feat(ci): append a local version suffix to resolute-qcom-devel builds - #108
Draft
Bjordis Collaku (bjordiscollaku) wants to merge 2 commits into
Draft
feat(ci): append a local version suffix to resolute-qcom-devel builds#108Bjordis Collaku (bjordiscollaku) wants to merge 2 commits into
Bjordis Collaku (bjordiscollaku) wants to merge 2 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Bjordis Collaku (bjordiscollaku)
added a commit
that referenced
this pull request
Sep 2, 2026
Pre-merge validation only, for PR #108. The permanent value is main, matching the docker-pkg-build checkout convention; this override lets the actual new script run in a real dispatch before merge, mirroring the same temporary-dispatch-input pattern already used for controlled distro validation testing. Will be reverted before this PR is marked ready for review. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Packages built from resolute-qcom-devel currently carry the same
version as whatever Canonical tag they were last rebased onto,
regardless of how many Qualcomm commits have landed on top since. A
build with five Qualcomm patches and a build with eight are versioned
identically, so the version string alone cannot distinguish them, and
apt/dpkg have no way to see a newer patched build as an upgrade over
an older one.
- Adds scripts/apply-local-version-suffix.sh, which appends
+qcom<N>.g<sha> to the topmost debian/changelog entry, where N is
the commit count past the last Canonical sync tag and <sha> is the
short commit hash. N sorts numerically ahead of the SHA, so ordering
between successive builds is always correct, and the leading + sorts
above the bare Canonical version per Debian Policy's convention for
local modifications.
- Only applies to resolute-qcom-devel builds with commits past the
last sync tag. Skipped for resolute-qcom mirror builds and exact
kernel_version-pinned builds, which must stay byte-identical to the
real Canonical upload, and skipped when HEAD is exactly a sync tag.
- Finds the nearest Ubuntu-qcom-* tag through the GitHub Compare API
rather than local git tags: the checkout is shallow and never
carries tag refs, deepening commit history alone does not fetch
tags, and this repository mirrors Ubuntu's full upstream history, so
a blanket "git fetch --tags" is unsafe on every build. Verified
empirically: a real depth-1 clone fails git describe outright ("No
names found"), while the Compare API gives an identical, correct
answer with no local tag fetch at all.
- Never fails the kernel build itself. The script writes a full
replacement changelog to a temp file and swaps it in with mv at the
end, so a failure partway through leaves the real changelog
untouched, and the calling workflow step downgrades any non-zero
exit to a warning.
- Adds a "Checkout CI scripts" step, its own path (matching kernel-src
and docker-pkg-build, since checking out to the workspace root would
clean the whole workspace and delete kernel-src), pinned to main:
this repository's own CI scripts must always come from the trusted
default branch, never from whatever ref is being built, including
when this workflow is called via workflow_call from premerge-pr.yml,
where github.sha reflects the caller's resolute-qcom-devel merge
commit rather than main.
- Sets persist-credentials: false on this and the two other checkout
steps in this file (kernel source, docker-pkg-build), per zizmor's
credential-persistence finding. Neither needs the checkout token
afterward: the devel-PR merge step already authenticates its own
git remote independently.
- Surfaces the resolved version in the existing build summary table.
Verified against the real repository before writing any workflow
change: constructed the actual changelog prepend against the real
fetched debian.qcom/changelog content and confirmed dpkg-parsechangelog
parses the full result cleanly, including the untouched older entry
beneath it; confirmed abi_release and uname -r are unaffected, since
both derive only from the portion of the version before the appended
suffix; confirmed worst-case filename length stays well under
filesystem limits; and confirmed no script in qcom-distro-images parses
package versions via a fragile filename regex that this could break,
since all of it goes through dpkg-deb metadata instead.
Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Pre-merge validation only, for PR #108. Permanent value is main, matching the docker-pkg-build checkout convention; this override lets the new script run in a real dispatch before merge. Revert before marking this PR ready for review. Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Bjordis Collaku (bjordiscollaku)
force-pushed
the
feat/qcom-devel-local-version-suffix
branch
from
September 2, 2026 21:06
0c02136 to
cb3f30a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Packages built from resolute-qcom-devel currently carry the same
version as whatever Canonical tag they were last rebased onto,
regardless of how many Qualcomm commits have landed on top since. A
build with five Qualcomm patches and a build with eight are versioned
identically, so the version string alone cannot distinguish them.
Fix
Adds a build-time local version suffix,
+qcom<N>.g<sha>, applied onlyto resolute-qcom-devel builds that carry commits past the last
Canonical sync tag. No changes to Canonical packaging under debian/,
nothing is ever committed back to git.
scripts/apply-local-version-suffix.sh: computes N (commits pastthe nearest Ubuntu-qcom-* tag) via the GitHub Compare API rather
than local git tags, since the checkout here is shallow and this
repository's tag namespace is unsafe to fetch blindly. Rewrites
debian/changelog atomically (temp file, then mv).
steps in build-kernel.yml, positioned after the devel-PR merge and
before the actual build. Pinned to main, never to whatever ref is
being built, for the same reason the docker-pkg-build checkout below
it is pinned to main.
build itself.
Status
Draft, work in progress. Raising now to spin a validation build
directly from this branch before marking ready for review.