Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Change detection can skip required checks, tiering leaves a tune unbuilt, and Docker refreshes can retain stale base images.
3 open issues
What changed in this PR
This PR reduces Yocto CI build time through tiered machine coverage and shared caches, while updating workflow security and maintenance.
Changes:
- Build five tier-1 machines and validate twelve others with layer signature checks.
- Reuse Docker images, persist hash-equivalence data, and schedule cache pruning.
- Replace third-party change detection, pin actions, and configure Renovate.
| File | Description |
|---|---|
renovate.json |
Configure automated dependency updates. |
.github/workflows/yocto-layer.yml |
Add tier-2 machine validation. |
.github/workflows/yocto-builds.yml |
Reduce the build matrix to tier 1. |
.github/workflows/prune-caches.yml |
Schedule stale sstate cleanup. |
.github/workflows/mirror.yml |
Update the pinned mirror action. |
.github/workflows/docker-images/yocto-builder/entrypoint-yocto-check-layer.sh |
Pass machines to layer checks. |
.github/workflows/docker-images/yocto-builder/entrypoint-build.sh |
Persist hash-equivalence data. |
.github/workflows/docker-images/yocto-builder/Dockerfile |
Reduce package-manager log noise. |
.github/workflows/compliance.yml |
Update action pins and Docker handling. |
.github/workflows/cancel-redundant-workflows.yml |
Remove superseded cancellation workflow. |
.github/actions/docker-cleanup/action.yml |
Clean runner containers and old images. |
.github/actions/docker-clean-image/action.yml |
Remove per-job image cleanup. |
.github/actions/docker-build/action.yml |
Cache images by build-context hash. |
.github/actions/changed-files/action.yml |
Add local change detection. |
Review effort: Balanced
agherzan
force-pushed
the
ag/ci-tiers
branch
3 times, most recently
from
October 18, 2026 22:58
8f77cab to
210d254
Compare
omxplayer is deprecated upstream in favour of VLC and relies on the legacy OMX/MMAL userland stack. It also depends on libssh and libpcre from meta-oe while living outside dynamic-layers, which breaks world on 32-bit machines without meta-oe (yocto-check-layer test_machine_world). Use rpidistro-ffmpeg or GStreamer with the default vc4 stack instead. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
picamera uses the legacy MMAL camera stack, which Raspberry Pi documents as deprecated and unsupported since Bullseye, with Picamera2 on libcamera as its replacement [1][2]. libcamera is available through the multimedia-layer dynamic layer. The recipe also fetches over SSH and RDEPENDS on python3-colorzero from meta-python while living outside dynamic-layers, which breaks world without meta-python (yocto-check-layer test_machine_world). picamera-libs only provides picamera's firmware libraries. [1] https://www.raspberrypi.com/documentation/computers/camera_software.html [2] https://github.com/raspberrypi/picamera2 Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
The cyfmac43455-sdio.bin link depends on CYFMAC43455_SDIO_FIRMWARE, which differs for raspberrypi5 based machines. As an allarch recipe, machines sharing a TMPDIR produced conflicting packages for the same "all" architecture (yocto-check-layer test_machine_signatures). Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Full builds of 16 machines run serially on one runner and take 5-17h per PR. Most of them share tune, defconfig and DTBs with another machine. Build rpi-test-image only for raspberrypi0-wifi, raspberrypi-armv7, raspberrypi-armv8, raspberrypi3-64, raspberrypi4-64 and raspberrypi5, which together cover every tune, defconfig and kernel recipe. Run yocto-check-layer with every machine in conf/machine. Its BSP machine tests were skipped until now as no machines were passed. The machines are listed from the layer, so new ones are checked without workflow changes. Also trigger yocto-layer.yml on changes to itself. Fixes #1633 Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
If the retry succeeds at the 3rd try, the final check would have failed. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Drop the dependency on tj-actions/changed-files and replace it with a local composite action. Especially given it was compromised in the past - see CVE-2025-30066. The action diffs HEAD^1..HEAD of the PR merge commit that actions/checkout checks out by default. It fails if HEAD is not a merge commit, so a change to the checkout ref can't silently diff the wrong range. With this in place, both of the workflows can share a consistent list of paths. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Bump actions/checkout from v3 to v7.0.1, as v3 runs on the deprecated node16 runtime. Bump fsfe/reuse-action from v1 to v6.0.0. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Nothing after checkout should need the GITHUB_TOKEN so persisting would only be an extra risk. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
We were rebuilding Docker images from scratch with --no-cache, tagged by PR number. With this, we were building multiple images per PR for the same context. This change tags the images by the git tree hash of the build context and only build if the tag is missing. This naturally covers rebuilding on build context changes. Finally, this change handles refreshing images every 7 days (for example to refresh OS packages) and prune by CI label after 14 days. The gap ensures an image a running job just picked up isn't pruned under it. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
BB_HASHSERVE defaults to "auto", which stores hashserv.db in the build directory. CI builds in a temporary build directory, so the database was discarded after every job and equivalent outputs from previous builds were never matched. Store it in SSTATE_DIR, next to the artifacts it references. This also aligns to bitbake-setup default behaviour. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
cancel-redundant-workflows.yml had some overhead as it was spawning an extra workflow_run job per workflow. With concurrency groups, a new push cancels the PR's previous run directly. A cancelled step can leave its docker container running against the shared sstate. Label containers with the runner name and remove them in the cleanup step. Rename docker-prune-images to docker-cleanup accordingly. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Nothing removes artifacts from the runner's SSTATE_DIR, so it grows without bound. Delete sstate files not touched in 30 days. bitbake touches sstate files whenever a build checks or unpacks them, so mtime tracks last use across all branches. DL_DIR is not pruned. Download stamps are only touched by do_fetch, which sstate-restored recipes skip, so their age doesn't reflect whether a rebuild would need them. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Keep the pinned GitHub Actions and Dockerfile base images up to date. Commits follow the repository conventions and are signed off for DCO. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
The checkout is owned by the runner user while the container runs as ci, so git refuses to read /work. Mark it as a safe directory, as the DCO check already does. Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
agherzan
changed the title
agherzan
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
- What I did
CI built 16 machines serially on one runner, 5-17 h per PR, while 12 of them reused another machine's tune, defconfig, and DTBs.
Fixes #1633