test(ci): exercise fork premerge distro validation - #90
Open
Bjordis Collaku (bjordiscollaku) wants to merge 122 commits into
Open
Conversation
Implements a complete CI/CD pipeline for mirroring and building the
Canonical Ubuntu kernel source package from Launchpad, targeting the
arm64 architecture on Ubuntu 24.04 LTS.
Repository branch layout:
main - CI infrastructure (workflows, scripts, documentation)
<series> - Orphan branch per Ubuntu series containing the full
extracted kernel source tree (one commit per upload)
e.g. noble branch for Ubuntu Noble 24.04 LTS
Workflows (.github/workflows/):
fetch-source-pkg.yml
- Queries the Launchpad REST API (api.launchpad.net/1.0) for the
latest published linux source package for the given series
- Downloads .dsc, .orig.tar.gz, .debian.tar.xz from Launchpad
- Extracts the full patched source tree via dpkg-source -x
- Commits the complete kernel source to the series branch
- Tags each commit as <series>-<version> (e.g. noble-6.8.0-51.52)
- Idempotent: skips if the tag already exists
- Auto-dispatches build-kernel.yml on each new version
- Schedule: daily 04:00 UTC
- Runner: self-hosted lecore-prd-u2404-arm64-xlrg-od-ephem
build-kernel.yml
- Checks out the series branch (full kernel source tree)
- Installs build dependencies via apt-get build-dep
- Native arm64 build: fakeroot debian/rules binary-<flavor>
- No cross-compilation required (runner is arm64)
- Uploads built .deb packages as:
* GitHub Actions artifact (90-day retention)
* GitHub Release asset on the <series>-<version> tag (permanent)
- Runner: self-hosted lecore-prd-u2404-arm64-xlrg-od-ephem
mirror-git.yml (optional)
- Mirrors the full Launchpad kernel git history to a separate
GitHub repository (qualcomm-linux/linux-noble)
- Incremental sync: clones from GitHub mirror then fetches delta
from Launchpad; full clone only on first run
- Schedule: daily 03:00 UTC
- Runner: self-hosted lecore-prd-u2404-arm64-xlrg-od-ephem
Helper scripts (scripts/):
check-version.sh - Query latest published version from Launchpad API
fetch-source-pkg.sh - Download source package files from Launchpad
build-kernel-deb.sh - Build kernel .deb packages locally (arm64 native)
Active series: noble (Ubuntu 24.04 LTS, kernel 6.8)
Future series: questing, resolute (added on demand via workflow input)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Implements a complete CI/CD pipeline for mirroring and building the
Canonical Ubuntu kernel source package from Launchpad, targeting the
arm64 architecture on Ubuntu 24.04 LTS.
Repository branch layout:
main - CI infrastructure (workflows, scripts, documentation)
<series> - Orphan branch per Ubuntu series containing the full
extracted kernel source tree (one commit per upload)
e.g. noble branch for Ubuntu Noble 24.04 LTS
Workflows (.github/workflows/):
fetch-source-pkg.yml
- Queries the Launchpad REST API for the latest published linux
source package for the given series
- Downloads .dsc, .orig.tar.gz, .debian.tar.xz from Launchpad
- Extracts the full patched source tree via dpkg-source -x
- Commits the complete kernel source to the series branch
- Tags each commit as <series>-<version> (e.g. noble-6.8.0-51.52)
- Idempotent: skips if the tag already exists
- Auto-dispatches build-kernel.yml on each new version
- Schedule: daily 04:00 UTC
- Runner: self-hosted lecore-prd-u2404-arm64-xlrg-od-ephem
build-kernel.yml
- Checks out the series branch (full kernel source tree)
- Installs build dependencies via apt-get build-dep
- Native arm64 build: fakeroot debian/rules binary-<flavor>
- No cross-compilation required (runner is arm64)
- Uploads built .deb packages as:
* GitHub Actions artifact (90-day retention)
* GitHub Release asset on the <series>-<version> tag (permanent)
- Runner: self-hosted lecore-prd-u2404-arm64-xlrg-od-ephem
Helper scripts (scripts/):
check-version.sh - Query latest published version from Launchpad API
fetch-source-pkg.sh - Download source package files from Launchpad
build-kernel-deb.sh - Build kernel .deb packages locally (arm64 native)
Active series: noble (Ubuntu 24.04 LTS, kernel 6.8)
Future series: questing, resolute (added on demand via workflow input)
Implements a complete CI/CD pipeline for mirroring and building the
Canonical Ubuntu kernel source package from Launchpad, targeting the
arm64 architecture on Ubuntu 24.04 LTS.
Repository branch layout:
main - CI infrastructure (workflows, scripts, documentation)
<suite> - Orphan branch per Ubuntu suite containing the full
extracted kernel source tree (one commit per upload)
e.g. noble branch for Ubuntu Noble 24.04 LTS
Workflows (.github/workflows/):
fetch-source-pkg.yml
- Queries the Launchpad REST API for the latest published linux
source package for the given suite
- Downloads .dsc, .orig.tar.gz, .debian.tar.xz from Launchpad
- Extracts the full patched source tree via dpkg-source -x
- Commits the complete kernel source to the suite branch
- Tags each commit as <suite>-<version> (e.g. noble-6.8.0-51.52)
- Idempotent: skips if the tag already exists
- Auto-dispatches build-kernel.yml on each new version
- Schedule: daily 04:00 UTC
- Runner: self-hosted lecore-prd-u2404-arm64-xlrg-od-ephem
build-kernel.yml
- Checks out the suite branch (full kernel source tree)
- Installs build dependencies via apt-get build-dep
- Native arm64 build: fakeroot debian/rules binary-<flavor>
- No cross-compilation required (runner is arm64)
- Uploads built .deb packages as:
* GitHub Actions artifact (90-day retention)
* GitHub Release asset on the <suite>-<version> tag (permanent)
- Runner: self-hosted lecore-prd-u2404-arm64-xlrg-od-ephem
Helper scripts (scripts/):
check-version.sh - Query latest published version from Launchpad API
fetch-source-pkg.sh - Download source package files from Launchpad
build-kernel-deb.sh - Build kernel .deb packages locally (arm64 native)
Active suite: noble (Ubuntu 24.04 LTS, kernel 6.8)
Future suites: questing, resolute (added on demand via workflow input)
build-kernel.yml:
- Checkout qualcomm-linux/docker-pkg-build@main
- Build suite-matched docker image via docker_deb_build.py --rebuild
- Run fakeroot debian/rules inside ghcr.io/qualcomm-linux/pkg-builder:<suite>
container (bind-mounted workspace) instead of bare host
- Add native build mode as fallback (--build_mode native)
- Upload .deb packages to S3 qli-prd-lecore-gh-artifacts in addition
to GitHub Actions artifact
fetch-source-pkg.yml:
- Pass build_mode=docker when dispatching build-kernel.yml
Use GitHub-hosted arm64 runner while self-hosted runner group access
is being configured for this repository.
Changes:
- fetch-source-pkg.yml: all three jobs → ubuntu-24.04-arm
- build-kernel.yml: job → ubuntu-24.04-arm
- build-kernel.yml: add disk cleanup step (GitHub runners have ~14 GB
free; kernel build needs ~20 GB)
- build-kernel.yml: S3 upload step marked continue-on-error (S3
credentials not available on GitHub-hosted runners)
- Add quilt, rsync, patch to dependencies (required for 3.0 quilt format) - Verify dpkg-source -x produced >5000 files before committing - Verify rsync copied >5000 files to suite-repo before committing - Both checks fail the job with a clear error if extraction is incomplete
The Launchpad getPublishedSources source_name= parameter is a prefix match, not an exact match. Querying for 'linux' was returning 'linux-meta-raspi' (most recently published) instead of 'linux'. Fix: filter results with jq select(.source_package_name == $name) to ensure exact package name matching in: - scripts/check-version.sh - scripts/fetch-source-pkg.sh - .github/workflows/fetch-source-pkg.yml (check-version job)
- Add disk cleanup step to sync job (frees ~10 GB before extraction) - Use dpkg-source --no-check to skip GPG verification and redirect verbose 'upstream files modified' output to log file - Add file count verification after extraction and rsync (>5000 files)
dpkg-source -x <dsc> <output-dir> extracts the source directly INTO the specified directory, not into a subdirectory. The previous code used 'find kernel-src/ -maxdepth 1 -mindepth 1 -type d | head -1' which found 'kernel-src/net' (first dir alphabetically) instead of the full tree root. Fix: set SRC_DIR=kernel-src directly since we pass kernel-src/ as the explicit output directory to dpkg-source.
dpkg-source -x <dsc> <output-dir> extracts directly INTO the specified directory, not into a subdirectory. Previous code used 'find' which picked up 'kernel-src/net' (first dir alphabetically) instead of the full tree root. Fix: set SRC_DIR=kernel-src directly. Also update README to reflect current state: - Runner: ubuntu-24.04-arm (temporary, pending runner group access) - Source format: Debian 1.0 (.diff.gz not .debian.tar.xz) - S3 upload: self-hosted only, gracefully skipped on GitHub-hosted - Launchpad exact match note documented
The Ubuntu kernel uses debian.master/ as the packaging directory with
debian/ as a symlink pointing to it. Git does not always preserve
symlinks, so the build would fail with 'No such file: debian/rules'.
Add a guard in both docker and native build steps:
if [ ! -e debian ] && [ -d debian.master ]; then
ln -sf debian.master debian
fi
Also update README with corrected source package anatomy.
…ce-pkg gh workflow run requires actions:write permission. Without it the trigger-build job fails with HTTP 403 when trying to dispatch build-kernel.yml.
…sion
build-kernel.yml:
- Remove sudo from apt-get commands inside docker run bash -c block.
The pkg-builder container runs as root; sudo is not installed.
fetch-source-pkg.yml:
- Add actions:write permission so gh workflow run can dispatch
build-kernel.yml from the trigger-build job.
When force=true and the extracted source is identical to what is already committed, 'git commit' would fail with 'nothing to commit'. - Skip commit if git diff --cached --quiet (content unchanged) - Use git tag -fa to force-overwrite existing tag - Use git push --force for the tag to overwrite on remote
The Ubuntu kernel source package does not include debian/ as a symlink in the .diff.gz. Add it in the sync job after rsync so the noble branch is self-contained and the build does not need to create it at runtime. This also ensures force re-sync correctly adds the symlink even when the rest of the source content is unchanged.
Ubuntu 24.04 uses DEB822 format (/etc/apt/sources.list.d/ubuntu.sources). The pkg-builder:noble container does not have deb-src enabled by default, causing 'apt-get build-dep' to fail with 'no deb-src URIs in sources.list'. Fix: sed 's/^Types: deb$/Types: deb deb-src/' before apt-get update.
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
apt-get build-dep kernel-src/ tries to find a source package named 'kernel-src/' in the apt repositories. The ./ prefix tells apt-get to read the debian/control file from the local directory instead.
The local directory syntax './kernel-src/' is not supported by the apt version in the pkg-builder container. Use the source package name 'linux' directly — deb-src is already enabled so apt can resolve it.
The Ubuntu noble kernel source package does not ship debian/rules directly. debian.master/ contains only rules.d/ fragments. The debian/rules file is generated by running debian/reconstruct which assembles the rules from the fragments.
Problem ─────── The Ubuntu kernel source package (Debian format 1.0) ships only debian.master/ containing rules.d/ Makefile fragments. It does NOT include debian/rules, debian/scripts/, debian/templates/, or any of the other files required to run 'fakeroot debian/rules binary-generic'. These files exist only in the Launchpad git repository: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble The previous approach (dpkg-source -x on the .dsc/.orig.tar.gz/.diff.gz) produced an incomplete source tree that could not be built. Every attempt to work around this (debian/ symlink, reconstruct script, make -f) failed because the required files were simply not present in the source package. Solution ──────── Replace the source package download+extraction with a shallow git clone from the Launchpad git repository at the tag Ubuntu-<version> (e.g. Ubuntu-6.8.0-114.114). This tag corresponds exactly to the version reported by the Launchpad REST API, so version tracking is unchanged. The git clone produces a complete, buildable source tree including: debian/rules ← main build entry point debian/scripts/ ← build helper scripts debian/templates/ ← package template files debian/cloud-tools/ ← cloud tools debian/config/ ← kernel config fragments debian/control.stub.in ← package control template Changes ─────── .github/workflows/fetch-source-pkg.yml - Remove: apt-get install devscripts dpkg-dev quilt patch - Remove: scripts/fetch-source-pkg.sh call - Remove: dpkg-source --no-check -x extraction step - Remove: debian/ symlink creation - Remove: file count verification (>5000 files check kept) - Add: git clone --depth=1 --branch Ubuntu-${VERSION} from Launchpad git - The Launchpad API is still used to determine the latest version number and map it to the git tag Ubuntu-<version> .github/workflows/build-kernel.yml - Remove: debian/ symlink creation workaround - Remove: debian/reconstruct execution attempt - Remove: all debug ls/echo diagnostic steps - The noble branch now has a complete debian/ directory from git; fakeroot debian/rules binary-generic works without any workarounds scripts/fetch-source-pkg.sh - Rewritten to use git clone instead of downloading source package files - Now produces the same complete, buildable source tree as the CI workflow - Local developers can use this script to get a buildable tree: ./scripts/fetch-source-pkg.sh noble linux ./kernel-src/ ./scripts/build-kernel-deb.sh ./kernel-src/ arm64 generic $(nproc) README.md - Update pipeline diagram: Job 2 now shows git clone instead of dpkg-source - Update fetch-source-pkg.yml description to reflect git clone approach - Add 'Source and build notes' section explaining why git is used - Update scripts table: fetch-source-pkg.sh now clones (not downloads) - Update local usage section with correct workflow
…URLs
build-kernel.yml — GitHub Release creation
Previously the 'Attach packages to release tag' step only uploaded
.deb assets if a GitHub Release already existed for the tag. Since
the sync workflow creates only a git tag (not a GitHub Release), no
release was ever created and the upload was silently skipped.
Fix: step 10 now creates the GitHub Release if it does not exist
before uploading the built .deb packages as release assets.
Release properties:
title: 'Ubuntu <suite> kernel <version> (arm64)'
tag: '<suite>-<version>' (e.g. noble-6.8.0-114.114)
assets: linux-image-*.deb, linux-headers-*.deb,
linux-modules-*.deb, linux-libc-dev_*.deb
latest: false (not marked as latest release)
Release notes are written to /tmp/release-notes.md via printf to
avoid YAML parsing errors caused by 'Key: value' patterns in
multi-line shell strings.
After a successful build, .deb packages are permanently accessible at:
https://github.com/qualcomm-linux/pkg-linux-qcom-canonical/releases/tag/<tag>
Storage summary after build:
GitHub Release assets — permanent, publicly downloadable from GitHub UI
GitHub Actions artifact — 90-day retention, downloadable from Actions tab
S3 qli-prd-lecore-gh-artifacts — permanent, self-hosted runner only
README.md — upstream source table
Replace the generic 'Launchpad REST API: https://api.launchpad.net/1.0/'
entry with the actual query URL and a 'Used by' column explaining the
purpose of each upstream resource:
Launchpad REST API → check-version job (version number lookup)
Launchpad git repo → sync job (shallow clone at Ubuntu-<version> tag)
GitHub Releases → build-kernel job (permanent .deb asset storage)
build-kernel.yml:
- S3 upload step now conditional on runner.name ==
'lecore-prd-u2404-arm64-xlrg-od-ephem' instead of continue-on-error.
Cleanly skipped on GitHub-hosted runners where S3 credentials and
network access are not available. No silent failures.
README.md:
- 'Noble (current active suite)' → 'Example (noble suite)'
- Fix stray 'A' character at top of file
Address review of the pre-merge build feature: premerge-pr.yml (moved to .github/devel-workflows/ as a source, installed on resolute-qcom-devel): - Was pull_request_target reading the workflow from main and building the raw PR head SHA on the S3-credentialed self-hosted runner - a pwn-request, and it would never have fired: pull_request(_target) resolves the workflow from the PR base branch (resolute-qcom-devel), not the default branch. - Now pull_request (read-only token, no secrets) building the PR merge ref via build-kernel.yml@main, gated to same-repo (non-fork) PRs. Installed on the integration branch so the trigger actually fires. Static job name yields the stable 'Build check / Build' required-check name. build-kernel.yml: - devel_prs now validates each PR is open and targets the suite branch, and deepens the shallow checkout until a merge base exists before merging (the old code failed on any PR not based on the exact branch tip and misreported it as a conflict). - Fix shell-injection of inputs.devel_prs in the summary step (route via env). - Align the empty-suite checkout fallback with the resolute-qcom-devel default. docs/PIPELINE.md: correct the pull_request_target rationale, document the install-on-devel step and the residual credentialed-runner security note. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Add a schedule trigger to build-kernel.yml so resolute-qcom-devel HEAD is built and uploaded to S3 daily at 15:00 PST (23:00 UTC). A scheduled run passes no inputs, so the existing defaults apply: SUITE and the checkout ref fall back to resolute-qcom-devel, the runner is the hardcoded lecore-production host, and the S3 upload runs because skip_s3 is unset. No other changes are needed. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
The --single-branch mirror clone only holds tags reachable from the branch tip, so a rebased or divergent upload that was already mirrored is invisible locally. The missing-upload check used that local view, re-listed such uploads, and the atomic push then failed with "tag already exists", halting the sync. Judge "already mirrored" against the mirror's actual tags via git ls-remote --tags origin, matching the check-version gate in fetch-source-pkg.yml. Also guarantee the branch ends at the newest upload after the loop: a backfilled older upload or a prior partial run could otherwise leave the mirror HEAD behind the latest tag. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Tighten and clarify the pipeline doc: trim deep operational detail to what a reader needs and simplify the wording throughout. Docs only; no workflow or script changes. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Add the Qualcomm Technologies copyright line above the existing SPDX-License-Identifier tag in each scripts/*.sh file, matching the header format used in LICENSE.txt and the .github/workflows/*.yml files. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
The public-issue reporting link in SECURITY.md pointed at a qualcomm/REPLACE-ME placeholder repo. Point it at qualcomm-linux/pkg-linux-qcom-canonical, matching the repository referenced everywhere else in the docs (README.md, CONTRIBUTING.md). Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Update the repository overview to describe the Canonical kernel mirror, Qualcomm contributions, and the resolute-qcom-devel integration branch. Refresh integration and pipeline documentation to use the same wording, remove README sections that no longer match the repository policy, and scope the BSD-3-Clause license summary to workflows, scripts, and documentation maintained on main in the README. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
…project-documentation Update project documentation wording
- Add a dbgsym workflow input (default true) mapped to a DBGSYM env var and passed into the build container. - Pass do_dbgsym_package=true/false to debian/rules based on DBGSYM. - Collect and list *.ddeb alongside *.deb/*.changes/*.buildinfo, both inside the container and in the outer "Collect built packages" step. - Add a Dbgsym row to the run summary table. - Document the new dbgsym input in docs/PIPELINE.md. Signed-off-by: Guanquan Tian <guanquan@qti.qualcomm.com>
FLAVOR was hardcoded to qcom, so the qcom-rt flavour defined in debian.qcom/rules.d/arm64.mk was never built despite being fully wired up (vars.qcom-rt, PREEMPT_RT policy in config/annotations). Set FLAVOR=all so TARGET resolves to the binary target, which depends on every flavour in debian.qcom's flavours list. Signed-off-by: Guanquan Tian <guanquan@qti.qualcomm.com>
qcom and qcom-rt flavour packages were collected into the same flat output/ directory, making the two indistinguishable downstream. Split qcom-rt packages (matched by their -qcom-rt/-qcom-rt-dbgsym suffix) into output/rt/, while qcom and arch-indep packages stay in output/. Also drop the redundant in-container copy step, since the host-side collection step already re-scans and copies the same files. Signed-off-by: Guanquan Tian <guanquan@qti.qualcomm.com>
linux-headers-*-qcom-rt depends on linux-qcom-headers-*, which is built as a single "Architecture: all" package per ABI rather than per-flavour, so it only ever lands in output/ and never matches the -qcom-rt filename pattern used to populate output/rt/. This leaves output/rt/ missing a dependency, breaking headers installs for the rt flavour when consumed standalone. Copy (not move, since qcom still needs its own copy) linux-qcom-headers-* and linux-qcom-tools-* into output/rt/ as well, so each flavour's output folder is self-contained. Signed-off-by: Guanquan Tian <guanquan@qti.qualcomm.com>
…lt, explicit s3_prefix Rename the flavor input to flavours and switch from a comma-separated token list to space-separated flavour names, matching how Canonical declares flavours in debian.qcom/rules.d/arm64.mk (e.g. "qcom qcom-rt"). binary-indep is no longer an optional token: it is always built alongside the selected flavours, since linux-headers-*/linux-tools-* packages depend on it and previously could be built into an uninstallable combination if the caller omitted it. Replace the S3 upload destination's github.event_name check with an explicit s3_prefix input. A reusable workflow's own github.event_name reflects the caller's original triggering event, not "workflow_call", so premerge-pr.yml calls were always landing under pkg/temp/ instead of the intended pkg/premerge/. Callers now declare their prefix directly. Updates docs/PIPELINE.md to match. Signed-off-by: Guanquan Tian <guanquan@qti.qualcomm.com>
Collect built packages unconditionally created output/rt/ and copied the architecture-independent linux-qcom-headers-*/linux-qcom-tools-* packages into it regardless of which flavours were selected, so a qcom-only build (e.g. premerge-pr.yml with flavours: qcom) still produced a populated output/rt/ directory. Create output/rt/ only when a qcom-rt artifact is actually found, and gate the header/tools copy and summary output on that. Signed-off-by: Guanquan Tian <guanquan@qti.qualcomm.com>
…rt-dir ci(build-kernel): only create output/rt/ when qcom-rt is actually built
- Observe completed Pre-merge PR build runs from the trusted default-branch workflow and resolve one tested pull request targeting resolute-qcom-devel. - Bind each validation request to the kernel run, attempt, package directory, pull request number, and head SHA. - Start a request-bound Check Run before dispatch and use its external ID to make retries, supersession, and callback completion deterministic. - Dispatch the verified request to qcom-distro-images without exposing repository secrets to the untrusted pull request workflow. - Revalidate the kernel run, pull request, distro run, source SHA, build ID, S3 location, and completion marker before reporting the result. - Complete only the exact matching Check Run while retaining the existing commit status during the reporting transition. - Pin checkout actions to a verified commit and disable persisted Git credentials in every trusted orchestration job. - Document the cross-repository trust boundary, callback lifecycle, artifact layout, and validation reporting contract. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
- Install GitHub CLI from Ubuntu repositories in every trusted job that invokes gh api. - Restore kernel context resolution, validation dispatch, failure reporting, callback validation, and Check Run updates. - Remove reliance on the ephemeral runner image providing the GitHub CLI. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
- Derive the distro build ID from the verified workflow run identity. - Read the immutable distro source SHA from the GitHub Actions run and construct the image prefix from validated kernel identity. - Preserve run, pull request, receipt, and completion marker verification for the reduced callback contract. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
- Publish only the raw image S3 prefix in Check Run output text for internal tooling compatibility. - Surface the kernel and distro build identities in the trusted callback workflow summary. - Preserve request validation, Check Run lifecycle handling, and S3 completion metadata. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Create a temporary fork-originated pull request targeting `resolute-qcom-devel` to exercise the complete premerge path. - Run the untrusted kernel premerge build from the pull request merge ref. - Delegate Canonical server and desktop image validation from `main`. - Verify the resulting Check Run is returned to the originating pull request. This marker is not intended to merge. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Canonical commit 544acfc ("UBUNTU: [SAUCE] fit image generation") enables `do_fitimage` for the Qualcomm arm64 flavor. The new packaging rule invokes `mkimage`, but the current Resolute pkg-builder image does not provide that tool, causing all Canonical package builds to fail. - Pass `do_fitimage=false` through the existing `debian/rules` invocation. - Preserve normal kernel, modules, DTB, headers, tools, and dbgsym builds. - Leave qcom-build-utils `dtb.bin` assembly unchanged. This is a temporary workflow-level compatibility measure. The durable resolution is to add `u-boot-tools` to the Resolute builder before re-enabling Canonical FIT generation and publishing its raw `qcom.itb` payload. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
…canonical-fit-image fix(ci): temporarily disable Canonical FIT image generation
Bjordis Collaku (bjordiscollaku)
added a commit
that referenced
this pull request
Aug 28, 2026
Both the workflow_run orchestrator and the repository_dispatch callback
handler identify the originating pull request by calling GET
/commits/{sha}/pulls with the triggering commit SHA. That endpoint does
not reliably resolve commits that only exist on a fork: such commits
are reachable in this repository solely through the hidden
refs/pull/<n>/head ref, never through an actual branch, and GitHub's
commit-to-pull-request association does not cover that case.
This surfaced on pull request #90, a real fork PR opened specifically
to exercise this chain. Its premerge kernel build succeeded and
correctly triggered the workflow_run orchestrator, but the orchestrator
then failed identity resolution with "found 0" pull requests for a
commit that was, in fact, the current head of an open PR.
- List open pull requests against resolute-qcom-devel directly with GET
/pulls?state=open&base=resolute-qcom-devel and match on head.sha
instead of relying on the commit-to-pull-request association. This
works identically for same-repo and fork-originated pull requests.
- Apply the same fix to both call sites: resolve-distro-validation-context.sh
(workflow_run path) and validate-distro-validation-callback.sh
(repository_dispatch callback path), which independently re-derives
the same identity as a security cross-check against the callback
payload.
- Move head_sha format validation ahead of its first use in
resolve-distro-validation-context.sh.
Verified live against the real API: the new query returns exactly one
match, PR #90, for the exact commit that the old query returned zero
results for.
Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
This was referenced Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Temporary fork-originated smoke test for the Canonical premerge distro validation path. This pull request is not intended to merge.
Expected flow
resolute-qcom-develpremerge workflow builds the pull request merge ref.mainvalidates that kernel run and dispatches Canonical server and desktop validation toqcom-distro-images.qcom-distro-images/canonical-premergeon this pull request.Scope
Adds only a temporary documentation marker. The branch and pull request will be closed after the validation result is recorded.