Ci1 - In progress - test and updates to be done by liviutomoiaga · Pull Request #3299 · analogdevicesinc/linux

liviutomoiaga · 2026-04-29T13:39:46Z

PR Description

This PR adds CI workflows and scripts for preparing and deploying Linux build artifacts to Cloudsmith:

RPI Artifacts: New workflow and script to prepare Raspberry Pi boot files and kernel modules (32-bit and 64-bit), package them as tar.gz
archives, and upload to Cloudsmith
SDG Linux Artifacts: New workflow and scripts to prepare SDG Linux artifacts (ARM, ARM64, Microblaze) with proper directory structure,
kernel images, DTBs, and git metadata
Upload to Cloudsmith: Enhanced to support input variable for Cloudsmith repository

PR Type

Bug fix (a change that fixes an issue)
New feature (a change that adds new functionality)
Breaking change (a change that affects other repos or cause CIs to fail)

PR Checklist

I have conducted a self-review of my own code changes
I have compiled my changes, including the documentation
I have tested the changes on the relevant hardware
I have updated the documentation outside this repo accordingly
I have provided links for the relevant upstream lore

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

Signed-off-by: Andreea Andrisan <Andreea.Andrisan@analog.com>

liviutomoiaga · 2026-04-29T13:40:44Z

Some tests are still running, but the implementation and the code can be reviewed

gastmaier

Will look more in depth later.
but take a look at
https://github.com/analogdevicesinc/linux-security-vulns/blob/ci/.github/workflows/check-artifact.yml#L70-L78

I use the same ci/download_artifacts.sh to get the artifacts I need and manipulate to my wish -> check cve
my wish could be gen a boot partition at adi-kuiper-gen

gastmaier · 2026-04-29T14:26:10Z

+        type: string
+      version:
+        required: false
+        default: ${{ github.sha }}


this changes the default for /linux from 12 chars to the full 40 chars.
I was considering to default to 40 chars, maybe we can merge and see where it breaks

gastmaier · 2026-04-29T14:27:19Z

@@ -0,0 +1,264 @@
+#!/bin/bash


this is mostly
https://github.com/analogdevicesinc/linux/blob/ci/ci/download_artifacts.sh
no?
Why not source download_artifacts.sh and just use another 'main' method (if any change required)

Why I had the feeling that this implementation was only on ci_adapter branch🤔 ? My mistake in this case.

Still, I would suggest to keep the logic apart since the name of the script is download_artifacts.sh and it's not really intuitive from this pov ( just a personal opinion. PS: I think I can come with a better name😅 )

gastmaier · 2026-04-29T14:30:26Z

@@ -0,0 +1,181 @@
+# SPDX-License-Identifier: GPL-2.0-only


This is kuiper-linux boot partition logic no? why can't adi-kuiper-gen do this step on their end?

I do not think so. This script mimics the logic from this one and I'm not sure if it can be added as an end step on adi-kuiper-gen, since the flow needs the artifacts from linux-rpi build. Maybe I'm missing something here, but this is my understanding so far

gastmaier · 2026-04-29T14:33:37Z

@@ -0,0 +1,294 @@
+#!/bin/bash


Also looks like adi-kuiper-gen logic

gastmaier · 2026-04-29T14:36:14Z

+    cat > "${output_dir}/extlinux.conf" <<EOF
+            LABEL Linux Default
+            KERNEL ../zImage
+            FDT ../${dtb_name}
+            APPEND root=/dev/mmcblk0p2 rw rootwait earlyprintk console=ttyS0,115200n8


Also adi-kuiper-gen logic
here we are saying how to boot, beyond dtb_name it is identical to the end of times.

gastmaier · 2026-04-29T14:37:05Z

@@ -0,0 +1,285 @@
+name: Prepare and Upload to Cloudsmith RPI Artifacts


Feels duplicated... all because of the kuiper logic...

gastmaier · 2026-04-29T14:44:04Z

+
+jobs:
+  prepare_and_upload_sdg_linux_artefacts:
+    runs-on: [self-hosted, repo-only]


ubuntu-slim is more suitable, only fast internet is needed

gastmaier · 2026-04-29T14:45:00Z

+    - uses: analogdevicesinc/doctools/checkout@action
+
+    - name: Prepare path
+      run: |
+        rm -rf dist ; mkdir dist


No need to checkout, you don't use anything from the linux git tree at this job

gastmaier · 2026-05-04T10:51:56Z

Hi @liviutomoiaga did you have the opportunity to go through my review?

gastmaier

some more comments

gastmaier · 2026-05-05T06:45:05Z

+
+permissions:
+  id-token: write
+  contents: write


Suggested change

contents: write

contents: read

gastmaier · 2026-05-05T06:45:20Z

+
+permissions:
+  id-token: write
+  contents: write


Suggested change

contents: write

contents: read

gastmaier · 2026-05-05T06:46:21Z

+      actions: read
+
+    steps:
+    - uses: analogdevicesinc/doctools/checkout@action


Suggested change

- uses: analogdevicesinc/doctools/checkout@action

No need to checkout, you get the files that you need on line 59

gastmaier · 2026-05-05T06:47:45Z

+        echo "Verifying script content:"
+        head -3 ci/prepare_rpi_artifacts.sh
+        if [[ ! -s ci/prepare_rpi_artifacts.sh ]] || ! head -1 ci/prepare_rpi_artifacts.sh | grep -q "^#"; then
+          echo "ERROR: Script download failed or invalid content"


Suggested change

echo "ERROR: Script download failed or invalid content"

echo "::error ::deploy-rpi-artifacts: Script download failed or invalid content."

I have been using gh-annotation to surface errors to the summary view of the run
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands

Nice tip 👀

gastmaier · 2026-05-05T06:49:24Z

@@ -0,0 +1,207 @@
+name: Deploy SDG Linux Artifacts to Cloudsmith


see https://github.com/analogdevicesinc/linux/blob/ci-adapter/.github/workflows/expand-to-cloudsmith.yml

why not unify 'xlnx' and 'rpi' in to single .yml and .sh scripts, and 'activate' the differences based on the ${{ github.ref }} value?

We destroying the kernel modules is a mistake on the 'xlnx' path is a mistake, unifying them allows to better compare the difference and mitigate the historical shortcomings.

gastmaier · 2026-05-05T06:53:07Z

+      artifacts:
+        required: true
+        type: string
+      CLOUDSMITH_REPO:


github semantic are lower case, dash separated for inputs, e.g., cloudsmith-repo

gastmaier · 2026-05-05T06:54:16Z

+        if [[ -n "${{ inputs.PR_NUMBER }}" ]]; then
+          export GIT_SHA="${{ github.event.pull_request.head.sha }}"
+        else
+          export GIT_SHA="${{ github.sha }}"
+        fi


Suggested change

if [[ -n "${{ inputs.PR_NUMBER }}" ]]; then

export GIT_SHA="${{ github.event.pull_request.head.sha }}"

else

export GIT_SHA="${{ github.sha }}"

fi

GIT_SHA="${{ github.event.pull_request.head.sha || github.sha }}"

gastmaier · 2026-05-05T07:03:12Z

+
+        # Build version path based on branch type
+        if [[ -n "${{ inputs.PR_TARGET_BRANCH }}" ]]; then
+          VERSION_PATH="linux/PRs/${{ inputs.PR_TARGET_BRANCH }}/pr_${{ inputs.PR_NUMBER }}"


There is mixing inputs with the github.context.
that is problematic

Suggested change

VERSION_PATH="linux/PRs/${{ inputs.PR_TARGET_BRANCH }}/pr_${{ inputs.PR_NUMBER }}"

pr=${{ github.ref }} # refs/pull/<pr_number>/merge

pr="${ref#refs/pull/}"

pr="${pr%/merge}"

VERSION_PATH="linux/PRs/${{ github.base_ref }}/pr_${pr}"

Tip: use github search to look for usage examples/inspiration:
https://github.com/search?q=path%3A.github%2Fworkflows+github.base_ref&type=code

Many thanks for the tip - that's really useful

gastmaier · 2026-05-05T07:03:52Z

+        MERGE_COMMIT_SHA=$(git rev-parse --short HEAD)
+        export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} | sed -e "s/ \|\:/-/g")


Suggested change

MERGE_COMMIT_SHA=$(git rev-parse --short HEAD)

export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} | sed -e "s/ \|\:/-/g")

export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${GIT_SHA} | sed -e "s/ \|\:/-/g")

In the previous line you said # Get git SHA (PR source commit or build commit) but then now you are considering only the MERGE_COMMIT_SHA case, but actually looking at head.

gastmaier · 2026-05-05T07:07:30Z

+        export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} | sed -e "s/ \|\:/-/g")
+
+        # Determine branch name (works for main, release/*, feature/*, etc.)
+        BRANCH_NAME=$(echo "${{ inputs.BUILD_SOURCEBRANCH }}" | awk -F'/' '{print $NF}')


${{ github.head_ref }}

gastmaier · 2026-05-05T07:08:59Z

+        default: 'sdg-linux'
+      BUILD_SOURCEBRANCH:
+        required: false
+        default: ${{ github.ref_name }}


${{ github.ref_name }}: For pull requests that were not merged, the format is <pr_number>/merge.
https://docs.github.com/en/actions/reference/workflows-and-actions/variables

gastmaier · 2026-05-05T07:15:47Z

Is this supposed for pull_request|push events, or workflow_dispatch too? This defines if you need the inputs. Or is better of using the gihtub context directly (most likely).

bia1708 · 2026-05-07T11:49:31Z

+
+
+jobs:
+  prepare_and_upload_sdg_linux_artefacts:


typo for "artifact"

bia1708 · 2026-05-07T11:52:01Z

+
+jobs:
+  prepare_and_upload_sdg_linux_artefacts:
+    runs-on: [self-hosted, repo-only]


can't we do cloud-hosted? Afaik you should be able to upload to cloudsmith from the cloud runners as well

bia1708 · 2026-05-07T11:53:21Z

+    - name: Get sources
+      run: |
+        file=$(echo "${{ github.workflow_ref }}" | cut -d'/' -f3- | cut -d'@' -f1)
+        workflow_ref=$(awk '


some comments would be nice

bia1708 · 2026-05-07T11:59:16Z

+        get_file ci/prepare_sdg_linux_artifacts.sh
+        get_file ci/lib.sh
+        get_file ci/prepare_artifacts_structure.sh
+
+        chmod +x ci/*.sh


ideally, these files should be committed as executable (git update-index --chmod=+x script.sh)

bia1708 · 2026-05-07T12:03:23Z

+    - name: Download workflow artifacts
+      run: |
+        gh-get-workflow-artifacts()
+        {


you should keep the same style across the script, curly bracket should be on L82

bia1708 · 2026-05-07T12:13:48Z

+# Configuration
+SOURCE_DIRECTORY="${SOURCE_DIRECTORY:-$(pwd)}"
+TIMESTAMP="${TIMESTAMP:-$(date +%Y_%m_%d-%H_%M_%S)}"
+BUILD_SOURCEBRANCHNAME="${BUILD_SOURCEBRANCHNAME:-main}"


maybe let's not use default for branch names

bia1708 · 2026-05-07T12:36:42Z

+        echo $workflow_ref
+
+        org_repo="$(echo "$workflow_ref" | cut -d'/' -f1-2)"
+        ref="$(echo "$workflow_ref" | cut -d'@' -f2)"


this is a bit of overengineering for things that will mostly stay static, e.g. org_repo would always be analogdevicesinc, right? And the ref should always be ci?

bia1708 · 2026-05-07T12:53:02Z

+        fi
+
+        source ci/lib.sh
+        source ci/prepare_artifacts_structure.sh


test if these sources are really needed (you already sourced them on L147)

bia1708 · 2026-05-07T12:55:12Z

+                               "$tags" \
+                               "$version" || exit 1
+        fi
+


extra newline

bia1708 · 2026-05-07T13:02:23Z

+    ["arria10"]="socfpga_adi_defconfig-gcc-arm/boot/zImage"
+    ["cyclone5"]="socfpga_adi_defconfig-gcc-arm/boot/zImage"
+    ["zynq"]="zynq_xcomm_adv7511_defconfig-gcc-arm/boot/uImage"
+    ["versal"]="adi_versal_defconfig-gcc-arm64/boot/Image"
+    ["zynqmp"]="adi_zynqmp_defconfig-gcc-arm64/boot/Image"


Maybe these can be replaced with regexes?

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

liviutomoiaga · 2026-05-12T07:57:57Z

Is this supposed for pull_request|push events, or workflow_dispatch too? This defines if you need the inputs. Or is better of using the gihtub context directly (most likely).

I was thinking to have the the following code block implemented in the top-level.yml from main branch. That's why I've added the inputs. Indeed, I'm not sure If I set the PR parameters by default in the deploy-sdg-linux-artifacts.yml will grab the needed values. I have to check that.

liviutomoiaga · 2026-05-12T08:03:01Z

Hi @liviutomoiaga did you have the opportunity to go through my review?

Hi @gastmaier I'm looking through it. There are some nice suggestions from your side and from @bia1708 that I would like to test. I'll set this PR to Draft for the moment.

liviutomoiaga and others added 3 commits April 29, 2026 16:32

ci: prepare_rpi_artefacts: Prepare RPI artefacts

68e6b6c

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

ci: prepare_sdg_artefacts: Prepare and deploy SDG Linux Artefacts

3bfc218

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

ci: upload_to_cloudsmith: Use input variable if provided

9b341e5

Signed-off-by: Andreea Andrisan <Andreea.Andrisan@analog.com>

liviutomoiaga requested review from bia1708 and gastmaier April 29, 2026 13:39

gastmaier added the llm review Request a review from a LLM Reviewer label Apr 29, 2026

gastmaier reviewed Apr 29, 2026

View reviewed changes

gastmaier requested changes Apr 29, 2026

View reviewed changes

gastmaier removed the llm review Request a review from a LLM Reviewer label Apr 29, 2026

gastmaier force-pushed the ci branch 2 times, most recently from 42812d4 to e8058b2 Compare May 4, 2026 10:45

gastmaier reviewed May 5, 2026

View reviewed changes

bia1708 requested changes May 7, 2026

View reviewed changes

Fix review findings

ce43926

Signed-off-by: Liviu Tomoiaga <Liviu.Tomoiaga@analog.com>

liviutomoiaga marked this pull request as draft May 12, 2026 08:03

liviutomoiaga changed the title ~~Ci1~~ Ci1 - In progress - test and updates to be done May 12, 2026

		@@ -0,0 +1,285 @@
		name: Prepare and Upload to Cloudsmith RPI Artifacts

	echo "ERROR: Script download failed or invalid content"
	echo "::error ::deploy-rpi-artifacts: Script download failed or invalid content."

		@@ -0,0 +1,207 @@
		name: Deploy SDG Linux Artifacts to Cloudsmith

-          VERSION_PATH="linux/PRs/${{ inputs.PR_TARGET_BRANCH }}/pr_${{ inputs.PR_NUMBER }}"
+          pr=${{ github.ref }} # refs/pull/<pr_number>/merge
+          pr="${ref#refs/pull/}"
+          pr="${pr%/merge}"
+          VERSION_PATH="linux/PRs/${{ github.base_ref }}/pr_${pr}"

		MERGE_COMMIT_SHA=$(git rev-parse --short HEAD)
		export GIT_SHA_DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d %H:%M' ${MERGE_COMMIT_SHA} \| sed -e "s/ \\|\:/-/g")



		jobs:
		prepare_and_upload_sdg_linux_artefacts:

Conversation

liviutomoiaga commented Apr 29, 2026

PR Description

PR Type

PR Checklist

Uh oh!

liviutomoiaga commented Apr 29, 2026

Uh oh!

gastmaier left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gastmaier commented May 4, 2026

Uh oh!

gastmaier left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gastmaier commented May 5, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

gastmaier left a comment •

edited

Loading