KioskConfig/.gitea/workflows/build.yml

# One build workflow for every branch — do not add per-branch copies.
#
# The branch/ref selects the channel, nothing else does: the flake's `channel`
# block picks the channel manifest whose closure is baked as the app, the Attic
# repo, and the upgrade ref, so the same config names build dev images on `dev`
# and prod images on `main`. This file itself is identical on both branches.
#
# Trigger model:
#   * push to `dev`   -> build every development image
#   * new git tag     -> build every production image (tags live on main)
#   * manual dispatch -> build the channel of the selected branch
#
# Hardware variants come from an include-matrix:
#   ISO variants  -> .config.system.build.isoImage (storeContents pulls in the closure)
#   Raspberry Pi  -> .config.system.build.sdImage
# `orion-lxc` emulates aarch64-linux, so the Pi build runs alongside the rest.
name: Build Kiosk Images

on:
  workflow_dispatch:
  push:
    branches:
      - dev
    tags:
      - "*"

env:
  # Both channel caches plus the Raspberry Pi cachix, so a build can substitute
  # from whichever channel the checked-out ref selects. tarball-ttl=0 keeps the
  # eval-time manifest fetch (builtins.fetchurl in flake.nix) from reusing a
  # stale copy cached by an earlier build on this persistent runner.
  NIX_CONFIG: |
    extra-substituters = https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev https://nixos-raspberrypi.cachix.org
    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
    tarball-ttl = 0

jobs:
  build:
    name: ${{ matrix.label }}
    runs-on: orion-lxc
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: kiosk
            system: kiosk-iso
            target: isoImage
            outdir: iso
            ext: iso
            arch: x86_64-linux
            manifest: manifest.json
          - label: commercial
            system: commercial-iso
            target: isoImage
            outdir: iso
            ext: iso
            arch: x86_64-linux
            manifest: manifest.json
          - label: android
            system: android-iso
            target: isoImage
            outdir: iso
            ext: iso
            arch: x86_64-linux
            manifest: manifest.json
          - label: rpi
            system: radiantwavekiosk-rpi
            target: sdImage
            outdir: sd-image
            ext: img.zst
            arch: aarch64-linux
            manifest: aarch64-manifest.json

    steps:
      - name: Clone repository
        run: |
          rm -rf ./* ./.[!.]* 2>/dev/null || true
          ref="${GITHUB_REF#refs/heads/}"
          ref="${ref#refs/tags/}"
          git clone --depth 1 --branch "$ref" \
            ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
          git log --oneline -1

      - name: Determine channel
        run: |
          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
          CHANNEL=$(nix eval --impure --raw .#channelName)
          if [ "$CHANNEL" = "radiantwave" ]; then LABEL=prod; else LABEL=dev; fi
          echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
          echo "CHANNEL_LABEL=$LABEL" >> "$GITHUB_ENV"
          echo "Building the '$CHANNEL' channel ($LABEL)"

      # Fail fast if the closure the channel manifest announces is not in the
      # channel's Attic cache. We bake that exact storePath, so without it the
      # image would try to compile RadiantWave from source (which never works:
      # this repo has no app source). Runs for both channels; RadiantWave CI
      # publishes the manifest only after the matching Attic push succeeds.
      - name: Verify published app closure is in the channel cache
        run: |
          set -euo pipefail
          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh

          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/${{ matrix.manifest }}"
          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')

          echo "channel : $CHANNEL"
          echo "attic   : $ATTIC"
          echo "manifest: $MANIFEST_URL"
          echo "closure : $PUB_PATH"

          HASH=$(basename "$PUB_PATH" | cut -d- -f1)
          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
            echo "ERROR: $PUB_PATH is not in $ATTIC; the image would compile RadiantWave from source."
            exit 1
          fi

      - name: Prepare output directory
        run: mkdir -p /var/lib/gitea-runner/radiantwave

      - name: Build ${{ matrix.label }}
        run: |
          export NIXPKGS_ALLOW_UNFREE=1
          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
          nix build -L --impure \
            ".#nixosConfigurations.${{ matrix.system }}.config.system.build.${{ matrix.target }}"

      - name: Publish ${{ matrix.label }}
        run: |
          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
          FILENAME="radiantwave-${{ matrix.label }}-${CHANNEL_LABEL}-${ISO_DATE}.${{ matrix.ext }}"
          cp -L result/${{ matrix.outdir }}/*.${{ matrix.ext }} \
            "/var/lib/gitea-runner/radiantwave/${FILENAME}"
          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
            157.245.124.103:/mnt/infrastructure_data/files/images/
          rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"