacts under the new runner's home directory instead:
- build-prod.yml: /home/user/radiantwave
- build-dev.yml: /home/usr/radiantwave
No other behavior changes; the output files are still scp'd to the fileserver and the flake.lock commit step is unchanged.
NeilClack
NeilClack