kernel beta update #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Triggered when raspberrypi/firmware's extra/git_hash file changes, | |
| # i.e. a new upstream firmware/kernel pair is being shipped to | |
| # rpi-update. Kicks off a kernel beta build so | |
| # the matching kernel .deb lands on public/beta automatically. | |
| # | |
| # Required secrets (org or repo level): | |
| # GITLAB_URL GitLab instance URL. | |
| # PACKAGING_TOKEN Project access token on the linux-packaging | |
| # project: api scope, Maintainer role. | |
| # BRIDGE_TOKEN Project access token on the bridge project: | |
| # read_repository scope, Reporter role. | |
| # PACKAGING_PROJECT linux-packaging project path on GitLab. | |
| # BRIDGE_PROJECT Bridge tool's project path on GitLab. | |
| # Required variables (org or repo level): | |
| # KERNEL_SOURCE_PATH Path to the persistent raspberrypi/linux clone | |
| # on the runner. Variable rather than secret | |
| # because container.volumes is evaluated before | |
| # the secrets context is available. | |
| # CI_AUTHOR_NAME Name attributed to bridge-driven commits and | |
| # the debian/changelog entry. | |
| # CI_AUTHOR_EMAIL Email attributed to the same. | |
| name: kernel beta update | |
| on: | |
| push: | |
| branches: [master] | |
| paths: | |
| - extra/git_hash | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: 'Kernel ref to build (SHA, tag, or origin/branch). Blank = read extra/git_hash.' | |
| required: false | |
| type: string | |
| dry_run: | |
| description: 'Dry run (no rpi/update, no GitLab push)' | |
| required: false | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: kernel-beta-update | |
| cancel-in-progress: true | |
| jobs: | |
| trixie: | |
| runs-on: [self-hosted, linux, linux-bridge] | |
| timeout-minutes: 30 | |
| environment: beta-release | |
| container: | |
| image: debian:stable | |
| volumes: | |
| - ${{ vars.KERNEL_SOURCE_PATH }}:${{ vars.KERNEL_SOURCE_PATH }} | |
| env: | |
| GITLAB_BASE: ${{ secrets.GITLAB_URL }} | |
| GITLAB_PROJECT: ${{ secrets.PACKAGING_PROJECT }} | |
| GITLAB_TOKEN: ${{ secrets.PACKAGING_TOKEN }} | |
| LINUX_SRC: ${{ vars.KERNEL_SOURCE_PATH }} | |
| GIT_AUTHOR_NAME: ${{ vars.CI_AUTHOR_NAME }} | |
| GIT_AUTHOR_EMAIL: ${{ vars.CI_AUTHOR_EMAIL }} | |
| GIT_COMMITTER_NAME: ${{ vars.CI_AUTHOR_NAME }} | |
| GIT_COMMITTER_EMAIL: ${{ vars.CI_AUTHOR_EMAIL }} | |
| DEBFULLNAME: ${{ vars.CI_AUTHOR_NAME }} | |
| DEBEMAIL: ${{ vars.CI_AUTHOR_EMAIL }} | |
| steps: | |
| - name: Install dependencies | |
| run: | | |
| apt-get update -qq | |
| apt-get install -y -qq --no-install-recommends \ | |
| devscripts \ | |
| git \ | |
| git-buildpackage \ | |
| python3-minimal \ | |
| quilt | |
| - name: Sync bridge from GitLab | |
| env: | |
| BRIDGE_PROJECT: ${{ secrets.BRIDGE_PROJECT }} | |
| BRIDGE_TOKEN: ${{ secrets.BRIDGE_TOKEN }} | |
| run: | | |
| host="${GITLAB_BASE#https://}" | |
| clone_url="https://oauth2:${BRIDGE_TOKEN}@${host}/${BRIDGE_PROJECT}.git" | |
| find . -mindepth 1 -delete 2>/dev/null || true | |
| git clone --depth 1 "$clone_url" . | |
| - name: Checkout extra/git_hash | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: extra/git_hash | |
| sparse-checkout-cone-mode: false | |
| path: firmware | |
| - name: Resolve kernel ref | |
| id: kernel | |
| run: | | |
| if [ -n "${{ inputs.ref }}" ]; then | |
| ref="${{ inputs.ref }}" | |
| else | |
| ref=$(tr -d '[:space:]' < firmware/extra/git_hash) | |
| fi | |
| [ -n "$ref" ] || { echo "no kernel ref resolved" >&2; exit 1; } | |
| echo "ref=$ref" >> "$GITHUB_OUTPUT" | |
| - name: Sync linux-packaging from GitLab | |
| run: | | |
| host="${GITLAB_BASE#https://}" | |
| clone_url="https://oauth2:${GITLAB_TOKEN}@${host}/${GITLAB_PROJECT}.git" | |
| git clone "$clone_url" linux-packaging | |
| - name: Run bridge | |
| run: | | |
| git config --global --add safe.directory "$LINUX_SRC" | |
| git -C "$LINUX_SRC" fetch --all --tags --prune | |
| ./bridge beta \ | |
| ${{ inputs.dry_run && '--dry-run' || '' }} \ | |
| --packaging ./linux-packaging \ | |
| --linux "$LINUX_SRC" \ | |
| --codename trixie \ | |
| "${{ steps.kernel.outputs.ref }}" |