OpenIPC/firmware/.github/workflows/build.yml has a `output/dl` cache
step that mirrors the Buildroot download directory across runs. This
saves both runner-minutes and — importantly — masks transient upstream
mirror failures: once any cron has cached the canonical tarball for a
package, every subsequent run reuses it regardless of whether the
primary URL is healthy that day.
builder's master.yml + build-one.yml had no equivalent. Each cron run
fully re-downloads the entire dl/ tree, so every package's upstream
must be healthy in every run. Hit hard 2026-05-24 by
wireguard-tools-1.0.20210914.tar.xz: it's served from a cgit
`snapshot/` URL on git.zx2c4.com which regenerates the tarball
per-request with shifting sha256, and `sources.buildroot.net` also
served drifted bytes — see kaeru
'wireguard-zx2c4-tarball-regeneration-hash-drift'. Result: random
matrix entries fail with hash mismatches each cron, with selection
roulette-style (93 boards enable wireguard; on any given run a few
roll snake-eyes on the download).
Mirror firmware's pattern with one wrinkle: builder.sh does
`rm -rf openipc` at the top of every run to force a clean re-clone of
firmware, which would obliterate `openipc/output/dl/` if we cached the
default path. Cache `/tmp/builder-dl` instead (outside the openipc
tree) and point Buildroot at it via BR2_DL_DIR env var, honored per
Buildroot manual section "Location of source tarballs". Same restore +
save lifecycle as firmware's, same monthly key shape.
Effect:
- First cron after merge: full download as usual; warms /tmp/builder-dl.
- Subsequent crons: instant cache hit for unchanged packages; only
re-download for version bumps. Removes the wireguard-roulette class
of failure entirely once cache is populated.
build-one.yml gets the same treatment so single-board dispatches share
the cache pool.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
147 lines
4.9 KiB
YAML
147 lines
4.9 KiB
YAML
name: build-one
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
platform:
|
|
description: 'Platform to build (e.g. hi3518ev200_lite_switcam-hs303-v2)'
|
|
required: true
|
|
commit:
|
|
description: 'Builder commit SHA to build (optional; defaults to current branch HEAD). Use this from `git bisect run` or for one-off historic rebuilds.'
|
|
required: false
|
|
firmware_ref:
|
|
description: 'OpenIPC/firmware ref (SHA/tag/branch) to clone — for cross-repo bisect of size/regression issues. Defaults to firmware HEAD.'
|
|
required: false
|
|
|
|
jobs:
|
|
resolve:
|
|
name: Resolve commit
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
ref: ${{ steps.r.outputs.ref }}
|
|
short_sha: ${{ steps.r.outputs.short_sha }}
|
|
tag_name: ${{ steps.r.outputs.tag_name }}
|
|
steps:
|
|
- id: r
|
|
run: |
|
|
REF="${{ inputs.commit }}"
|
|
[ -z "$REF" ] && REF="${{ github.sha }}"
|
|
SHORT="$(printf '%s' "$REF" | cut -c1-7)"
|
|
if [ -n "${{ inputs.commit }}" ]; then
|
|
TAG="nightly-bisect-${SHORT}"
|
|
else
|
|
TAG="nightly-bisect-${SHORT}-$(date -u +%Y%m%d%H%M%S)"
|
|
fi
|
|
echo "ref=$REF" >> "$GITHUB_OUTPUT"
|
|
echo "short_sha=$SHORT" >> "$GITHUB_OUTPUT"
|
|
echo "tag_name=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "Building ${{ inputs.platform }} at $REF -> release tag $TAG"
|
|
|
|
buildroot:
|
|
name: Firmware (${{inputs.platform}})
|
|
needs: resolve
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ needs.resolve.outputs.ref }}
|
|
|
|
- name: Prepare firmware
|
|
run: |
|
|
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf
|
|
echo CACHE_DATE=$(date +%m) >> ${GITHUB_ENV}
|
|
|
|
- name: Setup ccache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: /tmp/ccache
|
|
key: ${{inputs.platform}}-${{env.CACHE_DATE}}
|
|
|
|
# See master.yml for the rationale — builder.sh rm -rf's openipc/
|
|
# every run, so dl/ has to live outside via BR2_DL_DIR.
|
|
- name: Setup dl cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: /tmp/builder-dl
|
|
key: builder-dl-${{env.CACHE_DATE}}
|
|
restore-keys: builder-dl-
|
|
|
|
- name: Build firmware
|
|
env:
|
|
BUILD_ID: ${{ needs.resolve.outputs.tag_name }}
|
|
BUILD_SHA: ${{ needs.resolve.outputs.ref }}
|
|
BUILD_PLATFORM: ${{ inputs.platform }}
|
|
OPENIPC_FW_REV: ${{ inputs.firmware_ref }}
|
|
run: |
|
|
export GIT_HASH=$(git rev-parse --short ${GITHUB_SHA})
|
|
export GIT_BRANCH=${GITHUB_REF_NAME}
|
|
echo GIT_HASH=${GIT_HASH} >> ${GITHUB_ENV}
|
|
echo GIT_BRANCH=${GIT_BRANCH} >> ${GITHUB_ENV}
|
|
|
|
mkdir -p /tmp/ccache
|
|
ln -s /tmp/ccache ${HOME}/.ccache
|
|
|
|
mkdir -p /tmp/builder-dl
|
|
export BR2_DL_DIR=/tmp/builder-dl
|
|
|
|
NAME=${{inputs.platform}}
|
|
# Retry budget for transient upstream toolchain/CDN flakes
|
|
# (matches master.yml + OpenIPC/firmware/build-one.yml).
|
|
backoffs="30 60 120 300 600 1200"
|
|
attempt=1
|
|
for sleep_for in $backoffs ""; do
|
|
bash builder.sh ${NAME} && break
|
|
if [ -z "$sleep_for" ]; then
|
|
echo "::error::build failed after ${attempt} attempts"
|
|
exit 1
|
|
fi
|
|
echo "::warning::attempt ${attempt} failed, retrying after ${sleep_for}s"
|
|
sleep "$sleep_for"
|
|
attempt=$((attempt + 1))
|
|
done
|
|
cd openipc
|
|
|
|
TIME=$(date -d @${SECONDS} +%M:%S)
|
|
echo TIME=${TIME} >> ${GITHUB_ENV}
|
|
COMMON=$(echo ${NAME} | awk -F_ '{print NF-1}')
|
|
|
|
NORFW=$(find output/images -name openipc*nor*)
|
|
if [ ! -z ${NORFW} ]; then
|
|
if [ ${COMMON} -eq 1 ]; then
|
|
echo NORFW=openipc/${NORFW} >> ${GITHUB_ENV}
|
|
else
|
|
mv ${NORFW} ../${NAME}-nor.tgz
|
|
echo NORFW=${NAME}-nor.tgz >> ${GITHUB_ENV}
|
|
fi
|
|
fi
|
|
|
|
NANDFW=$(find output/images -name openipc*nand*)
|
|
if [ ! -z ${NANDFW} ]; then
|
|
if [ ${COMMON} -eq 1 ]; then
|
|
echo NANDFW=openipc/${NANDFW} >> ${GITHUB_ENV}
|
|
else
|
|
mv ${NANDFW} ../${NAME}-nand.tgz
|
|
echo NANDFW=${NAME}-nand.tgz >> ${GITHUB_ENV}
|
|
fi
|
|
fi
|
|
|
|
if [ -z ${NORFW} ] && [ -z ${NANDFW} ]; then
|
|
exit 1
|
|
fi
|
|
|
|
- name: Upload firmware
|
|
if: env.NORFW || env.NANDFW
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ needs.resolve.outputs.tag_name }}
|
|
prerelease: true
|
|
body: |
|
|
sha=${{ needs.resolve.outputs.ref }}
|
|
short=${{ needs.resolve.outputs.short_sha }}
|
|
platform=${{ inputs.platform }}
|
|
one_off=true
|
|
files: |
|
|
${{env.NORFW}}
|
|
${{env.NANDFW}}
|