Consolidate Gitea CI into one event-routed workflow

2026-09-11 19:14:58 -05:00
parent f37beaf07e
commit 21f13c6cd5
3 changed files with 59 additions and 106 deletions
@@ -0,0 +1,122 @@
+name: build
+
+on:
+  # Manual dispatch: always builds the `dev` branch (regardless of the ref
+  # selected when dispatching) and publishes to the dev Attic cache + dev
+  # live-update manifest. Version fingerprint = short commit hash.
+  workflow_dispatch:
+  # Any new tag: builds the tagged revision and publishes a release to the
+  # release Attic cache + production live-update manifest. Version = the tag.
+  push:
+    tags: ['*']
+
+jobs:
+  nix-build:
+    runs-on: build-server
+    steps:
+      # actions/checkout@v4 is unreliable on host-mode runners (its files are
+      # copied into the workspace instead of the repo), so clone explicitly.
+      # A manual dispatch always clones `dev`; a tag push clones the tag. A full
+      # clone (no --depth) lets `git describe --tags` resolve the real tag.
+      - name: Checkout
+        run: |
+          rm -rf ./* ./.[!.]* 2>/dev/null || true
+          git config --global http.extraheader "Authorization: token ${{ github.token }}"
+          REF="${{ gitea.ref_name }}"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            REF=dev
+          fi
+          git clone --branch "$REF" \
+            "${{ gitea.server_url }}/${{ gitea.repository }}.git" .
+          test -f flake.nix
+          git log --oneline -1
+
+      - name: Inspect workspace
+        run: |
+          pwd
+          ls -la
+          git rev-parse --show-toplevel 2>&1 || true
+          git remote -v 2>&1 || true
+          git describe --tags --always 2>&1 || true
+          test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
+
+      # Dev builds fingerprint as the short commit hash; releases report the
+      # tag. Persisted via GITHUB_ENV so the impure nix eval below reads it via
+      # builtins.getEnv.
+      - name: Compute version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "APP_VERSION=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
+          else
+            echo "APP_VERSION=$(git describe --tags --always)" >> "$GITHUB_ENV"
+          fi
+
+      # checks is keyed per-system (checks.<system>.default); nix build's
+      # #attr shorthand can't resolve it, so resolve the current system inline.
+      # --impure lets the flake read APP_VERSION via builtins.getEnv
+      # (pure evals always get the package defaults).
+      - name: Build package
+        run: |
+          nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-pkg
+
+      # The offline test suite runs in the check derivation's checkPhase.
+      # This is a separate build/output from the package itself.
+      - name: Build + offline test suite
+        run: |
+          nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-checks
+
+      - name: Live portal tests
+        env:
+          RWT_LIVE_ACCOUNT_EMAIL: ${{ secrets.RWT_LIVE_ACCOUNT_EMAIL }}
+          RWT_LIVE_LICENSE_EMAIL: ${{ secrets.RWT_LIVE_LICENSE_EMAIL }}
+          RWT_LIVE_LICENSE_KEY: ${{ secrets.RWT_LIVE_LICENSE_KEY }}
+        run: |
+          nix develop --command bash -c '
+            cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
+            cmake --build build --target test_api_client test_license_service
+            ./build/test_api_client
+            ./build/test_license_service
+          '
+
+      # Manual dispatch -> dev cache; tag push -> release cache.
+      - name: Push to Attic dev cache
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
+        run: |
+          attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
+          attic push radiantwave:radiantwave-dev ./result-pkg
+
+      - name: Push to Attic release cache
+        if: github.event_name != 'workflow_dispatch'
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_PROD }}
+        run: |
+          attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
+          attic push radiantwave:radiantwave ./result-pkg
+
+      # Publish the manifest kiosks poll for live app updates. `storePath`
+      # must match exactly the closure pushed to the matching Attic cache above
+      # (readlink resolves the result-pkg out-link symlink to its real
+      # /nix/store path), so a kiosk can `nix copy --from` it without ever
+      # building from source. Upload mirrors the ISO scp pattern to the
+      # fileserver via the build-server's `radiantwave-infra` SSH alias.
+      - name: Publish dev manifest
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          STOREPATH=$(readlink -f ./result-pkg)
+          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$STOREPATH" > manifest.json
+          cat manifest.json
+          scp manifest.json \
+            radiantwave-infra:/mnt/infrastructure_data/files/radiantwave-dev/manifest.json
+
+      - name: Publish release manifest
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          STOREPATH=$(readlink -f ./result-pkg)
+          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$STOREPATH" > manifest.json
+          cat manifest.json
+          scp manifest.json \
+            radiantwave-infra:/mnt/infrastructure_data/files/radiantwave/manifest.json