Files
openipc-builder/.github/workflows/build-one.yml
T
910c6326a3 ci: cache Buildroot dl/ at /tmp/builder-dl (mirrors firmware's dl cache) (#96)
OpenIPC/firmware/.github/workflows/build.yml has a `output/dl` cache
step that mirrors the Buildroot download directory across runs. This
saves both runner-minutes and — importantly — masks transient upstream
mirror failures: once any cron has cached the canonical tarball for a
package, every subsequent run reuses it regardless of whether the
primary URL is healthy that day.

builder's master.yml + build-one.yml had no equivalent. Each cron run
fully re-downloads the entire dl/ tree, so every package's upstream
must be healthy in every run. Hit hard 2026-05-24 by
wireguard-tools-1.0.20210914.tar.xz: it's served from a cgit
`snapshot/` URL on git.zx2c4.com which regenerates the tarball
per-request with shifting sha256, and `sources.buildroot.net` also
served drifted bytes — see kaeru
'wireguard-zx2c4-tarball-regeneration-hash-drift'. Result: random
matrix entries fail with hash mismatches each cron, with selection
roulette-style (93 boards enable wireguard; on any given run a few
roll snake-eyes on the download).

Mirror firmware's pattern with one wrinkle: builder.sh does
`rm -rf openipc` at the top of every run to force a clean re-clone of
firmware, which would obliterate `openipc/output/dl/` if we cached the
default path. Cache `/tmp/builder-dl` instead (outside the openipc
tree) and point Buildroot at it via BR2_DL_DIR env var, honored per
Buildroot manual section "Location of source tarballs". Same restore +
save lifecycle as firmware's, same monthly key shape.

Effect:
  - First cron after merge: full download as usual; warms /tmp/builder-dl.
  - Subsequent crons: instant cache hit for unchanged packages; only
    re-download for version bumps. Removes the wireguard-roulette class
    of failure entirely once cache is populated.

build-one.yml gets the same treatment so single-board dispatches share
the cache pool.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-24 21:42:11 +03:00

147 lines
4.9 KiB
YAML

name: build-one
on:
workflow_dispatch:
inputs:
platform:
description: 'Platform to build (e.g. hi3518ev200_lite_switcam-hs303-v2)'
required: true
commit:
description: 'Builder commit SHA to build (optional; defaults to current branch HEAD). Use this from `git bisect run` or for one-off historic rebuilds.'
required: false
firmware_ref:
description: 'OpenIPC/firmware ref (SHA/tag/branch) to clone — for cross-repo bisect of size/regression issues. Defaults to firmware HEAD.'
required: false
jobs:
resolve:
name: Resolve commit
runs-on: ubuntu-latest
outputs:
ref: ${{ steps.r.outputs.ref }}
short_sha: ${{ steps.r.outputs.short_sha }}
tag_name: ${{ steps.r.outputs.tag_name }}
steps:
- id: r
run: |
REF="${{ inputs.commit }}"
[ -z "$REF" ] && REF="${{ github.sha }}"
SHORT="$(printf '%s' "$REF" | cut -c1-7)"
if [ -n "${{ inputs.commit }}" ]; then
TAG="nightly-bisect-${SHORT}"
else
TAG="nightly-bisect-${SHORT}-$(date -u +%Y%m%d%H%M%S)"
fi
echo "ref=$REF" >> "$GITHUB_OUTPUT"
echo "short_sha=$SHORT" >> "$GITHUB_OUTPUT"
echo "tag_name=$TAG" >> "$GITHUB_OUTPUT"
echo "Building ${{ inputs.platform }} at $REF -> release tag $TAG"
buildroot:
name: Firmware (${{inputs.platform}})
needs: resolve
runs-on: ubuntu-latest
steps:
- name: Checkout source
uses: actions/checkout@v4
with:
ref: ${{ needs.resolve.outputs.ref }}
- name: Prepare firmware
run: |
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf
echo CACHE_DATE=$(date +%m) >> ${GITHUB_ENV}
- name: Setup ccache
uses: actions/cache@v4
with:
path: /tmp/ccache
key: ${{inputs.platform}}-${{env.CACHE_DATE}}
# See master.yml for the rationale — builder.sh rm -rf's openipc/
# every run, so dl/ has to live outside via BR2_DL_DIR.
- name: Setup dl cache
uses: actions/cache@v4
with:
path: /tmp/builder-dl
key: builder-dl-${{env.CACHE_DATE}}
restore-keys: builder-dl-
- name: Build firmware
env:
BUILD_ID: ${{ needs.resolve.outputs.tag_name }}
BUILD_SHA: ${{ needs.resolve.outputs.ref }}
BUILD_PLATFORM: ${{ inputs.platform }}
OPENIPC_FW_REV: ${{ inputs.firmware_ref }}
run: |
export GIT_HASH=$(git rev-parse --short ${GITHUB_SHA})
export GIT_BRANCH=${GITHUB_REF_NAME}
echo GIT_HASH=${GIT_HASH} >> ${GITHUB_ENV}
echo GIT_BRANCH=${GIT_BRANCH} >> ${GITHUB_ENV}
mkdir -p /tmp/ccache
ln -s /tmp/ccache ${HOME}/.ccache
mkdir -p /tmp/builder-dl
export BR2_DL_DIR=/tmp/builder-dl
NAME=${{inputs.platform}}
# Retry budget for transient upstream toolchain/CDN flakes
# (matches master.yml + OpenIPC/firmware/build-one.yml).
backoffs="30 60 120 300 600 1200"
attempt=1
for sleep_for in $backoffs ""; do
bash builder.sh ${NAME} && break
if [ -z "$sleep_for" ]; then
echo "::error::build failed after ${attempt} attempts"
exit 1
fi
echo "::warning::attempt ${attempt} failed, retrying after ${sleep_for}s"
sleep "$sleep_for"
attempt=$((attempt + 1))
done
cd openipc
TIME=$(date -d @${SECONDS} +%M:%S)
echo TIME=${TIME} >> ${GITHUB_ENV}
COMMON=$(echo ${NAME} | awk -F_ '{print NF-1}')
NORFW=$(find output/images -name openipc*nor*)
if [ ! -z ${NORFW} ]; then
if [ ${COMMON} -eq 1 ]; then
echo NORFW=openipc/${NORFW} >> ${GITHUB_ENV}
else
mv ${NORFW} ../${NAME}-nor.tgz
echo NORFW=${NAME}-nor.tgz >> ${GITHUB_ENV}
fi
fi
NANDFW=$(find output/images -name openipc*nand*)
if [ ! -z ${NANDFW} ]; then
if [ ${COMMON} -eq 1 ]; then
echo NANDFW=openipc/${NANDFW} >> ${GITHUB_ENV}
else
mv ${NANDFW} ../${NAME}-nand.tgz
echo NANDFW=${NAME}-nand.tgz >> ${GITHUB_ENV}
fi
fi
if [ -z ${NORFW} ] && [ -z ${NANDFW} ]; then
exit 1
fi
- name: Upload firmware
if: env.NORFW || env.NANDFW
uses: softprops/action-gh-release@v2
with:
tag_name: ${{ needs.resolve.outputs.tag_name }}
prerelease: true
body: |
sha=${{ needs.resolve.outputs.ref }}
short=${{ needs.resolve.outputs.short_sha }}
platform=${{ inputs.platform }}
one_off=true
files: |
${{env.NORFW}}
${{env.NANDFW}}