nixos-config/.gitea/workflows/iso-builder.yml

name: Build NixOS ISOs

on:
  push:
    paths:
      - hosts/acheron/**
      - hosts/armaros/**
      - hosts/buildbox/**
      - hosts/ender-ml/**
      - hosts/eva-01/**
      - hosts/eva-03/**
      - hosts/iso/**
      - flake.nix
      - flake.lock
      - .gitea/workflows/iso-builder.yml
  workflow_dispatch:
    inputs:
      publish-release:
        description: "Publish the ISOs as a Gitea release"
        type: boolean
        default: true

jobs:
  build-iso:
    strategy:
      fail-fast: false
      matrix:
        host:
          - acheron
          - armaros
          - buildbox
          - ender-ml
          - eva-01
          - eva-03
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v27
        with:
          nix_path: nixpkgs=channel:nixos-unstable
          extra_nix_config: |
            experimental-features = nix-command flakes
            download-buffer-size = 200000000
            auto-optimise-store = true

      - name: Cache Nix store
        uses: actions/cache@v4
        with:
          path: |
            /nix/store
            /nix/var/nix/profiles
          key: nix-iso-${{ matrix.host }}-${{ hashFiles('flake.lock', 'hosts/**', 'flake.nix') }}
          restore-keys: |
            nix-iso-${{ matrix.host }}-
            nix-iso-

      - name: Build ${{ matrix.host }} ISO
        id: build
        run: |
          set -euo pipefail
          # Build the ISO directly from the flake's NixOS configuration.
          # `config.system.build.isoImage` is a store path containing an `iso/`
          # directory with the actual .iso file.
          nix build --print-out-paths \
            .#nixosConfigurations.${{ matrix.host }}-iso.config.system.build.isoImage \
            --out-link result-iso 2>&1 | tee /tmp/nix-build.log

          # Resolve the real .iso. Do NOT use `find -L` — it follows symlinks
          # into the nix store and may pick up .iso files from build deps.
          ISO_SRC="$(ls result-iso/iso/*.iso 2>/dev/null | head -n 1 || true)"
          if [ -z "$ISO_SRC" ]; then
            echo "::error::No ISO found at result-iso/iso/*.iso"
            cat /tmp/nix-build.log
            ls -la result-iso/ || true
            ls -la result-iso/iso/ || true
            exit 1
          fi

          # Verify it's actually a bootable ISO 9660 image before proceeding.
          if ! file "$ISO_SRC" | grep -q "ISO 9660"; then
            echo "::error::$ISO_SRC is not an ISO 9660 image:"
            file "$ISO_SRC"
            exit 1
          fi

          # Stage the ISO under a stable name in the workspace root so the
          # upload-artifact step can reference a single file directly.
          ISO_NAME="${{ matrix.host }}-installer.iso"
          cp "$ISO_SRC" "$ISO_NAME"

          echo "iso-path=$ISO_NAME" >> "$GITHUB_OUTPUT"
          echo "iso-size=$(stat -c%s "$ISO_NAME")" >> "$GITHUB_OUTPUT"

          echo "::group::ISO info"
          ls -lh "$ISO_NAME"
          file "$ISO_NAME"
          echo "SHA256:"
          sha256sum "$ISO_NAME"
          echo "::endgroup::"

      - name: Pick release tag
        id: tag
        if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish-release }}
        run: |
          if [ "${GITHUB_REF:-}" = "refs/tags/${GITHUB_REF_NAME:-}" ] && [ -n "${GITHUB_REF_NAME:-}" ]; then
            echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
          else
            echo "tag=ci-${{ matrix.host }}-${GITHUB_SHA:0:12}-${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish ${{ matrix.host }} ISO as a Gitea release
        if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish-release }}
        uses: akkuman/gitea-release-action@v1
        with:
          token: ${{ secrets.UPLOAD_TOKEN }}
          tag_name: ${{ steps.tag.outputs.tag }}
          name: ${{ matrix.host }} ISO ${{ steps.tag.outputs.tag }}
          prerelease: ${{ steps.tag.outputs.prerelease }}
          files: ${{ matrix.host }}-installer.iso