When PR #1271 was merged (commit c34c8db4), it:
1. Created a new coverity-build target in src/Makefile
2. Updated .github/workflows/coverity.yml to call make coverity-build
3. Forgot to add coverity-build as an explicit target in the top-level Makefile
This commit also simplifies src/Makfile a lot for readability.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Let's give Coverity Scan its own make target so we can reuse 'make check'
for our own scan-build or cppcheck needs.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Release tarballs waste ~131MB per architecture by including both
rootfs.itb and rootfs.squashfs, even though rootfs.itb already
contains the squashfs (itb = 4096-byte header + squashfs).
This change removes rootfs.squashfs from releases and provides two
solutions for users who need it:
1. utils/extract-squashfs.sh - Full-featured utility for extracting
squashfs from release tarballs or .itb files. Includes validation
and helpful error messages.
2. board/common/qemu/qemu.sh - Auto-extraction support. When running
in initrd mode, automatically extracts rootfs.squashfs from
rootfs.itb if missing. Zero user impact - ./qemu.sh just works!
Space savings: ~262MB per release (2 architectures × 131MB)
Fixes#858
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prevent patch releases from stealing the "latest" tag from newer minor
versions. Only vXX.YY and vXX.YY.0 releases should be marked as latest.
Fixes#1187
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Collect only the most relevant info for SBOM. The CycloneDX format seems
to be what most tools are standardizing around, and they suggest saving
manifest.csv and cpe.json files. This commit includes all *.csv files
and drops sources and licenses for release builds, as decided in #1192Fixes#1217resolves#1192
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow a workflow caller to run pre-build scripts though a workflow
call variable. This is potentially dangerous as code can be injected
here. If for example a malicious actor wants to run there C2 code in
the context of someone else they could perhaps inject it here. I
assume this is protected by the same mecahism as the workflow files
themself. I.e. github users untrusted to the Infix org won't be able
to trigger workflows before being explicitly allowed to do so.
This patch also adds a checkout secret. This allows upstream callers
to fetch there own spin / fork though the infix workflows, if they
provide a checkout token with the correct permissions to do so.
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit consolidates mkimage.sh scripts into a unified SD card image
creation tool that works for all boards. It needs a bootloader an $ARCH
rootfs.squashfs image and a genimage.cfg.in template.
- Detects build directories from `O=` environment variable or `output/`
- Sources `.config` to discover Buildroot paths
- Uses Buildroot's `support/scripts/genimage.sh` when available
- Automatically generates `.bmap` files if `bmaptool` is available
- Fallback to direct `genimage` invocation if wrapper not found
See the online instructions for usage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the additional support for RPi3, including Zero 2W, this commit renames
all relevant directories and Config.In options to match.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This will fix#1106, in time, but only allows manual trigger for now,
needs more test and verification
utils/kernel-upgrade.sh at least automate all the manual manual processes
for upgrading the kernel.
Addresses disk space issues in GitHub Actions for generic x86_64 builds
by removing unused tools (Android SDK, .NET, Docker images, etc.) before
the build starts. This frees up ~30GB of space.
Fixes#1210
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With all jobs now depending on check-trigger we can do the evaluations
there and set some variables that can be reused later.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Here we use a check-trigger job that all the others depend on, which
should prevent duplicate workflows starting a bit more elegantly than
killing one of them with the concurrency checker.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is currently a standalone workflow that needs manual trigger via
workflow_dispatch, but the end goal here is to chain it to the release
job.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add concurrency control to trigger workflow to cancel in-progress builds
when new events (like adding ci:main label) occur on the same PR. This
prevents resource waste from duplicate builds and handles the common
workflow where developers add the ci:main label after PR creation.
Fixes#1154
It should be possible to create test reports manually, so logically
the GitHub workflow should call a make rule in test.mk
Untested: branding, or any case where Infix is used as a BR2_EXTERNAL
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This branch can be used to test push events which is especially
useful when working on the CI infrastructure.
Signed-off-by: Richard Alpe <richard@bit42.se>
There are 2 main reasons for this:
1) It's almost impossible to write complex logical expressions in GH
workflows. I wanted to pass "" as flavor when not building _minimal.
So that the end target string would become TARGET + FLAVOR where
FLAVOR is empty, making it x86_64 for example.
As it turns out "" is false in GH workflow logical expressions, this
in conjunction with the limitations the interpreter has made it hard
to actually write sane expressions in the "with:" variables when
calling downstream jobs via workflow calls.
Here's an example of what I was trying to do and could not:
with:
flavor: ${{ (
github.event_name == 'pull_request' &&
contains(github.event.pull_request.labels.*.name, 'ci:main')
) && '' || '_minimal' }}
As '' is false, the first sets of expressions always evaluates to
false making the string "_minimal". I tried bracing this in various
ways and to use "null" or various JSON objects, all in vain.
2) It reduces complexity instead of adding additional.
Signed-off-by: Richard Alpe <richard@bit42.se>
Mattias Walström