Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 33 additions & 4 deletions .github/workflows/build-kernel.yml
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,11 @@
required: false
default: true
type: boolean
flavours:
description: "ALL builds every flavour. Otherwise a space-separated list of flavour names (e.g. 'qcom', 'qcom qcom-rt'), no 'binary-' prefix."
required: false
default: "ALL"
type: string

workflow_call:
inputs:
Expand Down Expand Up @@ -78,6 +83,16 @@
required: false
default: false
type: boolean
flavours:
description: "ALL builds every flavour. Otherwise a space-separated list of flavour names (e.g. 'qcom', 'qcom qcom-rt'), no 'binary-' prefix."
required: false
default: "ALL"
type: string
s3_prefix:
description: "S3 path prefix under pkg/ (e.g. 'premerge', 'temp'). Callers must pass this explicitly."
required: false
default: "temp"
type: string

permissions:
contents: read # checkout + tag ls-remote only; output goes to S3
Expand All @@ -95,7 +110,7 @@
env:
SUITE: ${{ inputs.suite || 'resolute-qcom-devel' }}
ARCH: arm64
FLAVOR: all
FLAVOURS: ${{ inputs.flavours || 'ALL' }}
DBGSYM: ${{ github.event_name == 'schedule' && 'true' || (inputs.dbgsym && 'true' || 'false') }}

steps:
Expand Down Expand Up @@ -157,7 +172,7 @@
env:
GH_TOKEN: ${{ github.token }}
run: |
TAG="${UPSTREAM_PREFIX}-${{ inputs.kernel_version }}"

Check failure on line 175 in .github/workflows/build-kernel.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

build-kernel.yml:175: code injection via template expansion: may expand into attacker-controllable code
echo "Verifying tag '${TAG}' exists in repository..."

if git ls-remote --exit-code --tags \
Expand Down Expand Up @@ -294,7 +309,18 @@
- name: Build kernel packages (ghcr.io/qualcomm-linux/pkg-builder:${{ inputs.suite || 'resolute-qcom' }})
run: |
JOBS=$(nproc)
if [ "${FLAVOR}" = "all" ]; then TARGET="binary"; else TARGET="binary-${FLAVOR} binary-indep"; fi
FLAVOURS_LC=$(echo "${FLAVOURS}" | tr '[:upper:]' '[:lower:]')
# binary-indep is always built alongside the selected flavours —
# linux-headers-* and linux-tools-* packages depend on it, so it
# can't be made optional here.
if [ "${FLAVOURS_LC}" = "all" ]; then
TARGET="binary"
else
TARGET="binary-indep"
for f in ${FLAVOURS_LC}; do
TARGET="${TARGET} binary-${f}"
done
fi

echo "Building: suite=${SUITE} base_suite=${BASE_SUITE} target=${TARGET} arch=${ARCH} jobs=${JOBS}"

Expand Down Expand Up @@ -416,14 +442,17 @@
# -----------------------------------------------------------------------
# 9. Upload to S3 (lecore-production runner only)
# Skipped when skip_s3 is set (premerge-pr.yml build-only checks).
# Destination prefix is the caller-supplied s3_prefix input, not
# inferred from github.event_name: a reusable workflow inherits the
# caller's original event, so it is never actually "workflow_call".
# -----------------------------------------------------------------------
- name: Upload kernel .deb packages to S3
if: inputs.skip_s3 != true
uses: qualcomm-linux/upload-private-artifact-action@aws-v4
with:
s3_bucket: qli-prd-lecore-gh-artifacts
path: ${{ github.workspace }}/output
destination: ${{ env.ORG_NAME }}/pkg/temp/${{ env.REPO_NAME }}/${{ github.run_id }}-${{ github.run_attempt }}/
destination: ${{ env.ORG_NAME }}/pkg/${{ inputs.s3_prefix || 'temp' }}/${{ env.REPO_NAME }}/${{ github.run_id }}-${{ github.run_attempt }}/

# -----------------------------------------------------------------------
# 10. Summary
Expand All @@ -440,10 +469,10 @@
echo "|-------|-------|"
echo "| Branch | \`${SUITE}\` |"
echo "| Architecture | \`${ARCH}\` |"
echo "| Flavour | \`${FLAVOR}\` |"
echo "| Flavour | \`${FLAVOURS}\` |"
echo "| Dbgsym | \`${DBGSYM}\` |"
echo "| Container | \`ghcr.io/qualcomm-linux/pkg-builder:${BASE_SUITE}\` |"
echo "| Runner | \`${{ runner.name }}\` |"

Check failure on line 475 in .github/workflows/build-kernel.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

build-kernel.yml:475: code injection via template expansion: may expand into attacker-controllable code
if [ -n "${DEVEL_PRS}" ]; then
echo "| Devel PRs | \`${DEVEL_PRS}\` |"
fi
Expand Down
8 changes: 6 additions & 2 deletions docs/PIPELINE.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,10 @@ gh workflow run build-kernel.yml --repo qualcomm-linux/pkg-linux-qcom-canonical
gh workflow run bootstrap-history.yml --repo qualcomm-linux/pkg-linux-qcom-canonical
```

PRs into `resolute-qcom-devel` get a build-only pre-merge check (`premerge-pr.yml`
on that branch), which calls `build-kernel.yml` with `skip_s3=true`.
PRs into `resolute-qcom-devel` get a pre-merge build check (`premerge-pr.yml` on
that branch), which calls `build-kernel.yml` with `flavours=qcom`,
`dbgsym=false`, and `s3_prefix=premerge` (binary-indep is always built
regardless of `flavours`). Its packages are uploaded to S3 under
`pkg/premerge/`, separate from the `pkg/temp/` prefix used by nightly and
manual `workflow_dispatch` runs.

Loading