build: harden and modernize SCST build and CI workflows

.github/workflows/checkpatch_pull.yml

@@ -5,21 +5,34 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
+concurrency:
+  group: checkpatch-pull-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  CHECKPATCH_LINUX_REF: v6.18
+
 jobs:
   checkpatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout code
-        uses: actions/checkout@main
+        uses: actions/checkout@v6
         with:
           ref: ${{github.event.pull_request.head.sha}}
           fetch-depth: 0
 
       - name: Download checkpatch.pl
         run: |
-          curl https://raw.githubusercontent.com/torvalds/linux/master/scripts/checkpatch.pl -o checkpatch.pl
-          curl https://raw.githubusercontent.com/torvalds/linux/master/scripts/spelling.txt -o spelling.txt
-          curl https://raw.githubusercontent.com/torvalds/linux/master/scripts/const_structs.checkpatch -o const_structs.checkpatch
+          set -euxo pipefail
+          base_url="https://raw.githubusercontent.com/torvalds/linux/${CHECKPATCH_LINUX_REF}/scripts"
+          curl -fsSL "${base_url}/checkpatch.pl" -o checkpatch.pl
+          curl -fsSL "${base_url}/spelling.txt" -o spelling.txt
+          curl -fsSL "${base_url}/const_structs.checkpatch" -o const_structs.checkpatch
           chmod +x checkpatch.pl
 
       - name: Run checkpatch.pl

.github/workflows/checkpatch_push.yml

@@ -5,26 +5,39 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
+concurrency:
+  group: checkpatch-push-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CHECKPATCH_LINUX_REF: v6.18
+
 jobs:
   checkpatch:
     name: ${{matrix.commit.message}}
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         commit: ${{github.event.commits}}
     steps:
       - name: Checkout code
-        uses: actions/checkout@main
+        uses: actions/checkout@v6
         with:
           ref: ${{matrix.commit.id}}
           fetch-depth: 2
 
       - name: Download checkpatch.pl
         run: |
-          curl https://raw.githubusercontent.com/torvalds/linux/master/scripts/checkpatch.pl -o checkpatch.pl
-          curl https://raw.githubusercontent.com/torvalds/linux/master/scripts/spelling.txt -o spelling.txt
-          curl https://raw.githubusercontent.com/torvalds/linux/master/scripts/const_structs.checkpatch -o const_structs.checkpatch
+          set -euxo pipefail
+          base_url="https://raw.githubusercontent.com/torvalds/linux/${CHECKPATCH_LINUX_REF}/scripts"
+          curl -fsSL "${base_url}/checkpatch.pl" -o checkpatch.pl
+          curl -fsSL "${base_url}/spelling.txt" -o spelling.txt
+          curl -fsSL "${base_url}/const_structs.checkpatch" -o const_structs.checkpatch
           chmod +x checkpatch.pl
 
       - name: Run checkpatch.pl

.github/workflows/ci.yml

@@ -1,27 +1,177 @@
 name: CI
 
-on: [push, pull_request]
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CCACHE_DIR: ${{ github.workspace }}/.ccache
+  CCACHE_MAXSIZE: 500M
 
 jobs:
   build:
+    name: build-${{ matrix.compiler }}
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     strategy:
+      fail-fast: false
       matrix:
         compiler: [gcc, clang]
-        arch: [x86_64]
+    continue-on-error: ${{ matrix.compiler == 'clang' }}
     steps:
-      - uses: actions/checkout@main
-      - name: Install build-essential
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install dependencies
         run: |
+          set -euxo pipefail
           sudo apt-get update
-          sudo apt-get install -y build-essential debhelper devscripts dpkg-dev quilt
-      - name: Install multilib
+          sudo apt-get install -y \
+            build-essential \
+            ccache \
+            clang \
+            debhelper \
+            devscripts \
+            dpkg-dev \
+            libelf-dev \
+            libsqlite3-dev \
+            quilt \
+            sparse
+          if ! [ -e "/lib/modules/$(uname -r)/build/Makefile" ]; then
+            sudo apt-get install -y "linux-headers-$(uname -r)" || \
+              sudo apt-get install -y linux-headers-generic
+          fi
+
+      - name: Restore ccache
+        uses: actions/cache@v5
+        with:
+          path: ${{ env.CCACHE_DIR }}
+          key: ccache-${{ runner.os }}-${{ matrix.compiler }}-${{ github.ref_name }}-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ runner.os }}-${{ matrix.compiler }}-${{ github.ref_name }}-
+            ccache-${{ runner.os }}-${{ matrix.compiler }}-
+
+      - name: Print toolchain and kernel headers
         run: |
-          sudo apt-get install -y gcc-multilib g++-multilib
-        if: ${{ matrix.arch == 'x86' }}
-      - name: Build
+          set -euxo pipefail
+          uname -a
+          gcc --version | head -n 1
+          clang --version | head -n 1
+          ccache --version | head -n 1
+          printf 'KDIR=%s\n' "$(readlink -f /lib/modules/$(uname -r)/build || echo missing)"
+          make --version | head -n 1
+
+      - name: Build modules and userspace
         env:
           CC: ${{ matrix.compiler }}
-          CFLAGS: -Werror ${{ matrix.arch == 'x86' && '-m32' || '' }}
-          LDFLAGS: ${{ matrix.arch == 'x86' && '-m32' || '' }}
-        run: make CC=${{matrix.compiler}} dpkg
+          PASS_CC_TO_MAKE: "1"
+        run: |
+          set -euxo pipefail
+          export PATH="/usr/lib/ccache:${PATH}"
+          mkdir -p artifacts
+          ccache --set-config=max_size="${CCACHE_MAXSIZE}"
+          ccache --zero-stats
+
+          make 2release
+          make all 2>&1 | tee "artifacts/build-${CC}.log"
+          build_rc=${PIPESTATUS[0]}
+
+          ccache --show-stats | tee "artifacts/ccache-${CC}.txt"
+          exit "${build_rc}"
+
+      - name: Upload build logs
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: ci-${{ matrix.compiler }}-logs
+          path: artifacts/
+          if-no-files-found: error
+
+      - name: Job summary
+        if: always()
+        run: |
+          {
+            echo "### Build profile"
+            echo "- Compiler: \`${{ matrix.compiler }}\`"
+            echo "- KDIR: \`$(readlink -f /lib/modules/$(uname -r)/build || echo missing)\`"
+            echo "- ccache dir: \`${CCACHE_DIR}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  package-deb:
+    name: package-deb
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    needs: build
+    if: github.event_name == 'push'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install dependencies
+        run: |
+          set -euxo pipefail
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            ccache \
+            debhelper \
+            devscripts \
+            dpkg-dev \
+            quilt
+          if ! [ -e "/lib/modules/$(uname -r)/build/Makefile" ]; then
+            sudo apt-get install -y "linux-headers-$(uname -r)" || \
+              sudo apt-get install -y linux-headers-generic
+          fi
+
+      - name: Restore ccache
+        uses: actions/cache@v5
+        with:
+          path: ${{ env.CCACHE_DIR }}
+          key: ccache-${{ runner.os }}-gcc-packages-${{ github.ref_name }}-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ runner.os }}-gcc-packages-${{ github.ref_name }}-
+            ccache-${{ runner.os }}-gcc-packages-
+
+      - name: Build Debian packages
+        env:
+          CC: gcc
+          PASS_CC_TO_MAKE: "1"
+        run: |
+          set -euxo pipefail
+          export PATH="/usr/lib/ccache:${PATH}"
+          mkdir -p artifacts
+          ccache --set-config=max_size="${CCACHE_MAXSIZE}"
+
+          make dpkg 2>&1 | tee artifacts/dpkg.log
+          build_rc=${PIPESTATUS[0]}
+
+          if [ -d dpkg ]; then
+            find dpkg -maxdepth 1 -type f -printf '%P\n' | sort > artifacts/dpkg-files.txt
+          fi
+
+          exit "${build_rc}"
+
+      - name: Upload package artifacts
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: ci-deb-packages
+          path: |
+            artifacts/
+            dpkg/
+          if-no-files-found: warn

.github/workflows/coverity.yml

@@ -5,13 +5,21 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
+concurrency:
+  group: coverity-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   coverity:
     if: github.repository == 'SCST-project/scst'
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     steps:
       - name: Checkout Project
-        uses: actions/checkout@main
+        uses: actions/checkout@v6
 
       - name: Get version
         id: get_version
@@ -68,7 +76,7 @@ jobs:
           # Command to pass to cov-build.
           #
           # Default: 'make'
-          command: 'make -i cov-build'
+          command: 'make cov-build'
 
           # (Informational) The source version being built.
           #

.github/workflows/mail_notification.yml

@@ -6,18 +6,22 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   send_mails:
     name: ${{matrix.commit.message}}
     if: github.repository == 'SCST-project/scst'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       max-parallel: 1
       matrix:
         commit: ${{github.event.commits}}
     steps:
       - name: Checkout Project
-        uses: actions/checkout@main
+        uses: actions/checkout@v6
         with:
           ref: ${{matrix.commit.id}}
           fetch-depth: 2
@@ -58,7 +62,7 @@ jobs:
           fi
 
       - name: Send mail
-        uses: dawidd6/action-send-mail@v3
+        uses: dawidd6/action-send-mail@v9
         with:
           # Required mail server address:
           server_address: smtp.yandex.com