Add attic verification

.gitea/workflows/dev.yml

@@ -67,6 +67,20 @@ jobs:
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
           attic push radiantwave:radiantwave-dev ./result-pkg
 
+      # attic push can exit 0 while storing a truncated NAR (dropped
+      # connection, disk full on the attic host), which kiosks then fail to
+      # fetch. Re-fetch the whole closure into a throwaway store to verify
+      # every NAR; if the upload is incomplete, `nix copy` errors and the
+      # manifest below is never published.
+      - name: Verify Attic upload
+        run: |
+          nix copy \
+            --from "https://attic.radiantwavetech.com/radiantwave-dev" \
+            --to "$PWD/.attic-verify-store" \
+            --no-check-sigs \
+            "$(readlink -f ./result-pkg)"
+          rm -rf "$PWD/.attic-verify-store"
+
       # Publish the manifest kiosks poll for live app updates. `storePath`
       # must match exactly the closure pushed to the dev Attic cache above
       # (readlink resolves the result-pkg out-link symlink to its real

.gitea/workflows/main.yml

@@ -75,6 +75,20 @@ jobs:
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
           attic push radiantwave:radiantwave ./result-pkg
 
+      # attic push can exit 0 while storing a truncated NAR (dropped
+      # connection, disk full on the attic host), which kiosks then fail to
+      # fetch. Re-fetch the whole closure into a throwaway store to verify
+      # every NAR; if the upload is incomplete, `nix copy` errors and the
+      # manifest below is never published.
+      - name: Verify Attic upload
+        run: |
+          nix copy \
+            --from "https://attic.radiantwavetech.com/radiantwave" \
+            --to "$PWD/.attic-verify-store" \
+            --no-check-sigs \
+            "$(readlink -f ./result-pkg)"
+          rm -rf "$PWD/.attic-verify-store"
+
       # Publish the manifest production kiosks poll for live app updates.
       # `storePath` must match exactly the closure pushed to the release Attic
       # cache above (readlink resolves the result-pkg out-link symlink to its