From 832c2afa1a81d614e649c51ff934d463b3ebb47a Mon Sep 17 00:00:00 2001 From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com> Date: Fri, 28 Aug 2026 00:18:18 +0300 Subject: [PATCH] ci: let a pull request keep the image it just built (#135) Verified on this PR's own run rather than merged on the reasoning. Across all 15 devices in the matrix: ``` Stage artifacts 15 success Upload build artifacts 15 success Send binary 15 skipped Publish releases skipped CI Gate success ``` 15 `fw-*` artifacts produced, and the retention the fix was about is what actually landed: ``` fw-hi3516ev300_ultimate_rvi-1ncmw2028 created 2026-08-27T21:17:00Z expires 2026-09-03T21:16:58Z -> 7 days ``` So a pull request now keeps the images it built, for a week, while the two paths that must stay closed to a PR -- the Telegram secret and shared release assets -- are still closed. --- .github/workflows/master.yml | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 0975b30..038a3ac 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -274,10 +274,14 @@ jobs: # schemes the build used (compound devices rename to -nor.tgz in # the workspace root, simple ones leave openipc.-nor-.tgz # under openipc/output/images/). + # Runs on pull_request too. Staging and the upload below are run-scoped + # and touch no secret and no shared state, so unlike `Send binary` and the + # `publish` job -- which stay gated, and must -- there is nothing here for + # a PR to leak or clobber. Without this a contributor's PR compiles a full + # image and then discards it, so they cannot test their own device profile + # without asking a maintainer to dispatch build-one for them. - name: Stage artifacts - if: >- - github.event_name != 'pull_request' && - (env.NORFW || env.NANDFW) + if: env.NORFW || env.NANDFW run: | mkdir -p dist for f in "${NORFW:-}" "${NANDFW:-}" "${SIZES:-}"; do @@ -297,15 +301,24 @@ jobs: # contention (run 27108181857: every board built, 14 jobs red in their # upload step). Consolidating every release write into one job removes the # concurrent-writer contention that causes it. + # + # `publish` carries its own `github.event_name != 'pull_request'`, so + # producing fw-* on a PR cannot reach a release; it only makes the image + # downloadable from the run that built it. + # + # Retention is per-event deliberately. A nightly's artifact is consumed by + # `publish` inside the same run and no one downloads it afterwards, and a + # nightly builds the entire device matrix -- holding those a week would + # keep seven full matrices in storage instead of one, for no reader. A PR + # builds a handful and has a person waiting on them, plausibly in another + # timezone, so one day is too short a window there. - name: Upload build artifacts - if: >- - github.event_name != 'pull_request' && - (env.NORFW || env.NANDFW) + if: env.NORFW || env.NANDFW uses: actions/upload-artifact@v4 with: name: fw-${{ matrix.platform }} if-no-files-found: ignore - retention-days: 1 + retention-days: ${{ github.event_name == 'pull_request' && 7 || 1 }} path: dist/* - name: Send binary