diff --git a/CODEX_HANDOFF.md b/CODEX_HANDOFF.md new file mode 100644 index 0000000..c8ae7e0 --- /dev/null +++ b/CODEX_HANDOFF.md @@ -0,0 +1,60 @@ +# Codex Handoff + +Last updated: 2026-06-28 + +## Purpose + +This file is the stable restart point for future Codex sessions in this repository. If a session is closed, the next session should read this file first, then continue from the listed state and backlog. + +## Current State + +- Repository: `X-OpenWrt-New` +- Branch: `master` +- Latest completed task: fixed the Z workflow UEFI VMDK S3 upload path typo. +- Latest task commit: `175b268 fix z s3 upload path` +- AI log for that fix: `AI_CHANGELOG_Z_S3_UPLOAD_PATH.md` +- Backlog file: `NOTES_GHA_XYZ_OPTIMIZATION.md` + +## Continuation Rule + +When continuing this work, start with: + +```bash +git status --short +git log --oneline -5 +sed -n '1,140p' CODEX_HANDOFF.md +sed -n '1,180p' NOTES_GHA_XYZ_OPTIMIZATION.md +``` + +Then continue from the next unresolved high-priority backlog item. + +## Next Work + +The first backlog item is already fixed in commit `175b268`. + +Next unresolved high-priority item: + +1. Add `if` conditions to all S3/SharePoint upload steps in: + - `.github/workflows/X-x86_64_X.yml` + - `.github/workflows/X-x86_64_Y.yml` + - `.github/workflows/X-x86_64_Z.yml` + +Expected condition: + +```yaml +if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() +``` + +## Commit Discipline + +- Fix one backlog issue per commit unless the user asks for a batch. +- Keep each fix scoped to the files required for that issue. +- Add a separate `AI_CHANGELOG_*.md` file for each AI-made fix. +- Do not revert unrelated user changes. +- Before committing, check `git status --short` and staged diff. + +## Suggested Prompt For Next Session + +```text +继续之前的任务。请先读取 CODEX_HANDOFF.md 和 NOTES_GHA_XYZ_OPTIMIZATION.md，从下一个未解决的 High Priority 问题开始修复，并为本次修复创建单独的 AI 修改日志和合适的 commit。 +``` diff --git a/NOTES_GHA_XYZ_OPTIMIZATION.md b/NOTES_GHA_XYZ_OPTIMIZATION.md new file mode 100644 index 0000000..b70c5ec --- /dev/null +++ b/NOTES_GHA_XYZ_OPTIMIZATION.md @@ -0,0 +1,246 @@ +# GitHub Actions X/Y/Z Scan Notes + +Scan date: 2026-06-28 + +## Scope + +Target GitHub Actions: + +- `.github/workflows/X-x86_64_X.yml` +- `.github/workflows/X-x86_64_Y.yml` +- `.github/workflows/X-x86_64_Z.yml` + +Target OpenWrt config files: + +- `Configs/x86_64-X` +- `Configs/x86_64-Y` +- `Configs/x86_64-Z` + +Build scripts used by these workflows: + +- `Scripts/AutoBuild_Getenv.sh` +- `Scripts/AutoBuild_DiyScript.sh` +- `Scripts/AutoBuild_Function.sh` +- `Scripts/AutoBuild_Upcheck.sh` + +Related directories: + +- `.github/workflows`: GitHub Actions workflow definitions. +- `Configs`: OpenWrt `.config` profiles. +- `Scripts`: shared build/env/update helper scripts. +- `CustomFiles`: patches, dependency files and Kconfig fragments injected by scripts. + +## Optimization Backlog + +### High Priority + +1. Fix Z workflow S3 upload path typo. + - File: `.github/workflows/X-x86_64_Z.yml` + - Location: around line 322 + - Problem: `FILE: ./${{ steps.date.outputs.date }}e/${{ env.SP_UEFI_VMDK }}` has an extra `e`, so UEFI VMDK upload will look in the wrong directory. + +2. Add `if` conditions to all S3/SharePoint upload steps. + - Files: `.github/workflows/X-x86_64_X.yml`, `.github/workflows/X-x86_64_Y.yml`, `.github/workflows/X-x86_64_Z.yml` + - Locations: X around lines 316-350, Y around lines 311-345, Z around lines 310-366 + - Problem: `SharePoint` input is written to `$GITHUB_ENV`, but these upload steps do not check `env.SharePoint == 'true'` or `env.Result == 'true'`. + - Suggested condition: `if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()`. + +3. Fix build result detection for `make | tee`. + - Files: all X/Y/Z workflows + - Locations: X around line 223, Y around line 220, Z around lines 217-220 + - Problems: + - X/Y use `make -j4 | tee ... || make -j1 V=s`; without `set -o pipefail`, the pipeline can succeed because `tee` succeeds even when `make` fails. + - Z adds `pipefail`, but then runs `sed` after `make`; `$?` is likely checking `sed`, not the build. + - Suggested pattern: run `set -o pipefail`, run primary build, run fallback build on failure, store the build exit code immediately, then write `Result=true/false`. + +4. Move Z mosdns `sed` fix before build. + - File: `.github/workflows/X-x86_64_Z.yml` + - Location: around lines 217-219 + - Problem: `sed -i 's/CGO_ENABLED=0/CGO_ENABLED=1/g' feeds/packages/net/mosdns/Makefile` is after `make`, so the intended fix is applied too late. X/Y apply it before `make`. + +5. Stop mutating tracked config files during workflow execution. + - Files: all X/Y/Z workflows + - Locations: X around lines 191-195, Y around lines 188-192, Z around lines 187-191 + - Problem: `CONFIG_DEVEL` and `CONFIG_CCACHE` are appended to `$GITHUB_WORKSPACE/Configs/$CONFIG_FILE`. This mutates the checked-out repo copy and can duplicate lines during reruns or debugging. + - Suggested fix: copy the selected config to a temp file or `.config` first, then append CI-only options there. + +6. Fix likely wrong config append in `Firmware_Diy_Main`. + - File: `Scripts/AutoBuild_Function.sh` + - Location: around line 133 + - Problem: `echo -e "\nCONFIG_PACKAGE_luci-app-autoupdate=y" >> ${CONFIG_FILE}` runs after `cd openwrt`; `${CONFIG_FILE}` is the config name such as `x86_64-Z`, not `.config` or the full config path. This probably creates/edits an unintended file under `openwrt`. + - Suggested target: `${CONFIG_TEMP}` or the generated `.config`. + +7. Fix clone path/workdir usage. + - Files: all X/Y/Z workflows + - Locations: X around lines 160-163, Y around lines 157-160, Z around lines 156-159 + - Problem: `/workdir` is created, but `git clone ... openwrt` clones into the workspace, then `ln -sf /workdir/openwrt $GITHUB_WORKSPACE/openwrt` does not move the clone into `/workdir`. + - Suggested fix: `git clone -b "$REPO_BRANCH" "$REPO_URL" /workdir/openwrt` then symlink `/workdir/openwrt` into `$GITHUB_WORKSPACE/openwrt`, or remove `/workdir` entirely. + +8. Make `Check Build Update` conditional. + - Files: all X/Y/Z workflows + - Locations: X around lines 228-232, Y around lines 224-228, Z around lines 222-226 + - Problem: update checking runs even if the build failed or release upload is disabled. It depends on `openwrt/build_log.log` and remote release files. + - Suggested condition: `if: env.Result == 'true' && env.Release == 'true' && env.UPLOAD_RELEASES == 'true' && !cancelled()`. + +9. Remove hard-coded release repository from update checker. + - File: `Scripts/AutoBuild_Upcheck.sh` + - Locations: around lines 97 and 114 + - Problem: release history is fetched from `X-OpenWrt/X-OpenWrt-Dev`, while workflows upload to `${{ github.repository }}`. + - Suggested fix: use `${GITHUB_REPOSITORY}` or pass the repository as an argument. + +10. Replace deprecated `::set-output`. + - Files: all X/Y/Z workflows + - Locations: X around line 68, Y around line 83, Z around line 84 + - Problem: `::set-output` is deprecated. + - Suggested fix: `echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"`. + +11. Add explicit workflow permissions. + - Files: all X/Y/Z workflows + - Problem: releases and workflow-run deletion need write permissions. Current workflows rely on defaults. + - Suggested block: `permissions: contents: write, actions: write` with the minimum needed per workflow. + +12. Add concurrency control. + - Files: all X/Y/Z workflows + - Problem: multiple runs can upload to the same `AutoUpdate` tag and same date tag, causing races and overwrites. + - Suggested fix: add `concurrency` keyed by workflow/config, or include run id in per-run release tags. + +### Maintainability + +13. Consolidate X/Y/Z workflows. + - Files: all X/Y/Z workflows + - Problem: the three files are mostly copies, and drift has already produced Z-only bugs. + - Suggested fix: create one reusable workflow with `config_file` and `flag` inputs, or one matrix workflow for X/Y/Z. + +14. Pin actions to stable versions or SHAs. + - Files: all X/Y/Z workflows + - Examples: `actions/checkout@main`, `actions/upload-artifact@main`, `easimon/maximize-build-space@master`, `klever1988/cachewrtbuild@main`, `GitRML/delete-workflow-runs@main`, `xopenwrt/s3-upload-github-action@master` + - Problem: moving branches reduce reproducibility and increase supply-chain risk. + - Suggested fix: use versioned tags such as `actions/checkout@v4`, `actions/upload-artifact@v4`, or commit SHAs for third-party actions. + +15. Use typed `workflow_dispatch` inputs and normalize defaults. + - Files: all X/Y/Z workflows + - Locations: inputs around lines 14-28 + - Problems: + - `Release` and `SharePoint` are free-form strings. + - `repository_dispatch` has no `github.event.inputs`, so manual defaults may not apply. + - `Tempoary_*` is misspelled and spread across workflows/scripts. + - Suggested fix: use boolean typed inputs where possible; add safe defaults in shell; keep old `Tempoary_*` as compatibility aliases if renaming. + +16. Validate user inputs before using them in shell. + - Files: all X/Y/Z workflows and `Scripts/AutoBuild_Function.sh` + - Problems: dispatch inputs are interpolated directly into shell blocks and `$GITHUB_ENV`. + - Suggested fix: pass inputs through `env:`, quote variables, validate config names against `Configs/*`, validate IP by regex plus octet range, and restrict flag characters. + +17. Replace repeated S3 upload steps with a loop or matrix. + - Files: all X/Y/Z workflows + - Problem: four nearly identical upload steps make path/name mistakes easy. + - Suggested fix: generate a list of existing firmware files and upload in a small script, or use a matrix with `FILE` values. + +18. Make firmware glob handling robust. + - Files: all X/Y/Z workflows + - Locations: `Download Github Release API` step, X around lines 279-314, Y around lines 274-309, Z around lines 273-308 + - Problem: if a glob has no match, the literal pattern can be exported and uploaded. + - Suggested fix: use `shopt -s nullglob`, arrays, and skip missing files explicitly. + +19. Normalize line endings and final newlines. + - Files: `.github/workflows/X-x86_64_Y.yml`, `.github/workflows/X-x86_64_Z.yml`, `Configs/x86_64-Y`, `Configs/x86_64-Z` + - Problem: diff showed CRLF-style content and missing newline at EOF in config files. + - Suggested fix: standardize on LF and add final newline. + +20. Remove debug/noise differences between X/Y/Z. + - File: `.github/workflows/X-x86_64_Z.yml` + - Examples: `docker images` around line 150, extra `ls` around lines 254 and 394 + - Problem: useful while debugging, but causes drift and noisy logs if kept permanently. + +### Build Efficiency + +21. Revisit download/build parallelism. + - Files: X/Y/Z workflows + - Examples: X uses `make download -j32`; Y/Z use `-j8`; all build with `make -j4`. + - Suggested fix: use a shared variable such as `BUILD_JOBS: $(nproc)` or a conservative configured number, then keep all workflows consistent. + +22. Trim duplicate and unnecessary apt packages. + - Files: all X/Y/Z workflows + - Locations: init environment package list + - Examples: `zlib1g-dev` and `git` appear more than once; editors like `vim`, `nano`, `lrzsz` are probably unnecessary in CI. + - Suggested fix: keep only required build dependencies and split comments by category. + +23. Move package replacement before defconfig/download where possible. + - Files: all X/Y/Z workflows + - Locations: adguardhome/passwall package deletion and symlink in build step + - Problem: package replacement happens after `feeds install`, `make defconfig`, and `make download`; selected package metadata/download behavior may drift from the package actually built. + - Suggested fix: perform package overrides before final `make defconfig` and `make download`. + +24. Pin external package repositories or document why moving branches are used. + - Files: workflows and `Scripts/AutoBuild_DiyScript.sh` + - Examples: `sbwml/packages_lang_golang -b 26.x`, `OpenWrt-Passwall main`, `fw876 master`, `xopenwrt master` + - Problem: builds can change without repo changes. + - Suggested fix: pin to commits/tags for reproducible builds, or accept moving branches but document it. + +### Script Robustness + +25. Add stricter error handling carefully to scripts. + - Files: `Scripts/AutoBuild_*.sh` + - Problem: helper functions often log failures but return success, so missing packages/files can be hidden. + - Suggested fix: introduce `set -euo pipefail` only after auditing expected non-fatal commands, or make critical helpers return non-zero on failure. + +26. Quote variables in shell scripts. + - Files: `Scripts/AutoBuild_Function.sh`, `Scripts/AutoBuild_Upcheck.sh`, `Scripts/AutoBuild_DiyScript.sh` + - Examples: `cd $1`, `grep $1`, `find $2`, `rm ${SVN_REPO_NAME} -rf`, many `cat openwrt/${build_pkg_dir}/Makefile` + - Problem: spaces, glob characters, or empty variables can cause unintended behavior. + +27. Fix `Get_Release_Info`. + - File: `Scripts/AutoBuild_Getenv.sh` + - Location: around line 28 + - Problem: backticks around `cat ... | grep ...` execute the grep output as a command. + - Suggested fix: `grep 'KERNEL_PATCHVER:=' "${OPENWRT_BUILD_DIR}/target/linux/x86/Makefile"`. + +28. Make external IP lookup non-blocking. + - File: `Scripts/AutoBuild_Getenv.sh` + - Locations: around lines 18-21 + - Problem: build info step depends on external APIs for logging. + - Suggested fix: add `curl --connect-timeout 5 --max-time 10` and tolerate failures. + +29. Improve `AutoBuild_Upcheck.sh` parsing. + - File: `Scripts/AutoBuild_Upcheck.sh` + - Locations: around lines 23-93 + - Problems: parses build logs with multiple `cat | grep` chains, assumes Makefiles exist, and may duplicate package entries. + - Suggested fix: use `awk/sort -u`, quote paths, skip missing Makefiles, and record warnings. + +30. Improve release tag comparison. + - File: `Scripts/AutoBuild_Upcheck.sh` + - Locations: around lines 97-114 + - Problem: date tags are compared lexically and initialized with `v2023-1-1`. + - Suggested fix: normalize tags to `vYYYY-MM-DD`, sort with `sort -V` or parse dates explicitly. + +### Config Maintenance + +31. Split common x86_64 config fragments from X/Y/Z differences. + - Files: `Configs/x86_64-X`, `Configs/x86_64-Y`, `Configs/x86_64-Z` + - Problem: target/image/IPv6/theme/base package settings are repeated, while X/Y/Z differ mainly by feature level. + - Suggested fix: maintain `x86_64-common`, `x86_64-X.fragment`, `x86_64-Y.fragment`, `x86_64-Z.fragment`, then concatenate into `.config` in the workflow. + +32. Shrink configs with OpenWrt diffconfig. + - Files: `Configs/x86_64-X`, `Configs/x86_64-Y`, `Configs/x86_64-Z` + - Problem: configs include redundant selected dependencies and stale comments. + - Suggested fix: after a successful build, use OpenWrt `scripts/diffconfig.sh` to keep only meaningful deltas. + +33. Re-check Z Image Builder expectations. + - File: `Configs/x86_64-Z` + - Locations: around lines 8-10 + - Problem: Z enables `CONFIG_IB` and `CONFIG_IB_STANDALONE`, but the workflow still processes/uploads only firmware image patterns. + - Suggested fix: decide whether Image Builder artifacts should be uploaded, ignored, or disabled. + +34. Clean stale kernel comments. + - Files: `Configs/x86_64-X`, `Configs/x86_64-Y`, `Configs/x86_64-Z` + - Problem: commented `KERNEL_PATCHVER` lines do not affect OpenWrt config and can mislead later edits. + - Suggested fix: remove stale comments or move kernel selection into the correct build mechanism. + +## Suggested First Fix Batch + +1. Fix Z upload path typo and Z mosdns build-order issue. +2. Add S3 upload `if` conditions using `SharePoint`, `Result`, and `!cancelled()`. +3. Replace all build commands with a shared pipefail-safe result pattern. +4. Stop appending CI-only config options to tracked `Configs/*`. +5. Replace deprecated `set-output` with `$GITHUB_OUTPUT`. +