Ci1 by liviutomoiaga · Pull Request #3299 · analogdevicesinc/linux

liviutomoiaga · 2026-04-29T13:39:46Z

PR Description

This PR adds CI workflows and scripts for preparing and deploying Linux build artifacts to Cloudsmith:

RPI Artifacts: New workflow and script to prepare Raspberry Pi boot files and kernel modules (32-bit and 64-bit), package them as tar.gz
archives, and upload to Cloudsmith
SDG Linux Artifacts: New workflow and scripts to prepare SDG Linux artifacts (ARM, ARM64, Microblaze) with proper directory structure,
kernel images, DTBs, and git metadata
Upload to Cloudsmith: Enhanced to support input variable for Cloudsmith repository

PR Type

Bug fix (a change that fixes an issue)
New feature (a change that adds new functionality)
Breaking change (a change that affects other repos or cause CIs to fail)

PR Checklist

I have conducted a self-review of my own code changes
I have compiled my changes, including the documentation
I have tested the changes on the relevant hardware
I have updated the documentation outside this repo accordingly
I have provided links for the relevant upstream lore

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

Signed-off-by: Andreea Andrisan <Andreea.Andrisan@analog.com>

liviutomoiaga · 2026-04-29T13:40:44Z

Some tests are still running, but the implementation and the code can be reviewed

gastmaier

Will look more in depth later.
but take a look at
https://github.com/analogdevicesinc/linux-security-vulns/blob/ci/.github/workflows/check-artifact.yml#L70-L78

I use the same ci/download_artifacts.sh to get the artifacts I need and manipulate to my wish -> check cve
my wish could be gen a boot partition at adi-kuiper-gen

gastmaier · 2026-04-29T14:26:10Z

+        type: string
+      version:
+        required: false
+        default: ${{ github.sha }}


this changes the default for /linux from 12 chars to the full 40 chars.
I was considering to default to 40 chars, maybe we can merge and see where it breaks

gastmaier · 2026-04-29T14:27:19Z

@@ -0,0 +1,264 @@
+#!/bin/bash


this is mostly
https://github.com/analogdevicesinc/linux/blob/ci/ci/download_artifacts.sh
no?
Why not source download_artifacts.sh and just use another 'main' method (if any change required)

Why I had the feeling that this implementation was only on ci_adapter branch🤔 ? My mistake in this case.

Still, I would suggest to keep the logic apart since the name of the script is download_artifacts.sh and it's not really intuitive from this pov ( just a personal opinion. PS: I think I can come with a better name😅 )

gastmaier · 2026-04-29T14:30:26Z

@@ -0,0 +1,181 @@
+# SPDX-License-Identifier: GPL-2.0-only


This is kuiper-linux boot partition logic no? why can't adi-kuiper-gen do this step on their end?

I do not think so. This script mimics the logic from this one and I'm not sure if it can be added as an end step on adi-kuiper-gen, since the flow needs the artifacts from linux-rpi build. Maybe I'm missing something here, but this is my understanding so far

gastmaier · 2026-04-29T14:33:37Z

@@ -0,0 +1,294 @@
+#!/bin/bash


Also looks like adi-kuiper-gen logic

gastmaier · 2026-04-29T14:36:14Z

+    cat > "${output_dir}/extlinux.conf" <<EOF
+            LABEL Linux Default
+            KERNEL ../zImage
+            FDT ../${dtb_name}
+            APPEND root=/dev/mmcblk0p2 rw rootwait earlyprintk console=ttyS0,115200n8


Also adi-kuiper-gen logic
here we are saying how to boot, beyond dtb_name it is identical to the end of times.

gastmaier · 2026-04-29T14:37:05Z

@@ -0,0 +1,285 @@
+name: Prepare and Upload to Cloudsmith RPI Artifacts


Feels duplicated... all because of the kuiper logic...

gastmaier · 2026-04-29T14:44:04Z

+
+jobs:
+  prepare_and_upload_sdg_linux_artefacts:
+    runs-on: [self-hosted, repo-only]


ubuntu-slim is more suitable, only fast internet is needed

gastmaier · 2026-04-29T14:45:00Z

+    - uses: analogdevicesinc/doctools/checkout@action
+
+    - name: Prepare path
+      run: |
+        rm -rf dist ; mkdir dist


No need to checkout, you don't use anything from the linux git tree at this job

gastmaier · 2026-05-04T10:51:56Z

Hi @liviutomoiaga did you have the opportunity to go through my review?

gastmaier

some more comments

gastmaier · 2026-05-05T06:45:05Z

+
+permissions:
+  id-token: write
+  contents: write


Suggested change

contents: write

contents: read

gastmaier · 2026-05-05T06:45:20Z

+
+permissions:
+  id-token: write
+  contents: write


Suggested change

contents: write

contents: read

gastmaier · 2026-05-05T06:46:21Z

+      actions: read
+
+    steps:
+    - uses: analogdevicesinc/doctools/checkout@action


Suggested change

- uses: analogdevicesinc/doctools/checkout@action

No need to checkout, you get the files that you need on line 59

gastmaier · 2026-05-05T06:47:45Z

+        echo "Verifying script content:"
+        head -3 ci/prepare_rpi_artifacts.sh
+        if [[ ! -s ci/prepare_rpi_artifacts.sh ]] || ! head -1 ci/prepare_rpi_artifacts.sh | grep -q "^#"; then
+          echo "ERROR: Script download failed or invalid content"


Suggested change

echo "ERROR: Script download failed or invalid content"

echo "::error ::deploy-rpi-artifacts: Script download failed or invalid content."

I have been using gh-annotation to surface errors to the summary view of the run
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands

Nice tip 👀

gastmaier · 2026-05-05T06:49:24Z

@@ -0,0 +1,207 @@
+name: Deploy SDG Linux Artifacts to Cloudsmith


see https://github.com/analogdevicesinc/linux/blob/ci-adapter/.github/workflows/expand-to-cloudsmith.yml

why not unify 'xlnx' and 'rpi' in to single .yml and .sh scripts, and 'activate' the differences based on the ${{ github.ref }} value?

We destroying the kernel modules is a mistake on the 'xlnx' path is a mistake, unifying them allows to better compare the difference and mitigate the historical shortcomings.

I'll add new flow that unifies deploy-sdg-linux-artifacts.yml and deploy_rpi_artifacts.yml. The logic will be handled by a new a new input artifact-type

Update: artifact-type is not a valid solution. To many branches to be updated and having another parameter to configure may be more error prone. Using github.ref_name is a better solution.

gastmaier · 2026-05-05T06:53:07Z

+      artifacts:
+        required: true
+        type: string
+      CLOUDSMITH_REPO:


github semantic are lower case, dash separated for inputs, e.g., cloudsmith-repo

Took care of it.

gastmaier · 2026-05-05T06:54:16Z

+        if [[ -n "${{ inputs.PR_NUMBER }}" ]]; then
+          export GIT_SHA="${{ github.event.pull_request.head.sha }}"
+        else
+          export GIT_SHA="${{ github.sha }}"
+        fi


Suggested change

if [[ -n "${{ inputs.PR_NUMBER }}" ]]; then

export GIT_SHA="${{ github.event.pull_request.head.sha }}"

else

export GIT_SHA="${{ github.sha }}"

fi

GIT_SHA="${{ github.event.pull_request.head.sha || github.sha }}"

gastmaier · 2026-05-05T07:03:12Z

+
+        # Build version path based on branch type
+        if [[ -n "${{ inputs.PR_TARGET_BRANCH }}" ]]; then
+          VERSION_PATH="linux/PRs/${{ inputs.PR_TARGET_BRANCH }}/pr_${{ inputs.PR_NUMBER }}"


There is mixing inputs with the github.context.
that is problematic

Suggested change

VERSION_PATH="linux/PRs/${{ inputs.PR_TARGET_BRANCH }}/pr_${{ inputs.PR_NUMBER }}"

pr=${{ github.ref }} # refs/pull/<pr_number>/merge

pr="${ref#refs/pull/}"

pr="${pr%/merge}"

VERSION_PATH="linux/PRs/${{ github.base_ref }}/pr_${pr}"

Tip: use github search to look for usage examples/inspiration:
https://github.com/search?q=path%3A.github%2Fworkflows+github.base_ref&type=code

Many thanks for the tip - that's really useful

gastmaier · 2026-05-05T07:03:52Z

+        MERGE_COMMIT_SHA=$(git rev-parse --short HEAD)
+        export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} | sed -e "s/ \|\:/-/g")


Suggested change

MERGE_COMMIT_SHA=$(git rev-parse --short HEAD)

export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} | sed -e "s/ \|\:/-/g")

export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${GIT_SHA} | sed -e "s/ \|\:/-/g")

In the previous line you said # Get git SHA (PR source commit or build commit) but then now you are considering only the MERGE_COMMIT_SHA case, but actually looking at head.

gastmaier · 2026-05-05T07:07:30Z

+        export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} | sed -e "s/ \|\:/-/g")
+
+        # Determine branch name (works for main, release/*, feature/*, etc.)
+        BRANCH_NAME=$(echo "${{ inputs.BUILD_SOURCEBRANCH }}" | awk -F'/' '{print $NF}')


${{ github.head_ref }}

gastmaier · 2026-05-05T07:08:59Z

+        default: 'sdg-linux'
+      BUILD_SOURCEBRANCH:
+        required: false
+        default: ${{ github.ref_name }}


${{ github.ref_name }}: For pull requests that were not merged, the format is <pr_number>/merge.
https://docs.github.com/en/actions/reference/workflows-and-actions/variables

gastmaier · 2026-05-05T07:15:47Z

Is this supposed for pull_request|push events, or workflow_dispatch too? This defines if you need the inputs. Or is better of using the gihtub context directly (most likely).

bia1708 · 2026-05-07T11:49:31Z

+
+
+jobs:
+  prepare_and_upload_sdg_linux_artefacts:


typo for "artifact"

bia1708 · 2026-05-07T11:52:01Z

+
+jobs:
+  prepare_and_upload_sdg_linux_artefacts:
+    runs-on: [self-hosted, repo-only]


can't we do cloud-hosted? Afaik you should be able to upload to cloudsmith from the cloud runners as well

ubuntu-slim ✅

bia1708 · 2026-05-07T11:53:21Z

+    - name: Get sources
+      run: |
+        file=$(echo "${{ github.workflow_ref }}" | cut -d'/' -f3- | cut -d'@' -f1)
+        workflow_ref=$(awk '


some comments would be nice

I think in the end, this fuzzy pull of workflow_ref metadata could be replaced by a simpler approach. I'll update the PR shortly.

bia1708 · 2026-05-07T11:59:16Z

+        get_file ci/prepare_sdg_linux_artifacts.sh
+        get_file ci/lib.sh
+        get_file ci/prepare_artifacts_structure.sh
+
+        chmod +x ci/*.sh


ideally, these files should be committed as executable (git update-index --chmod=+x script.sh)

yes, but apparently if you download a file via curl, as it is done now, executable bit is lost. so this won't be really helpful in my case

bia1708 · 2026-05-07T12:03:23Z

+    - name: Download workflow artifacts
+      run: |
+        gh-get-workflow-artifacts()
+        {


you should keep the same style across the script, curly bracket should be on L82

bia1708 · 2026-05-07T12:13:48Z

+# Configuration
+SOURCE_DIRECTORY="${SOURCE_DIRECTORY:-$(pwd)}"
+TIMESTAMP="${TIMESTAMP:-$(date +%Y_%m_%d-%H_%M_%S)}"
+BUILD_SOURCEBRANCHNAME="${BUILD_SOURCEBRANCHNAME:-main}"


maybe let's not use default for branch names

bia1708 · 2026-05-07T12:36:42Z

+        echo $workflow_ref
+
+        org_repo="$(echo "$workflow_ref" | cut -d'/' -f1-2)"
+        ref="$(echo "$workflow_ref" | cut -d'@' -f2)"


this is a bit of overengineering for things that will mostly stay static, e.g. org_repo would always be analogdevicesinc, right? And the ref should always be ci?

yes - https://github.com/analogdevicesinc/linux/pull/3299/changes#r3240872362

bia1708 · 2026-05-07T12:53:02Z

+        fi
+
+        source ci/lib.sh
+        source ci/prepare_artifacts_structure.sh


test if these sources are really needed (you already sourced them on L147)

Each pipeline step starts in a new session. Having only one source command in a previous step won't work for the rest of them.

bia1708 · 2026-05-07T12:55:12Z

+                               "$tags" \
+                               "$version" || exit 1
+        fi
+


extra newline

bia1708 · 2026-05-07T13:02:23Z

+    ["arria10"]="socfpga_adi_defconfig-gcc-arm/boot/zImage"
+    ["cyclone5"]="socfpga_adi_defconfig-gcc-arm/boot/zImage"
+    ["zynq"]="zynq_xcomm_adv7511_defconfig-gcc-arm/boot/uImage"
+    ["versal"]="adi_versal_defconfig-gcc-arm64/boot/Image"
+    ["zynqmp"]="adi_zynqmp_defconfig-gcc-arm64/boot/Image"


Maybe these can be replaced with regexes?

Here is a implementation with regex approach.

For Microblaze DTBs -> regex used (kc705|kcu105|vc707|vcu118|vcu128)

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

liviutomoiaga · 2026-05-12T07:57:57Z

Is this supposed for pull_request|push events, or workflow_dispatch too? This defines if you need the inputs. Or is better of using the gihtub context directly (most likely).

I was thinking to have the the following code block implemented in the top-level.yml from main branch. That's why I've added the inputs. Indeed, I'm not sure If I set the PR parameters by default in the deploy-sdg-linux-artifacts.yml will grab the needed values. I have to check that.

liviutomoiaga · 2026-05-12T08:03:01Z

Hi @liviutomoiaga did you have the opportunity to go through my review?

Hi @gastmaier I'm looking through it. There are some nice suggestions from your side and from @bia1708 that I would like to test. I'll set this PR to Draft for the moment.

Consolidate the separate Kuiper and RPI artifact deployment workflows into a single unified workflow, reducing duplication and simplifying maintenance. Changes: - Merge deploy-sdg-linux-artifacts.yml and deploy_rpi_artifacts.yml into deploy_linux_artifacts.yml with conditional RPI processing - Rename prepare_sdg_linux_artifacts.sh to expand_kernel_images.sh for clarity (handles DTB unpacking and microblaze/nios2 image expansion) - Replace prepare_artifacts_structure.sh with cleaner prepare_kuiper_artifacts_structure.sh - Add lib_github.sh with shared GitHub Actions helper functions - Update prepare_rpi_artifacts.sh to work with the unified flow - Add comments explaining non-obvious logic (DTB embedding, overlay renaming, platform mapping) Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

liviutomoiaga · 2026-05-15T08:31:56Z

Hi @gastmaier @bia1708 ,

Most of previous findings/questions/suggestions were addressed.

Here are the key-differences between implementation:

inputs.scripts-ref : Allows overriding which branch CI scripts are fetched from, replacing the logic of using workflow_ref. Useful for testing or cross-branch script reuse. It defaults to ci if not used

Single unified deploy_linux_artifacts.yml for deploy-sdg-linux-artifacts.yml + deploy_rpi_artifacts.yml. Uses conditional RPI processing within the unified workflow based on github.ref

Script naming: from prepare_sdg_linux_artifacts.sh -> expand_kernel_images.sh | prepare_artifacts_structure.sh -> prepare_kuiper_artifacts_structure.sh

Introduce lib_github.sh -> centralizes GitHub artifact operations (download, extraction, versioning) that were previously duplicated across workflows. maybe it's worth it use it in other flows as well (looks also a bit more cleaner)

The Kernel images and DTBs are re-organized in a structured way based on arch type using a regex approach. Now the summary is generated via tree -> code block

Regarding your comment @gastmaier I added expand_kernel_images.sh as a separate script to follow single responsibility principle, download_artifacts.sh already has a clear purpose reflected in its name. Mixing in kernel image expansion would make the script less intuitive to navigate and maintain.

About kuiper-logic, comment1 and comment2 here maybe I have additional questions:

Why should the logic be separated now from linux, since it is already present in the main branch -> prepare_artifacts.sh ?
Won't these separation break our current flow for boot-partition ? ( @bia1708 )

Here are some examples how to use them on top-level.yml - product delimitation implemented on this step :

linux -> deploy_kuiper_binaries -> uploads to Cloudsmith repo: sdg-linux

rpi -> deploy_rpi_artifacts -> uploads to Cloudsmith repo: sdg-linux-rpi

liviutomoiaga and others added 3 commits April 29, 2026 16:32

ci: prepare_rpi_artefacts: Prepare RPI artefacts

68e6b6c

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

ci: prepare_sdg_artefacts: Prepare and deploy SDG Linux Artefacts

3bfc218

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

ci: upload_to_cloudsmith: Use input variable if provided

9b341e5

Signed-off-by: Andreea Andrisan <Andreea.Andrisan@analog.com>

liviutomoiaga requested review from bia1708 and gastmaier April 29, 2026 13:39

gastmaier added the llm review Request a review from a LLM Reviewer label Apr 29, 2026

gastmaier reviewed Apr 29, 2026

View reviewed changes

gastmaier requested changes Apr 29, 2026

View reviewed changes

gastmaier removed the llm review Request a review from a LLM Reviewer label Apr 29, 2026

gastmaier force-pushed the ci branch 2 times, most recently from 42812d4 to e8058b2 Compare May 4, 2026 10:45

gastmaier reviewed May 5, 2026

View reviewed changes

bia1708 requested changes May 7, 2026

View reviewed changes

Fix review findings

ce43926

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

liviutomoiaga marked this pull request as draft May 12, 2026 08:03

liviutomoiaga changed the title ~~Ci1~~ Ci1 - In progress - test and updates to be done May 12, 2026

liviutomoiaga changed the title ~~Ci1 - In progress - test and updates to be done~~ Ci1 May 15, 2026

liviutomoiaga requested review from bia1708 and gastmaier May 15, 2026 08:45

liviutomoiaga marked this pull request as ready for review May 15, 2026 09:15

		@@ -0,0 +1,285 @@
		name: Prepare and Upload to Cloudsmith RPI Artifacts

	echo "ERROR: Script download failed or invalid content"
	echo "::error ::deploy-rpi-artifacts: Script download failed or invalid content."

		@@ -0,0 +1,207 @@
		name: Deploy SDG Linux Artifacts to Cloudsmith

-          VERSION_PATH="linux/PRs/${{ inputs.PR_TARGET_BRANCH }}/pr_${{ inputs.PR_NUMBER }}"
+          pr=${{ github.ref }} # refs/pull/<pr_number>/merge
+          pr="${ref#refs/pull/}"
+          pr="${pr%/merge}"
+          VERSION_PATH="linux/PRs/${{ github.base_ref }}/pr_${pr}"

		MERGE_COMMIT_SHA=$(git rev-parse --short HEAD)
		export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} \| sed -e "s/ \\|\:/-/g")



		jobs:
		prepare_and_upload_sdg_linux_artefacts:

Conversation

liviutomoiaga commented Apr 29, 2026

PR Description

PR Type

PR Checklist

Uh oh!

liviutomoiaga commented Apr 29, 2026

Uh oh!

gastmaier left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gastmaier commented May 4, 2026

Uh oh!

gastmaier left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gastmaier commented May 5, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

gastmaier left a comment •

edited

Loading