This commit migrates the repository validation to a webhook-based bot instead of the GitHub Actions workflow (.github/workflows/formal.yml).
Since the bot handles stable branch labeling automatically (via the "branch_labeling: true" configuration option), the redundant branch check and labeling steps are removed from .github/workflows/labeler.yml.
The following configuration choices are applied in formalities.json:
- check_space_after_assignment: false (Disabled temporarily to catch any issues since it is a newly implemented check)
- check_makefile_indentation: false (Disabled temporarily to catch any issues since it is a new feature)
- check_patch_headers: 'warning' (Changed to warning instead of hard error since many legacy patches lack headers)
- enable_stale_bot: false (Disabled for now)
Other configurations can be adjusted in formalities.json based on the openwrt-bot-worker repository [1].
[1] https://github.com/openwrt/openwrt-bot-worker
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24256
(cherry picked from commit 9146f931b6)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Drop the pull_request_target trigger so the LLM review no longer runs
on opened/reopened PRs. We are limited to 15 Claude routine runs per
day, and the automatic per-PR trigger exhausted that budget on
several days, starving the nightly digest.
The nightly schedule and manual workflow_dispatch triggers remain.
Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 4871040d5d)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Manual workflow_dispatch and push share the same ref on main, so
they previously landed in the same concurrency group
'Build Kernel-refs/heads/main' (and the equivalent for the packages
workflow). With cancel-in-progress: false for non-PR events, only
one run can be pending per group: a newer queued run cancels the
older pending one.
That made the manual trigger unreliable in both directions. A push
landing while a dispatch was queued displaced the dispatch (so the
ccache reseed never ran), and dispatching while a push was queued
displaced the push (so the legitimate per-commit build was lost).
Adding github.event_name to the concurrency group puts pushes,
dispatches, and pull_requests in separate buckets on the same ref,
so they no longer compete with each other.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/23283
(cherry picked from commit 3c7a1418c1)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Allow the Build Kernel and Build all core packages workflows to be
launched manually from the Actions tab. The shared workflow side
detects workflow_dispatch and, for Build Kernel, rebuilds the full
target/subtarget matrix including testing kernel versions, so a
manual run can re-seed the s3 ccache when a queued push run got
displaced from the concurrency queue by the next commit on main.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/23283
(cherry picked from commit d9e6f9dce8)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Drop-in wrapper that calls the reusable LLM review workflows in
openwrt/actions-shared-workflows. Triggers on pull_request_target
(incl. PRs from forks), a nightly cron (03:00 UTC), and manual
workflow_dispatch with a max_prs input override.
A detect-kernels pre-step builds the extra_repos list at workflow
runtime: it reads target/linux/generic/kernel-* in the base branch
to derive gregkh/linux:v<X.Y.Z> tags for each currently-targeted
kernel, then appends u-boot/u-boot:master. The list updates
automatically when kernel versions are bumped; the routine clones
only the entries actually needed for a given diff.
The bundled .github/llm-review-rules.md teaches the bot two
project-specific deprecations to flag even when other in-tree files
still use the legacy form:
- LED label syntax `label = "<color>:<function>";` -->
`color = <LED_COLOR_ID_*>;` + `function = "<func>";`
- `mediatek,mtd-eeprom` for MAC sourcing -->
`nvmem-cells` + `nvmem-cell-names = "mac-address";`
Repository settings need LLM_ROUTINE_ID_PR / LLM_ROUTINE_TOKEN_PR
and the *_NIGHTLY counterparts populated before the workflow can
fire. See openwrt/actions-shared-workflows/docs/llm-review-setup.md
for the full setup procedure.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23105
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit af3cbd4013)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Without a prompt the action auto-detected mode: tag instead of agent
when triggered via issue_comment, resulting in no review being posted.
Remove the prompt so the action can correctly use its built-in agent
mode with full PR context.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 62ca0a987f)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The claude-code-action uses mcp__github_ci__get_ci_status and related
tools to check workflow run status as part of the review. Without
actions: read the GitHub API calls for CI status are rejected.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 122b2f2ef5)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The whitelist was too restrictive, causing permission denials when
Claude tried to use basic tools like Read or Grep to analyse the diff.
Remove it and let the action use its default toolset.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 29e1c7b85a)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add claude-code-review.yml using anthropics/claude-code-action@v1.
The review runs when a PR comment containing "/claude" is posted,
avoiding unnecessary API usage on every push.
Uses issue_comment trigger restricted to PR comments only. Only
triggers for users with write access (OWNER, MEMBER, COLLABORATOR)
and when the comment body contains "/claude", preventing any runner
from being allocated for unrelated comments. A short domain hint
steers the review toward OpenWrt embedded Linux conventions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22556
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit c0e75c9de6)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Run this only when a PR is created, so either author or anyone who can
edit the PR message (all maintainers) can trigger such build.
Instead of maintaining it in the main repository, move it to the
external repository to bloat this repository less with further CI
commits.
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 8cff0d8ca0)
Link: https://github.com/openwrt/openwrt/pull/24318
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
While this worked during testing, the repository of a organization requires
extra permissions. Add write access to pull requests, like we do over at
packages.git.
Signed-off-by: Paul Spooren <mail@aparcar.org>
This has been requested many times, so let's add this to speed up reviews. When
a member of the "reviewers" group comments the magic word written below, that
specific firmware is created and attached by a bot.
build <target>/<subtarget>/<profile>
Members of the "reviewers" group have no extra privileges, they can not commit
to the repository nor perform any action outside the `build-on-comment` action.
Motivation is to speedup reviews and have a better source for sharing compiled
firmware.
Signed-off-by: Paul Spooren <mail@aparcar.org>
* Version 5 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16251
Signed-off-by: Robert Marko <robimarko@gmail.com>
Use shared workflow in actions-shared-workflows instead of keeping the
workflow in openwrt main branch to make it easier to maintain and update
without bloating the main repository commit history.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add issue labeler action. This action will parse BUG issue from the
template and will make validation on the insert data.
The action will:
- Tag the issue with SNAPSHOT or release based on the provided release
- Tag the issue with the reported tag
- Tag the issue with the image kind (Official or Self Built)
- Validate the reported version exist
- Validate the reported release exist
- Validate the reported device exist
Will also tag the issue with useful tag or flag the issue as invalid.
Will also comment the issue with the invalid info provided.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Implement a GitHub Actions workflow for automated project releases.
The workflow triggers on Git tags, ensuring that a GitHub release is
created whenever a new tag is pushed.
That new release is going to be created in draft and pre-release mode
and needs to be manually promoted to the proper release, once its
decided, that its good enough and prepared.
This is a start of a streamlined and consistent release process for
GitHub, reducing manual intervention.
Acked-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Provide new required secret for S3 endpoint and bucket name to permit an
easier migration to new services.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Drop unused reusable workflow and dockerfiles now that we moved them to
a dedicated repository.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Migrate each workflow to use reusable workflow from dedicated repo to
skip pushing CI related commits to openwrt and better track versioning
of CI workflow.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Now that we build also core packages, we need more host tools. Compile
all of them to reduce compile time on other actions.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add support to label-kernel for compiling testing kernel version and
check patches. To trigger this special build appent :testing to the
normal label.
Example:
- ci:kernel:ipq806x:generic:testing
Test will fail if the requested target doesn't have a defined kernel
testing version.
Also add support for testing all target and subtarget. To trigger this
some special pattern are added:
- ci:kernel:all:all
Trigger test for all target and subtarget
- ci:kernel:all:first
Trigger test for all target and the first subtarget in alphabetical
order for the target.
With these special case :testing can also be used and every target and
subtarget that supports kernel testing version will be selected:
- ci:kernel:all:all:testing
Trigger test for all target and subtarget that have a kernel testing
version defined.
- ci:kernel:all:first:testing
Trigger test for all target and the first subtarget in alphabetical
order for the target that, if they have a kernel testing version
defined.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
CDNs are known to ship outdated or corrupted files, if it unpacks
correctly, it necessarily doesn't mean, that we're using the desired
content. So lets fix it by checking the tarball as well.
I'm adding GPG checking explicitly, its not needed, but just double
checking, that everything is working as expected on build
infrastructure.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Its being used by buildbot workers, adds g++-multilib to fix node
cross-compilation from a 64-bit build machine to 32-bit host.
References: https://github.com/openwrt/buildbot/pull/7
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Add support for getting ccache cache from S3.
ccache is archieved in a tar and downloaded from S3 Cloud Storage.
For push events, ccache is then uplodaed back to S3 to refresh and have
a ccache cache always fresh.
An additional workflow is added to upload files to an S3 Cloud Storage
from artifacts uplodaed to github. The minio tool is used to upload
files to S3.
If the ccache can't be downloaded from s3, we fallback to github cache
system.
Also limit s3 upload to the openwrt repository since external fork won't
have (obviously) the required secrtes to upload data to the S3 Cloud
Storage.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Limit ccache cache save/delete only on push events. Saving ccache
cache for pull request will result in bloat and refreshing ccache is not
possible due to security measure on enforcing read permission on
pull_request events.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
CCache cache is currently broken due to a funny bug in ccache compiler
type detection. It seems ccache compiler type detection is very fragile
and with the use of external toolchain doesn't correctly detect the
type.
The type detected is set to other instead of gcc resulting in ccache
complaining for unsupported compiler options.
To handle this problem, force the compiler type to gcc to make ccache
correctly work and speedup compilation.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Josef Schlehofer
Hauke Mehrtens
Paul Spooren
George Sapkin
Goetz Goerisch
Robert Marko
Christian Marangi
Petr Štetiar