[WIP] Gaia charts

.envrc

@@ -0,0 +1 @@
+use flake

.github/workflows/bootstrap-tarball.yml

@@ -0,0 +1,117 @@
+name: Build Bootstrap Tarball
+
+on:
+  push:
+    branches: [nixos]
+    paths:
+      - 'nixos/bootstrap.nix'
+      - 'flake.nix'
+      - '.github/workflows/bootstrap-tarball.yml'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version tag (e.g. 2.5.0)"
+        required: false
+        default: "2.5.0"
+        type: string
+
+jobs:
+  build-bootstrap:
+    runs-on: [self-hosted, aarch64]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "VERSION=${{ inputs.version }}" >> "$GITHUB_ENV"
+          else
+            echo "VERSION=2.5.0" >> "$GITHUB_ENV"
+          fi
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Setup Cachix
+        uses: cachix/cachix-action@v15
+        with:
+          name: pifinder
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Build bootstrap SD image
+        run: |
+          nix build .#images.bootstrap --print-out-paths > /tmp/image_path
+          echo "IMAGE_PATH=$(cat /tmp/image_path)" >> "$GITHUB_ENV"
+
+      - name: Extract boot and rootfs
+        run: |
+          # Clean up any leftover from previous runs
+          sudo rm -rf /tmp/tarball-staging /tmp/bootstrap.img /mnt/boot /mnt/root
+
+          # The SD image output is a directory containing sd-image/*.img.zst
+          IMAGE_FILE=$(find "$IMAGE_PATH" -type f \( -name "*.img" -o -name "*.img.zst" \) | head -1)
+          echo "Found image: $IMAGE_FILE"
+
+          if [[ "${IMAGE_FILE}" == *.zst ]]; then
+            zstd -d "${IMAGE_FILE}" -o /tmp/bootstrap.img
+          else
+            cp "${IMAGE_FILE}" /tmp/bootstrap.img
+          fi
+
+          LOOP=$(sudo losetup --find --show --partscan /tmp/bootstrap.img)
+          echo "LOOP=${LOOP}" >> "$GITHUB_ENV"
+
+          sudo mkdir -p /mnt/boot /mnt/root
+          sudo mount "${LOOP}p1" /mnt/boot
+          sudo mount "${LOOP}p2" /mnt/root
+
+          mkdir -p /tmp/tarball-staging
+          sudo cp -a /mnt/boot /tmp/tarball-staging/boot
+          sudo cp -a /mnt/root /tmp/tarball-staging/rootfs
+
+          sudo umount /mnt/boot /mnt/root
+          sudo losetup -d "${LOOP}"
+          rm -f /tmp/bootstrap.img
+
+      - name: Create bootstrap tarball
+        run: |
+          TARBALL="pifinder-bootstrap-v${VERSION}.tar.gz"
+
+          # Clean up any leftover files from previous runs
+          sudo rm -rf /tmp/tarball-staging/manifest.json "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256"
+
+          cat > /tmp/tarball-staging/manifest.json <<EOF
+          {
+            "version": "$VERSION",
+            "type": "bootstrap",
+            "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "boot_label": "FIRMWARE",
+            "root_label": "NIXOS_SD"
+          }
+          EOF
+
+          # Use sudo for tar since rootfs contains root-owned files
+          sudo tar -C /tmp/tarball-staging -czf "/tmp/${TARBALL}" \
+            --exclude='*/lost+found' \
+            boot rootfs manifest.json
+          sudo chown $USER "/tmp/${TARBALL}"
+
+          echo "TARBALL=/tmp/${TARBALL}" >> "$GITHUB_ENV"
+          echo "TARBALL_NAME=${TARBALL}" >> "$GITHUB_ENV"
+
+          sha256sum "/tmp/${TARBALL}" | awk '{print $1}' > "/tmp/${TARBALL}.sha256"
+          echo "SHA256=$(cat /tmp/${TARBALL}.sha256)" >> "$GITHUB_ENV"
+
+          ls -lh "/tmp/${TARBALL}"
+
+      - name: Upload tarball artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.TARBALL_NAME }}
+          path: |
+            ${{ env.TARBALL }}
+            ${{ env.TARBALL }}.sha256

.github/workflows/build.yml

@@ -0,0 +1,155 @@
+name: Build PiFinder NixOS
+
+on:
+  push:
+    branches: [main, nixos]
+  pull_request:
+    types: [labeled, synchronize, opened]
+  workflow_dispatch:
+
+concurrency:
+  group: build-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  # Try Pi5 native build first (fast)
+  build-native:
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      contains(github.event.pull_request.labels.*.name, 'preview') ||
+      contains(github.event.pull_request.labels.*.name, 'testable')
+    runs-on: [self-hosted, aarch64]
+    timeout-minutes: 30
+    outputs:
+      success: ${{ steps.build.outcome == 'success' }}
+      store_path: ${{ steps.push.outputs.store_path }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/cachix-action@v15
+        with:
+          name: pifinder
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Build NixOS system closure
+        id: build
+        run: |
+          nix build .#nixosConfigurations.pifinder.config.system.build.toplevel \
+            -L --no-link
+
+      - name: Push to Cachix
+        id: push
+        run: |
+          STORE_PATH=$(nix build .#nixosConfigurations.pifinder.config.system.build.toplevel \
+            --json | jq -r '.[].outputs.out')
+          echo "$STORE_PATH" | cachix push pifinder
+          echo "store_path=$STORE_PATH" >> "$GITHUB_OUTPUT"
+
+  # Wait up to 15 min for native builder, then decide on fallback
+  native-wait:
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      contains(github.event.pull_request.labels.*.name, 'preview') ||
+      contains(github.event.pull_request.labels.*.name, 'testable')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      need_emulated: ${{ steps.wait.outputs.need_emulated }}
+    steps:
+      - name: Wait for native build
+        id: wait
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          for i in $(seq 1 30); do
+            sleep 30
+            RESULT=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs" \
+              --jq '.jobs[] | select(.name == "build-native") | .conclusion // "pending"' 2>/dev/null || echo "pending")
+            echo "Check $i/30: build-native=$RESULT"
+            if [ "$RESULT" = "success" ]; then
+              echo "need_emulated=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            elif [ "$RESULT" = "failure" ] || [ "$RESULT" = "cancelled" ]; then
+              echo "need_emulated=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          done
+          echo "Native build not done after 15 min, falling back to emulated"
+          echo "need_emulated=true" >> "$GITHUB_OUTPUT"
+
+  # Fallback to QEMU emulation if Pi5 unavailable or slow
+  build-emulated:
+    needs: native-wait
+    if: needs.native-wait.outputs.need_emulated == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    outputs:
+      store_path: ${{ steps.push.outputs.store_path }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v27
+        with:
+          extra_nix_config: |
+            extra-platforms = aarch64-linux
+            extra-system-features = big-parallel
+
+      - uses: cachix/cachix-action@v15
+        with:
+          name: pifinder
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Register QEMU binfmt for aarch64
+        run: sudo apt-get update && sudo apt-get install -y qemu-user-static
+
+      - name: Build NixOS system closure
+        run: |
+          nix build .#nixosConfigurations.pifinder.config.system.build.toplevel \
+            --system aarch64-linux \
+            -L --no-link
+
+      - name: Push to Cachix
+        id: push
+        run: |
+          STORE_PATH=$(nix build .#nixosConfigurations.pifinder.config.system.build.toplevel \
+            --system aarch64-linux \
+            --json | jq -r '.[].outputs.out')
+          echo "$STORE_PATH" | cachix push pifinder
+          echo "store_path=$STORE_PATH" >> "$GITHUB_OUTPUT"
+
+  # Commit pifinder-build.json with store path to the same branch
+  stamp-build:
+    needs: [build-native, build-emulated]
+    if: always() && (needs.build-native.result == 'success' || needs.build-emulated.result == 'success')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Write pifinder-build.json
+        run: |
+          STORE_PATH="${{ needs.build-native.outputs.store_path || needs.build-emulated.outputs.store_path }}"
+          BRANCH="${{ github.head_ref || github.ref_name }}"
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          PR_NUMBER="${{ github.event.pull_request.number }}"
+          if [ -n "$PR_NUMBER" ]; then
+            VERSION="PR#${PR_NUMBER}-${SHORT_SHA}"
+          else
+            VERSION="${BRANCH}-${SHORT_SHA}"
+          fi
+          jq -n --arg sp "$STORE_PATH" --arg v "$VERSION" \
+            '{store_path: $sp, version: $v}' > pifinder-build.json
+
+      - name: Commit pifinder-build.json
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add pifinder-build.json
+          git diff --staged --quiet || git commit -m "chore: stamp build [skip ci]"
+          git push

.github/workflows/lint.yml

@@ -0,0 +1,56 @@
+name: Lint & Test
+on: [push, pull_request]
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: false
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Lint
+        run: nix develop --command bash -c "cd python && ruff check"
+      - name: Format check
+        run: nix develop --command bash -c "cd python && ruff format --check"
+      - name: Check for removed config keys
+        if: github.event_name == 'pull_request'
+        run: |
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          git show "$BASE_SHA:default_config.json" 2>/dev/null \
+            | python3 -c "import json,sys; print('\n'.join(sorted(json.load(sys.stdin).keys())))" \
+            > /tmp/base_keys.txt || exit 0
+          python3 -c "import json,sys; print('\n'.join(sorted(json.load(sys.stdin).keys())))" \
+            < default_config.json > /tmp/head_keys.txt
+          REMOVED=$(comm -23 /tmp/base_keys.txt /tmp/head_keys.txt)
+          if [ -n "$REMOVED" ]; then
+            while IFS= read -r key; do
+              echo "::warning file=default_config.json::Config key '$key' was removed — this may break user preferences across release switches"
+            done <<< "$REMOVED"
+          fi
+
+  type-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: false
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Type check
+        run: nix develop --command bash -c "cd python && mypy --install-types --non-interactive ."
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: false
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Smoke tests
+        run: nix develop --command bash -c "cd python && pytest -m smoke"
+      - name: Unit tests
+        run: nix develop --command bash -c "cd python && pytest -m unit"