feat(pi): deploy from CI-gated ref via comin (candidate C)

.github/workflows/build.yml

@@ -130,3 +130,23 @@ jobs:
             || contains(needs.*.result, 'cancelled')
             || contains(needs.*.result, 'skipped') }}
         run: exit 1
+
+  # Fast-forward the `deploy` ref to this commit so pi's comin poller
+  # converges within a minute. Gated on all-builds succeeding, which also
+  # guarantees the aarch64 closure is already in Cachix (pushed by tower's
+  # post-build hook during the build). Main only, and all-builds runs with
+  # if: always(), so require its explicit success.
+  deploy:
+    name: deploy
+    needs: all-builds
+    if: >-
+      ${{ github.ref == 'refs/heads/main'
+        && needs.all-builds.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Fast-forward deploy ref
+        run: git push origin HEAD:deploy

CLAUDE.md

@@ -116,8 +116,10 @@ the insecure package, the assertion fails and prompts removal.
 are port-forwarded to tower (`.10`).
 
 **LAN DHCP + DNS:** served by `pi` via `dnsmasq` (`modules/lan-dns.nix`,
-listening on `end0`, static `.18`). Pi auto-upgrades from main nightly — test
-before merging.
+listening on `end0`, static `.18`). Pi runs comin, which polls the CI-gated
+`deploy` ref (fast-forwarded to a commit only after `all-builds` passes) and
+deploys `nixosConfigurations.pi` within ~60s of a merge to main — test before
+merging.
 
 **Static LAN addresses:** `pi end0` `.18` (MAC `DC:A6:32:13:51:14`), `tower`
 `.10` (motherboard NIC `enp11s0`, static via NetworkManager in

flake.nix

@@ -64,6 +64,11 @@
       url = "github:ryoppippi/nix-claude-code";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # Pull-based GitOps deployer for pi; not packaged in nixpkgs.
+    comin = {
+      url = "github:nlewo/comin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =

modules/hosts/pi/configuration.nix

@@ -27,17 +27,6 @@
     };
   };
 
-  system.autoUpgrade = {
-    enable = true;
-    flake = "github:etrobert/setup/main#pi";
-    flags = [
-      "--accept-flake-config"
-      "--print-build-logs"
-    ];
-    # dates = "4:40"; # default value
-    randomizedDelaySec = "5min";
-  };
-
   networking.hostName = "pi";
 
   networking.networkmanager = {
@@ -64,6 +53,19 @@
   services = {
     tailscale.extraUpFlags = [ "--advertise-exit-node" ];
 
+    # comin polls the CI-gated `deploy` ref (fast-forwarded only after the
+    # all-builds job succeeds) and deploys nixosConfigurations.pi within ~60s.
+    comin = {
+      enable = true;
+      remotes = [
+        {
+          name = "origin";
+          url = "https://github.com/etrobert/setup.git";
+          branches.main.name = "deploy";
+        }
+      ];
+    };
+
     navidrome = {
       enable = true;
       settings = {

modules/hosts/pi/default.nix

@@ -13,6 +13,7 @@
       self.nixosModules.base
       self.nixosModules.lanDns
       inputs.agenix.nixosModules.default
+      inputs.comin.nixosModules.comin
     ];
   };
 }