ElementaryOS_MSeries/.github/workflows/aurora-kernel.yml at dev · techmore/ElementaryOS_MSeries · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
name: Aurora kernel port

on:
  workflow_dispatch:
  pull_request:
    paths:
      - "mseries/aurora/**"
      - "mseries/power/display_status.py"
      - "mseries/aurora-sep/install-aurora-sep.sh"
      - ".github/workflows/aurora-kernel.yml"

permissions:
  contents: read

# New commits replace only checks for this workflow and PR. Publishing is not preempted.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  package:
    runs-on: ubuntu-26.04-arm
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/fast-apt

      - name: Install payload inspection tools
        run: sudo apt-get update && sudo apt-get install -y zstd device-tree-compiler shellcheck
      - name: Check installer and staging regressions
        env:
          FREEZE_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          bash -n mseries/aurora-sep/install-aurora-sep.sh
          shellcheck -S warning mseries/aurora-sep/install-aurora-sep.sh
          python3 -m unittest discover -s mseries/aurora -p 'test_*.py' -v
          if [[ -n "$FREEZE_BASE_SHA" ]]; then
            git fetch --no-tags --depth=1 origin "$FREEZE_BASE_SHA"
            python3 mseries/aurora/check_freezes.py --base "$FREEZE_BASE_SHA"
          else
            python3 mseries/aurora/check_freezes.py
          fi
          python3 mseries/aurora/qualification.py verify \
            mseries/aurora/frozen/mseries-aurora20-j314s-2026.10.18-exp1.json \
            --pins mseries/aurora/frozen/pins/aurora20.json \
            --evidence mseries/aurora/hardware-tests/2026-10-18-j314s-aurora20.json \
            --binary-proof mseries/aurora/hardware-tests/2026-10-18-j314s-binary-verification.json
      - name: Package the unchanged public kernel and corresponding source
        run: |
          python3 mseries/aurora/package-release.py --cache "$RUNNER_TEMP/aurora-cache" --output "$RUNNER_TEMP/aurora-port"
          cd "$RUNNER_TEMP/aurora-port"
          sha256sum --check SHA256SUMS
          deb=linux-image-elementary-aurora20_7.1.12+aurora.20261017.20-1_arm64.deb
          dpkg-deb --info "$deb"
          dpkg-deb --extract "$deb" "$RUNNER_TEMP/aurora-inspect"
          dpkg-deb --control "$deb" "$RUNNER_TEMP/aurora-control"
          test "$(find "$RUNNER_TEMP/aurora-control" -type f | wc -l)" -eq 1
          test ! -e "$RUNNER_TEMP/aurora-inspect/boot"
          python3 - <<'PY'
          import os, pathlib, sys
          sys.path.insert(0, str(pathlib.Path(os.environ['GITHUB_WORKSPACE']) / 'mseries/aurora'))
          from release import validate_kernel
          validate_kernel(pathlib.Path(os.environ['RUNNER_TEMP']) / 'aurora-inspect')
          PY
      - name: Preserve candidate package, upstream binary, build recipe and corresponding source
        uses: actions/upload-artifact@v7
        with:
          name: elementary-aurora20-${{ github.run_id }}
          path: ${{ runner.temp }}/aurora-port/
          if-no-files-found: error
          retention-days: 7
          compression-level: 0