Add beads and gastown to CI cache, consolidate CI workflow

- Add packages/beads and packages/gastown with shared definitions
- Expose custom-beads and custom-gastown in flake packages output
- Consolidate CI from matrix (8 parallel jobs) to single job with loop
- Saves ~12 minutes of redundant nix-setup time per run
- Uses ::group:: for collapsible log sections per package

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -23,50 +23,64 @@ jobs:
     runs-on: ubuntu-latest
     needs: check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    strategy:
-      fail-fast: false
-      matrix:
-        package:
-          - custom-claude-code
-          - custom-app-launcher-server
-          - custom-mcrcon-rbw
-          - custom-tea-rbw
-          - custom-rclone-torbox-setup
-          - qt-pinned-jellyfin-media-player
     steps:
       - uses: actions/checkout@v6
 
       - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
 
-      - name: Build ${{ matrix.package }}
-        id: build
+      - name: Setup SSH for cache
         run: |
-          OUT_PATH=$(nix build .#${{ matrix.package }} --no-link --print-out-paths)
-          echo "out_path=$OUT_PATH" >> "$GITHUB_OUTPUT"
-        env:
-          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
-
-      - name: Sign and push to cache
-        run: |
-          # Write signing key
-          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
-          chmod 600 /tmp/signing-key
-
-          # Sign the closure
-          nix store sign --key-file /tmp/signing-key -r "${{ steps.build.outputs.out_path }}"
-
-          # Setup SSH key for cache push
           mkdir -p ~/.ssh
           echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
           chmod 600 ~/.ssh/cache_key
           ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
 
-          # Push to cache
-          nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "${{ steps.build.outputs.out_path }}"
+      - name: Setup signing key
+        run: |
+          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
+          chmod 600 /tmp/signing-key
 
-          # Create GC root to prevent garbage collection
-          OUT_HASH=$(basename "${{ steps.build.outputs.out_path }}" | cut -d'-' -f1)
-          ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
-            "mkdir -p /nix/var/nix/gcroots/ci-cache && ln -sfn ${{ steps.build.outputs.out_path }} /nix/var/nix/gcroots/ci-cache/${OUT_HASH}"
+      - name: Build, sign, and cache all packages
+        run: |
+          PACKAGES=(
+            custom-claude-code
+            custom-app-launcher-server
+            custom-mcrcon-rbw
+            custom-tea-rbw
+            custom-rclone-torbox-setup
+            custom-beads
+            custom-gastown
+            qt-pinned-jellyfin-media-player
+          )
+
+          FAILED=()
+          for pkg in "${PACKAGES[@]}"; do
+            echo "::group::Building $pkg"
+            if OUT_PATH=$(nix build ".#$pkg" --no-link --print-out-paths 2>&1); then
+              echo "Built: $OUT_PATH"
+
+              # Sign the closure
+              nix store sign --key-file /tmp/signing-key -r "$OUT_PATH"
+
+              # Push to cache
+              nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "$OUT_PATH"
+
+              # Create GC root to prevent garbage collection
+              OUT_HASH=$(basename "$OUT_PATH" | cut -d'-' -f1)
+              ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
+                "mkdir -p /nix/var/nix/gcroots/ci-cache && ln -sfn $OUT_PATH /nix/var/nix/gcroots/ci-cache/${OUT_HASH}"
+
+              echo "✓ $pkg cached successfully"
+            else
+              echo "✗ $pkg failed to build"
+              FAILED+=("$pkg")
+            fi
+            echo "::endgroup::"
+          done
+
+          if [ ${#FAILED[@]} -gt 0 ]; then
+            echo "::error::Failed packages: ${FAILED[*]}"
+            exit 1
+          fi
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"