Add Raspberry Pi build steps

.gitea/workflows/build.yml

@@ -1,12 +1,7 @@
 name: build
 
 on:
-  # Manual dispatch: always builds the `dev` branch (regardless of the ref
-  # selected when dispatching) and publishes to the dev Attic cache + dev
-  # live-update manifest. Version fingerprint = short commit hash.
   workflow_dispatch:
-  # Any new tag: builds the tagged revision and publishes a release to the
-  # release Attic cache + production live-update manifest. Version = the tag.
   push:
     tags: ['*']
 
@@ -14,10 +9,6 @@ jobs:
   nix-build:
     runs-on: orion-lxc
     steps:
-      # actions/checkout@v4 is unreliable on host-mode runners (its files are
-      # copied into the workspace instead of the repo), so clone explicitly.
-      # A manual dispatch always clones `dev`; a tag push clones the tag. A full
-      # clone (no --depth) lets `git describe --tags` resolve the real tag.
       - name: Checkout
         run: |
           rm -rf ./* ./.[!.]* 2>/dev/null || true
@@ -39,9 +30,6 @@ jobs:
           git describe --tags --always 2>&1 || true
           test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
 
-      # Dev builds fingerprint as the short commit hash; releases report the
-      # tag. Persisted via GITHUB_ENV so the impure nix eval below reads it via
-      # builtins.getEnv.
       - name: Compute version
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
@@ -50,18 +38,13 @@ jobs:
             echo "APP_VERSION=$(git describe --tags --always)" >> "$GITHUB_ENV"
           fi
 
-      # checks is keyed per-system (checks.<system>.default); nix build's
-      # #attr shorthand can't resolve it, so resolve the current system inline.
-      # --impure lets the flake read APP_VERSION via builtins.getEnv
-      # (pure evals always get the package defaults).
-      - name: Build package
+      # ---- x86_64 (native) ----
+      - name: Build package (x86_64)
         run: |
           nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
             --impure --out-link result-pkg
 
-      # The offline test suite runs in the check derivation's checkPhase.
-      # This is a separate build/output from the package itself.
-      - name: Build + offline test suite
+      - name: Build + offline test suite (x86_64)
         run: |
           nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
             --impure --out-link result-checks
@@ -79,14 +62,25 @@ jobs:
             ./build/test_license_service
           '
 
-      # Manual dispatch -> dev cache; tag push -> release cache.
+      # ---- aarch64 (emulated via host binfmt_misc/qemu-user) ----
+      - name: Build package (aarch64)
+        run: |
+          nix build -L ".#packages.aarch64-linux.default" \
+            --impure --out-link result-pkg-aarch64
+
+      - name: Build + offline test suite (aarch64)
+        run: |
+          nix build -L ".#checks.aarch64-linux.default" \
+            --impure --out-link result-checks-aarch64
+
+      # ---- Publish (only reached if every build/test above passed) ----
       - name: Push to Attic dev cache
         if: github.event_name == 'workflow_dispatch'
         env:
           ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
         run: |
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave-dev ./result-pkg
+          attic push radiantwave:radiantwave-dev ./result-pkg ./result-pkg-aarch64
 
       - name: Push to Attic release cache
         if: github.event_name != 'workflow_dispatch'
@@ -94,28 +88,22 @@ jobs:
           ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_PROD }}
         run: |
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave ./result-pkg
+          attic push radiantwave:radiantwave ./result-pkg ./result-pkg-aarch64
 
-      # Publish the manifest kiosks poll for live app updates. `storePath`
-      # must match exactly the closure pushed to the matching Attic cache above
-      # (readlink resolves the result-pkg out-link symlink to its real
-      # /nix/store path), so a kiosk can `nix copy --from` it without ever
-      # building from source. Upload mirrors the ISO scp pattern to the
-      # fileserver via the build-server's `radiantwave-infra` SSH alias.
-      - name: Publish dev manifest
-        if: github.event_name == 'workflow_dispatch'
+      - name: Publish manifests
         run: |
-          STOREPATH=$(readlink -f ./result-pkg)
-          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$STOREPATH" > manifest.json
-          cat manifest.json
-          scp manifest.json \
-            nclack@157.245.124.103:/mnt/infrastructure_data/files/radiantwave-dev/manifest.json
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            DEST=radiantwave-dev
+          else
+            DEST=radiantwave
+          fi
 
-      - name: Publish release manifest
-        if: github.event_name != 'workflow_dispatch'
-        run: |
-          STOREPATH=$(readlink -f ./result-pkg)
-          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$STOREPATH" > manifest.json
-          cat manifest.json
-          scp manifest.json \
-            nclack@157.245.124.103:/mnt/infrastructure_data/files/radiantwave/manifest.json
+          X86_PATH=$(readlink -f ./result-pkg)
+          ARM_PATH=$(readlink -f ./result-pkg-aarch64)
+
+          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$X86_PATH" > manifest.json
+          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$ARM_PATH" > aarch64-manifest.json
+          cat manifest.json aarch64-manifest.json
+
+          scp manifest.json aarch64-manifest.json \
+            nclack@157.245.124.103:/mnt/infrastructure_data/files/$DEST/