ci/build-one: accept arbitrary commit input; publish to nightly-bisect-* tag (#93)

PR-Bld-C in the mirror of OpenIPC/firmware's nightly redesign.
Mirrors OpenIPC/firmware#2116. Adds an optional `commit` workflow_-
dispatch input to `build-one.yml` so:

  - `gh workflow run build-one.yml -f platform=X -f commit=<sha>`
    builds the given SHA from `git bisect run`.
  - Output goes to `nightly-bisect-<short>` (prerelease) tag, distinct
    from the dated `nightly-YYYYMMDD-<short>` namespace produced by
    PR-Bld-A's master.yml. The manifest aggregator's regex only
    indexes `^nightly-[0-9]{8}-[0-9a-f]{7}$`, so one-off bisect
    rebuilds never enter manifest.{json,flat}.
  - Without `commit`, falls back to building HEAD and tags as
    `nightly-bisect-<short>-<UTC ts>` so repeated dispatches of the
    same HEAD don't collide.

Also:
  - Retry budget around `bash builder.sh` matching master.yml +
    OpenIPC/firmware#2129's hardening.
  - BUILD_ID / BUILD_SHA / BUILD_PLATFORM env at the Build firmware
    step level (forward-compat with Phase 3 of the mirror plan).
  - Drops dead `env: TAG_NAME: latest` at workflow level.
  - Release body carries sha/short/platform/one_off=true for the
    aggregator's downstream consumers to easily distinguish bisect
    builds from dated nightlies.

See ~/.claude/plans/mirror-nightly-redesign-to-builder.md.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/build-one.yml

@@ -5,18 +5,44 @@ on:
       platform:
         description: 'Platform to build (e.g. hi3518ev200_lite_switcam-hs303-v2)'
         required: true
-
-env:
-  TAG_NAME: latest
+      commit:
+        description: 'Commit SHA to build (optional; defaults to current branch HEAD). Use this from `git bisect run` or for one-off historic rebuilds.'
+        required: false
 
 jobs:
+  resolve:
+    name: Resolve commit
+    runs-on: ubuntu-latest
+    outputs:
+      ref:       ${{ steps.r.outputs.ref }}
+      short_sha: ${{ steps.r.outputs.short_sha }}
+      tag_name:  ${{ steps.r.outputs.tag_name }}
+    steps:
+      - id: r
+        run: |
+          REF="${{ inputs.commit }}"
+          [ -z "$REF" ] && REF="${{ github.sha }}"
+          SHORT="$(printf '%s' "$REF" | cut -c1-7)"
+          if [ -n "${{ inputs.commit }}" ]; then
+            TAG="nightly-bisect-${SHORT}"
+          else
+            TAG="nightly-bisect-${SHORT}-$(date -u +%Y%m%d%H%M%S)"
+          fi
+          echo "ref=$REF"               >> "$GITHUB_OUTPUT"
+          echo "short_sha=$SHORT"       >> "$GITHUB_OUTPUT"
+          echo "tag_name=$TAG"          >> "$GITHUB_OUTPUT"
+          echo "Building ${{ inputs.platform }} at $REF -> release tag $TAG"
+
   buildroot:
     name: Firmware (${{inputs.platform}})
+    needs: resolve
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout source
         uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.ref }}
 
       - name: Prepare firmware
         run: |
@@ -30,6 +56,10 @@ jobs:
           key: ${{inputs.platform}}-${{env.CACHE_DATE}}
 
       - name: Build firmware
+        env:
+          BUILD_ID:       ${{ needs.resolve.outputs.tag_name }}
+          BUILD_SHA:      ${{ needs.resolve.outputs.ref }}
+          BUILD_PLATFORM: ${{ inputs.platform }}
         run: |
           export GIT_HASH=$(git rev-parse --short ${GITHUB_SHA})
           export GIT_BRANCH=${GITHUB_REF_NAME}
@@ -40,7 +70,20 @@ jobs:
           ln -s /tmp/ccache ${HOME}/.ccache
 
           NAME=${{inputs.platform}}
-          bash builder.sh ${NAME}
+          # Retry budget for transient upstream toolchain/CDN flakes
+          # (matches master.yml + OpenIPC/firmware/build-one.yml).
+          backoffs="30 60 120 300 600 1200"
+          attempt=1
+          for sleep_for in $backoffs ""; do
+            bash builder.sh ${NAME} && break
+            if [ -z "$sleep_for" ]; then
+              echo "::error::build failed after ${attempt} attempts"
+              exit 1
+            fi
+            echo "::warning::attempt ${attempt} failed, retrying after ${sleep_for}s"
+            sleep "$sleep_for"
+            attempt=$((attempt + 1))
+          done
           cd openipc
 
           TIME=$(date -d @${SECONDS} +%M:%S)
@@ -75,7 +118,13 @@ jobs:
         if: env.NORFW || env.NANDFW
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{env.TAG_NAME}}
+          tag_name: ${{ needs.resolve.outputs.tag_name }}
+          prerelease: true
+          body: |
+            sha=${{ needs.resolve.outputs.ref }}
+            short=${{ needs.resolve.outputs.short_sha }}
+            platform=${{ inputs.platform }}
+            one_off=true
           files: |
             ${{env.NORFW}}
             ${{env.NANDFW}}