Merge pull request 'Dev' (#9) from dev into main

Reviewed-on: #9

.gitea/workflows/build-prod-android.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /var/lib/gitea-runner/radiantwave
 

.gitea/workflows/build-prod-commercial.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /var/lib/gitea-runner/radiantwave
 

.gitea/workflows/build-prod-kiosk.yml

@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /var/lib/gitea-runner/radiantwave
 

.gitea/workflows/build-prod-rpi.yml

@@ -14,6 +14,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod images."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /var/lib/gitea-runner/radiantwave
 

flake.lock

@@ -220,11 +220,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1787675420,
-        "narHash": "sha256-2Hq9IcgdDXQc2uQ4yC/5NZVjcZaFCcVS78vj+ee+y/Q=",
+        "lastModified": 1789157302,
+        "narHash": "sha256-9wOHFEkFd7Lz1cJoUWBksgzTB+RP6sdtiF3hpyOrnQY=",
         "ref": "main",
-        "rev": "43cd93bbd7dde69c55c00a28c1691e1a192eda39",
-        "revCount": 47,
+        "rev": "a043ec84d8c421f6fc2abb064da2836449010868",
+        "revCount": 64,
         "type": "git",
         "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
       },

flake.nix

@@ -69,11 +69,19 @@
       #
       # To flip branches, change ONLY these three values (then push/merge).
       channel = {
-        appInput = radiantwave-dev;                                    # dev
-        atticRepo = "radiantwave-dev";                                 # dev
-        gitRef = "?ref=dev";                                           # dev
+        appInput = radiantwave;                                        # main
+        atticRepo = "radiantwave";                                     # main
+        gitRef = "";                                                   # main
       };
 
+      # Exposed so CI (see .gitea/workflows/build-prod-*.yml) and humans can
+      # verify which channel this checkout resolves to. On `main` this must be
+      # "radiantwave"; on `dev` it must be "radiantwave-dev". The prod
+      # workflows fail fast if this isn't the production channel, so a merge
+      # that brings a dev-pointing channel block into `main` breaks the build
+      # instead of silently shipping dev builds as prod ISOs.
+      channelName = if channel.appInput == radiantwave then "radiantwave" else "radiantwave-dev";
+
       # Live app-update side channel. The manifest is served by the
       # fileserver; closures are fetched (never built) from the channel's
       # Attic cache. `repo` selects the channel — "radiantwave" (main) or
@@ -201,6 +209,8 @@
         };
     in
     {
+      inherit channelName;
+
       packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;