feat(pi): deploy from CI-gated ref within a minute (candidate A: gated pull)

.github/workflows/build.yml

@@ -130,3 +130,16 @@ jobs:
             || contains(needs.*.result, 'cancelled')
             || contains(needs.*.result, 'skipped') }}
         run: exit 1
+
+  deploy:
+    name: deploy
+    needs: all-builds
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Fast-forward deploy ref
+        run: git push origin HEAD:deploy

CLAUDE.md

@@ -116,8 +116,7 @@ the insecure package, the assertion fails and prompts removal.
 are port-forwarded to tower (`.10`).
 
 **LAN DHCP + DNS:** served by `pi` via `dnsmasq` (`modules/lan-dns.nix`,
-listening on `end0`, static `.18`). Pi auto-upgrades from main nightly — test
-before merging.
+listening on `end0`, static `.18`).
 
 **Static LAN addresses:** `pi end0` `.18` (MAC `DC:A6:32:13:51:14`), `tower`
 `.10` (motherboard NIC `enp11s0`, static via NetworkManager in

flake.nix

@@ -93,6 +93,7 @@
           ./modules/file-manager.nix
           ./modules/pimsync.nix
           ./modules/lan-dns.nix
+          ./modules/auto-upgrade.nix
           ./modules/darkman.nix
           ./modules/mpd.nix
           ./modules/hypridle.nix

modules/auto-upgrade.nix

@@ -0,0 +1,65 @@
+_: {
+  flake.nixosModules.autoUpgrade =
+    { pkgs, lib, ... }:
+    let
+      deployGate = pkgs.writeShellApplication {
+        name = "pi-deploy-gate";
+
+        runtimeInputs = [
+          pkgs.gitMinimal
+          pkgs.coreutils
+        ];
+
+        inheritPath = false;
+
+        text = ''
+          state_dir=/var/lib/nixos-upgrade
+          last_rev="$state_dir/last-deployed-rev"
+          pending_rev="$state_dir/pending-rev"
+          deploy_url=https://github.com/etrobert/setup.git
+
+          case "$1" in
+            check)
+              rev=$(git ls-remote "$deploy_url" deploy | cut --fields=1)
+              if [ -z "$rev" ]; then
+                echo "could not resolve deploy ref; skipping" >&2
+                exit 1
+              fi
+              if [ -f "$last_rev" ] && [ "$rev" = "$(cat "$last_rev")" ]; then
+                echo "deploy $rev already live; skipping"
+                exit 1
+              fi
+              printf '%s\n' "$rev" > "$pending_rev"
+              echo "deploy $rev differs from live; upgrading"
+              ;;
+            record)
+              if [ -f "$pending_rev" ]; then
+                mv "$pending_rev" "$last_rev"
+              fi
+              ;;
+            *)
+              echo "usage: pi-deploy-gate {check|record}" >&2
+              exit 2
+              ;;
+          esac
+        '';
+      };
+    in
+    {
+      system.autoUpgrade = {
+        enable = true;
+        flake = "github:etrobert/setup/deploy#pi";
+        flags = [
+          "--accept-flake-config"
+          "--print-build-logs"
+        ];
+        dates = "*:0/1"; # every minute
+      };
+
+      systemd.services.nixos-upgrade.serviceConfig = {
+        StateDirectory = "nixos-upgrade";
+        ExecCondition = "${lib.getExe deployGate} check";
+        ExecStartPost = "${lib.getExe deployGate} record";
+      };
+    };
+}

modules/hosts/pi/configuration.nix

@@ -27,17 +27,6 @@
     };
   };
 
-  system.autoUpgrade = {
-    enable = true;
-    flake = "github:etrobert/setup/main#pi";
-    flags = [
-      "--accept-flake-config"
-      "--print-build-logs"
-    ];
-    # dates = "4:40"; # default value
-    randomizedDelaySec = "5min";
-  };
-
   networking.hostName = "pi";
 
   networking.networkmanager = {

modules/hosts/pi/default.nix

@@ -12,6 +12,7 @@
       self.nixosModules.nixosBase
       self.nixosModules.base
       self.nixosModules.lanDns
+      self.nixosModules.autoUpgrade
       inputs.agenix.nixosModules.default
     ];
   };