KioskConfig/.gitea/workflows/build.yml

# One build workflow per hardware family, identical on every branch — do not
# add per-branch copies. build-rpi.yaml is the same file with a different matrix.
#
# The branch/ref selects the channel, nothing else does: the flake's `channel`
# block picks the app input, Attic repo, and upgrade ref, so the same config
# names build dev images on `dev` and prod images on `main`.
#
# Trigger model:
#   * push to `dev`   -> build every development image
#   * new git tag     -> build every production image (tags live on main)
#   * manual dispatch -> build the channel of the selected branch
#
# This file builds the x86_64 ISO variants:
#   ISO variants  -> .config.system.build.isoImage (storeContents pulls in the closure)
name: Build Kiosk Images (x86)

on:
  workflow_dispatch:
  push:
    branches:
      - dev
    tags:
      - "*"

env:
  # Both channel caches plus the Raspberry Pi cachix, so a build can substitute
  # from whichever channel the checked-out ref selects.
  NIX_CONFIG: |
    extra-substituters = https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev https://nixos-raspberrypi.cachix.org
    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=

jobs:
  build:
    name: ${{ matrix.label }}
    runs-on: orion-lxc
    strategy:
      fail-fast: false
      matrix:
        include:
          # NOTE: Gitea schedules matrix jobs in reverse definition order on
          # the single orion-lxc runner, so the list is reversed on purpose:
          # android -> commercial -> kiosk means kiosk builds FIRST.
          - label: android
            system: android-iso
            target: isoImage
            outdir: iso
            ext: iso
            arch: x86_64-linux
            manifest: manifest.json
          - label: commercial
            system: commercial-iso
            target: isoImage
            outdir: iso
            ext: iso
            arch: x86_64-linux
            manifest: manifest.json
          - label: kiosk
            system: kiosk-iso
            target: isoImage
            outdir: iso
            ext: iso
            arch: x86_64-linux
            manifest: manifest.json

    steps:
      - name: Clone repository
        run: |
          rm -rf ./* ./.[!.]* 2>/dev/null || true
          ref="${GITHUB_REF#refs/heads/}"
          ref="${ref#refs/tags/}"
          git clone --depth 1 --branch "$ref" \
            ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
          git log --oneline -1

      - name: Determine channel
        run: |
          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
          CHANNEL=$(nix eval --impure --raw .#channelName)
          if [ "$CHANNEL" = "radiantwave" ]; then LABEL=prod; else LABEL=dev; fi
          echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
          echo "CHANNEL_LABEL=$LABEL" >> "$GITHUB_ENV"
          echo "Building the '$CHANNEL' channel ($LABEL)"

      # Production only: fail fast unless the baked closure is exactly what
      # RadiantWave CI published to Attic. The dev channel churns on every
      # dispatch, so this is skipped there.
      - name: Verify baked baseline matches the published channel
        run: |
          set -euo pipefail
          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh

          if [ "$CHANNEL" != "radiantwave" ]; then
            echo "channel '$CHANNEL' is not production; skipping baseline preflight"
            exit 0
          fi

          VERSION=$(nix eval --impure --raw .#channelVersion)
          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/${{ matrix.manifest }}"
          BASELINE=$(nix eval --impure --raw .#baselineOutPaths.${{ matrix.arch }})

          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
          PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')

          echo "channel version : $VERSION"
          echo "manifest version: $PUB_VERSION"
          echo "baseline path   : $BASELINE"
          echo "manifest path   : $PUB_PATH"

          if [ "$VERSION" != "$PUB_VERSION" ]; then
            echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
            exit 1
          fi
          if [ "$BASELINE" != "$PUB_PATH" ]; then
            echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
            echo "       Run 'nix flake update radiantwave' so the pinned input resolves to the released commit."
            exit 1
          fi
          HASH=$(basename "$BASELINE" | cut -d- -f1)
          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
            echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source."
            exit 1
          fi

      - name: Prepare output directory
        run: mkdir -p /var/lib/gitea-runner/radiantwave

      - name: Build ${{ matrix.label }}
        run: |
          export NIXPKGS_ALLOW_UNFREE=1
          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
          nix build -L --impure \
            ".#nixosConfigurations.${{ matrix.system }}.config.system.build.${{ matrix.target }}"

      - name: Publish ${{ matrix.label }}
        run: |
          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
          FILENAME="radiantwave-${{ matrix.label }}-${CHANNEL_LABEL}-${ISO_DATE}.${{ matrix.ext }}"
          cp -L result/${{ matrix.outdir }}/*.${{ matrix.ext }} \
            "/var/lib/gitea-runner/radiantwave/${FILENAME}"
          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
            157.245.124.103:/mnt/infrastructure_data/files/images/
          rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"