ci: expose angieVersion as plain string attr; fix push step

Use `nix eval --raw .#angieVersion` instead of trying to read a
writeText derivation that was never built. Also call streamLayeredImage
output via process-substitution properly.

.woodpecker.yaml

@@ -43,12 +43,12 @@ steps:
         EOF
       - if [ -n "$GITEA_CLONE_TOKEN" ]; then echo "machine git.oleks.space login oleks password $GITEA_CLONE_TOKEN" >~/.netrc && chmod 600 ~/.netrc; fi
 
-      # Build the image (a script that streams the OCI tar to stdout).
-      - nix build .#default --print-out-paths --no-link
-      - VERSION="$(nix eval --raw .#version | xargs cat)"
-      - echo "Built angie $VERSION"
+      # Resolve the upstream Angie version and build the image stream script.
+      - VERSION="$(nix eval --raw .#angieVersion)"
+      - echo "Building angie $VERSION"
+      - STREAM="$(nix build .#default --print-out-paths --no-link)"
 
-      # Push to Gitea OCI registry under both the version tag and `latest-arm64`.
+      # Auth + push to Gitea OCI registry under both <ver>-arm64 and latest-arm64.
       - mkdir -p ~/.config/containers
       - |
         printf '{"auths":{"git.oleks.space":{"auth":"%s"}}}\n' \
@@ -57,7 +57,7 @@ steps:
       - |
         nix run nixpkgs#skopeo -- copy --insecure-policy \
           --authfile ~/.config/containers/auth.json \
-          docker-archive:<($(nix build .#default --print-out-paths --no-link)) \
+          docker-archive:<("$STREAM") \
           docker://git.oleks.space/oleks/angie:$VERSION-arm64
       - |
         nix run nixpkgs#skopeo -- copy --insecure-policy \

flake.nix

@@ -12,7 +12,7 @@
       # nixpkgs ships angie compiled against `--prefix=/etc/angie` and
       # `--http-log-path=/var/log/angie/access.log`; the package's `bin/angie`
       # already knows where to look for its main config (/etc/angie/angie.conf).
-      angie = pkgs.angie;
+      inherit (pkgs) angie;
 
       # Stock main config: turns on http and includes whatever drop-ins the
       # chart mounts at /etc/angie/http.d/*.conf — same idiom as the alpine
@@ -55,8 +55,13 @@
         '';
         config = {
           Entrypoint = [ "${angie}/bin/angie" ];
-          Cmd = [ "-g" "daemon off;" ];
-          ExposedPorts = { "80/tcp" = { }; };
+          Cmd = [
+            "-g"
+            "daemon off;"
+          ];
+          ExposedPorts = {
+            "80/tcp" = { };
+          };
           WorkingDir = "/etc/angie";
         };
       };
@@ -64,9 +69,8 @@
     {
       packages.${system} = {
         default = image;
-        # Plain text file containing just the version string — read by CI to
-        # produce the registry tag without re-evaluating the flake.
-        version = pkgs.writeText "angie-version" angie.version;
       };
+      # Plain string — read by CI via `nix eval --raw .#angieVersion`.
+      angieVersion = angie.version;
     };
 }