Claude
d54e2fe276
- scripts/nightly.sh images builds the PC's USB stick too (make boot_image TARGET=PC -> pc-stick.img.xz, in SHA256SUMS); publish sends it to Nexus as classifier pc-stick. pc stays the ISO QEMU boots. - scripts/nightly.sh gitea-release <tag>: the tag as a Gitea release -- a pre-release for -alpha.N and the like -- notes from the tag's message with the checksums, the images, SHA256SUMS, the documents and the StarshipOS Root CA's certificate attached; run again, it adds only what is missing. release.yml runs it after the Nexus publish, with the secret RELEASE_TOKEN. Tested here: images builds pc-stick.img.xz (785 KB); gitea-release against a stand-in Gitea API made a pre-release with the notes and ten files, and a second run added nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
94 lines
3.8 KiB
YAML
94 lines
3.8 KiB
YAML
# Nightly snapshot of the kernel images: the acceptance protocol, the board images, Nexus, then
|
|
# the proofs. Each stage is a step of scripts/nightly.sh (its header says what each does); any
|
|
# failure stops the run, and nothing is published unless every stage before it passed. The proofs
|
|
# come last and run whatever happened before them: they check the theories, not the images, so a
|
|
# failed proof does not hold back images that passed acceptance -- it turns the run red.
|
|
#
|
|
# org.starship:kernelImage:<LITHOS_VERSION>-SNAPSHOT, starshipos-snapshots
|
|
# classifier pc StarshipOS.iso amd64, UEFI -- the ISO the amd64 acceptance boot booted
|
|
# classifier pc-stick pc-stick.img.xz a PC's USB stick, for any UEFI PC (make boot_image TARGET=PC)
|
|
# classifier raspi5 raspi5.img.xz Raspberry Pi 5, for Raspberry Pi Imager
|
|
# classifier milkv MilkV.img.xz Milk-V Mars
|
|
# classifier logs logs.tar.gz this run's serial logs and DoE CSVs (the proof log is in
|
|
# the run's logs artifact)
|
|
#
|
|
# Gitea runs a schedule from the default branch, master, so this builds master.
|
|
name: Nightly snapshot
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 3 * * *' # 03:00 UTC; the documents are at 04:00 (nightly-docs.yml)
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: qemu # every workflow shares this one group: one run at a time,
|
|
# a runner-image rebuild included (Captain Bob, 2026-11-07)
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
nightly:
|
|
name: Acceptance, images, proofs
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2 # ci/runner-image (#120)
|
|
credentials: # the registry refuses anonymous pulls
|
|
username: rajames
|
|
password: ${{ secrets.PACKAGES_TOKEN }}
|
|
timeout-minutes: 150
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # the SBOM's version is git describe
|
|
lfs: false # only the logs and DoE CSVs are in LFS; the build needs neither
|
|
|
|
- name: The capsule-signing key
|
|
env:
|
|
KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
|
|
run: | # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
|
|
if [ -n "$KEY" ]; then
|
|
f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
|
|
(umask 077; printf '%s\n' "$KEY" > "$f")
|
|
echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
|
|
else
|
|
echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
|
|
fi
|
|
|
|
- name: Acceptance amd64
|
|
run: scripts/nightly.sh accept amd64
|
|
- name: Acceptance aarch64
|
|
run: scripts/nightly.sh accept aarch64
|
|
- name: Acceptance riscv64
|
|
run: scripts/nightly.sh accept riscv64
|
|
- name: Acceptance PC stick loaded high
|
|
run: scripts/nightly.sh accept stick-high
|
|
- name: Acceptance 32-bit build
|
|
run: scripts/nightly.sh test-32
|
|
|
|
- name: Images
|
|
run: scripts/nightly.sh images
|
|
|
|
- name: Publish to Nexus
|
|
env:
|
|
NEXUS_USER: ci-publisher
|
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_CI_PASSWORD }}
|
|
run: scripts/nightly.sh publish https://nexus.starshipos-f18.org/repository/starshipos-snapshots
|
|
|
|
- name: Keep the images
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: kernel-images-${{ github.run_number }}
|
|
path: build/nightly/
|
|
|
|
- name: Isabelle/HOL proofs
|
|
if: always()
|
|
run: scripts/nightly.sh proofs
|
|
|
|
- name: Keep the logs and DoE CSVs
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: logs-${{ github.run_number }}
|
|
path: |
|
|
logs/
|
|
experiments/bare_metal/runs/
|