docs annotate x86 config profiles

ci retry package downloads serially
docs refresh ai task backlog
2026-09-27 07:14:43 +00:00 · 2026-06-30 23:40:39 +08:00 · 2026-06-30 23:31:42 +08:00 · 2026-06-29 23:31:49 +08:00 · 2026-06-29 22:31:12 +08:00 · 2026-06-29 22:28:58 +08:00
39 changed files with 1179 additions and 366 deletions
@@ -256,7 +256,7 @@ jobs:
        echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV

    - name: 1 Upload SP_UEFI_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -267,7 +267,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_UEFI_IMG_GZ }}

    - name: 2 Upload SP_UEFI_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -278,7 +278,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_UEFI_VMDK }}

    # - name: 3 Upload SP_UEFI_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -289,7 +289,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VDI }}

    # - name: 4 Upload SP_UEFI_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -300,7 +300,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VHDX }}

    - name: 5 Upload SP_LEGACY_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -311,7 +311,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_IMG_GZ }}

    - name: 6 Upload SP_LEGACY_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -322,7 +322,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VMDK }}

    # - name: 7 Upload SP_LEGACY_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -333,7 +333,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VDI }}

    # - name: 8 Upload SP_LEGACY_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -13,10 +13,12 @@ on:
    inputs:
      Release:
        description: '是否上传到Github'
-        default: 'true'
+        type: boolean
+        default: true
      SharePoint:
        description: '是否上传到SharePoint'
-        default: 'true'
+        type: boolean
+        default: true
      Tempoary_IP:
        description: '固件 IP 地址 [可选]'
        default: '192.168.2.200'
@@ -38,6 +40,14 @@ on:
  #watch:
  #  types: [started]

+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
@@ -56,6 +66,10 @@ env:
  DELETE_OLD_WORKFLOW: true
 # Cache 加速编译
  CACHE_ACCELERATE: true
+# 下载并行数
+  DOWNLOAD_JOBS: 8
+# 编译并行数
+  BUILD_JOBS: 4
 ### 结束

 jobs:
@@ -65,30 +79,29 @@ jobs:
    - name: Get current date & Set env
      id: date
      run: |
-        echo "::set-output name=date::$(date +'%Y-%m-%d')"
-        echo "Release=${{ github.event.inputs.Release }}" >> $GITHUB_ENV
-        echo "SharePoint=${{ github.event.inputs.SharePoint }}" >> $GITHUB_ENV
+        echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
+        echo "Release=${{ github.event.inputs.Release || 'true' }}" >> $GITHUB_ENV
+        echo "SharePoint=${{ github.event.inputs.SharePoint || 'true' }}" >> $GITHUB_ENV
        echo "data2=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
        echo "NOW_DATA_VERSION=v$(date +'%Y-%m-%d')" >> $GITHUB_ENV
        if [ "${{ env.DELETE_USELESS_FILES }}" == true ]
        then
-            docker rmi node:18 node:20 node:22 node:18-alpine node:20-alpine node:22-alpine alpine:3.16 alpine:3.17 alpine:3.18 moby/buildkit:latest ubuntu:20.04 debian:10 debian:11
            sudo rm -rf /usr/share/dotnet /etc/mysql /etc/php
            sudo -E apt-get -y autoremove --purge
            sudo -E apt-get clean
        fi

    - name: Maximize Build Space
-      uses: easimon/maximize-build-space@master
+      uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794
      with:
-        root-reserve-mb: 3500
-        swap-size-mb: 100
+        root-reserve-mb: 4096
+        swap-size-mb: 512
+        temp-reserve-mb: 1024
        remove-dotnet: 'true'
        remove-android: 'true'
-        remove-haskell: 'true'

    - name: Checkout
-      uses: actions/checkout@main
+      uses: actions/checkout@b9e0990d219a03df7633c93f6f005a8fecbcab22
      with:
        fetch-depth: 0

@@ -111,11 +124,19 @@ jobs:
      run: |
        echo "Free space:"
        df -h
-        if [ -n "${{ github.event.inputs.Tempoary_CONFIG }}" ]
+        INPUT_CONFIG="${{ github.event.inputs.Tempoary_CONFIG || '' }}"
+        INPUT_IP="${{ github.event.inputs.Tempoary_IP || '' }}"
+        INPUT_FLAG="${{ github.event.inputs.Tempoary_FLAG || '' }}"
+
+        if [ -n "${INPUT_CONFIG}" ]
        then
-            if [ -f "$GITHUB_WORKSPACE/Configs/${{ github.event.inputs.Tempoary_CONFIG }}" ]
+            if [[ ! "${INPUT_CONFIG}" =~ ^[A-Za-z0-9._-]+$ ]]
            then
-                CONFIG_FILE=${{ github.event.inputs.Tempoary_CONFIG }}
+                echo "Invalid CONFIG_FILE input: [${INPUT_CONFIG}]"
+                exit 1
+            elif [ -f "$GITHUB_WORKSPACE/Configs/${INPUT_CONFIG}" ]
+            then
+                CONFIG_FILE="${INPUT_CONFIG}"
            else
                CONFIG_FILE=${{ env.CONFIG_FILE }}
            fi
@@ -130,15 +151,34 @@ jobs:
            echo "CONFIG_FILE: [/Config/$CONFIG_FILE]"
            echo "CONFIG_FILE=$CONFIG_FILE" >> $GITHUB_ENV
        fi
-        if [ -n "${{ github.event.inputs.Tempoary_IP }}" ]
+        if [ -n "${INPUT_IP}" ]
        then
-            echo "IP: [${{ github.event.inputs.Tempoary_IP }}]"
-            echo "Tempoary_IP=${{ github.event.inputs.Tempoary_IP }}" >> $GITHUB_ENV
+            if [[ ! "${INPUT_IP}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]
+            then
+                echo "Invalid Tempoary_IP input: [${INPUT_IP}]"
+                exit 1
            fi
-        if [ -n "${{ github.event.inputs.Tempoary_FLAG }}" ]
+            IFS=. read -r ip1 ip2 ip3 ip4 <<< "${INPUT_IP}"
+            for octet in "$ip1" "$ip2" "$ip3" "$ip4"
+            do
+                if (( octet < 0 || octet > 255 ))
                then
-            echo "FLAG: [${{ github.event.inputs.Tempoary_FLAG }}]"
-            echo "Tempoary_FLAG=${{ github.event.inputs.Tempoary_FLAG }}" >> $GITHUB_ENV
+                    echo "Invalid Tempoary_IP input: [${INPUT_IP}]"
+                    exit 1
+                fi
+            done
+            echo "IP: [${INPUT_IP}]"
+            echo "Tempoary_IP=${INPUT_IP}" >> $GITHUB_ENV
+        fi
+        if [ -n "${INPUT_FLAG}" ]
+        then
+            if [[ ! "${INPUT_FLAG}" =~ ^[A-Za-z0-9]+$ ]]
+            then
+                echo "Invalid Tempoary_FLAG input: [${INPUT_FLAG}]"
+                exit 1
+            fi
+            echo "FLAG: [${INPUT_FLAG}]"
+            echo "Tempoary_FLAG=${INPUT_FLAG}" >> $GITHUB_ENV
        fi
        REPO_URL="https://github.com/$(cut -d \: -f 1 <<< ${{ env.DEFAULT_SOURCE }})"
        REPO_BRANCH=$(cut -d \: -f 2 <<< ${{ env.DEFAULT_SOURCE }})
@@ -152,7 +192,7 @@ jobs:
        DEBIAN_FRONTEND: noninteractive
      run: |
        sudo -E apt-get update
-        sudo -E apt-get -y install build-essential cmake asciidoc binutils bzip2 gawk gettext git libncurses5-dev zlib1g-dev patch unzip zlib1g-dev lib32gcc-s1 libc6-dev-i386 subversion flex uglifyjs git gcc-multilib g++-multilib p7zip p7zip-full msmtp libssl-dev texinfo libreadline-dev libglib2.0-dev xmlto qemu-utils upx-ucl libelf-dev autoconf automake libtool autopoint ccache curl wget vim nano python3 python3-pip python3-ply haveged lrzsz device-tree-compiler scons antlr3 gperf intltool genisoimage rsync
+        sudo -E apt-get -y install build-essential cmake binutils bzip2 gawk gettext git libncurses5-dev zlib1g-dev patch unzip lib32gcc-s1 libc6-dev-i386 subversion flex uglifyjs gcc-multilib g++-multilib p7zip p7zip-full msmtp libssl-dev texinfo libreadline-dev libglib2.0-dev qemu-utils upx-ucl libelf-dev autoconf automake libtool autopoint ccache curl wget python3 python3-pip python3-ply haveged device-tree-compiler scons antlr3 gperf intltool genisoimage rsync
        sudo -E apt-get -y install llvm clang
        sudo timedatectl set-timezone "Asia/Shanghai"
        sudo mkdir -p /workdir
@@ -160,12 +200,12 @@ jobs:

    - name: Clone Openwrt Source Code
      run: |
-        git clone -b $REPO_BRANCH $REPO_URL openwrt
+        git clone -b $REPO_BRANCH $REPO_URL /workdir/openwrt
        ln -sf /workdir/openwrt $GITHUB_WORKSPACE/openwrt

    - name: Accelerate
      if: env.CACHE_ACCELERATE == 'true'
-      uses: klever1988/cachewrtbuild@main
+      uses: klever1988/cachewrtbuild@b729f807837dbc3455d02fd35192660d9b662121
      with:
        ccache: false
        toolchain: true
@@ -181,7 +221,7 @@ jobs:
        ./scripts/feeds uninstall luci-theme-argon
        # Update golang to 1.22 for xray-core build
        rm -rf feeds/packages/lang/golang
-        git clone https://github.com/sbwml/packages_lang_golang -b 22.x feeds/packages/lang/golang
+        git clone https://github.com/sbwml/packages_lang_golang -b 26.x feeds/packages/lang/golang
 #        sed -i 's/^\s*$[(]call\sEnsureVendoredVersion/#&/' $GITHUB_WORKSPACE/openwrt/feeds/packages/utils/dockerd/Makefile
 #fix dockerd bug

@@ -189,16 +229,20 @@ jobs:
      run: |
        chmod +x Scripts/AutoBuild_*.sh
        cd openwrt
+        cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
        if [ "${{ env.CACHE_ACCELERATE }}" == true ]
        then
-            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> $GITHUB_WORKSPACE/Configs/$CONFIG_FILE
+            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> .config
        fi
-        cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_DiyScript.sh
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_Function.sh
        make defconfig
        Firmware_Diy_Before
        rm -f .config && cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
+        if [ "${{ env.CACHE_ACCELERATE }}" == true ]
+        then
+            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> .config
+        fi
        Firmware_Diy_Main
        Firmware_Diy
        Firmware_Diy_Other
@@ -208,22 +252,40 @@ jobs:
        cd openwrt
        ./scripts/feeds install -a
        make defconfig
-        make download -j32
+        mkdir -p dl
+        if ! make download -j${DOWNLOAD_JOBS}
+        then
+            echo "Parallel package download failed; retrying serially with verbose output."
+            find dl -type f -size -1024c -print -delete
+            make download -j1 V=s
+        fi
+        find dl -type f -size -1024c -print -delete

    - name: Build OpenWrt
      run: |
        cd openwrt
+        rm -rf package/feeds/packages/net/{xray-core,v2ray-geodata,sing-box,chinadns-ng,dns2socks,hysteria,ipt2socks,microsocks,naiveproxy,shadowsocks-rust,shadowsocksr-libev,simple-obfs,tcping,v2ray-plugin,xray-plugin,geoview,shadow-tls}
+        rm -rf package/feeds/luci/applications/luci-app-passwall
        rm package/feeds/packages/adguardhome -rf
        rm feeds/packages/net/adguardhome -rf
+        rm feeds/luci/applications/luci-app-adguardhome -rf
        ln -s ../../../package/other/AutoBuild-Packages/adguardhome package/feeds/packages/adguardhome
        # 2024.03.03 mosdns build fail by golang 1.22
-        sed -i 's/CGO_ENABLED=0/CGO_ENABLED=1/g' feeds/packages/net/mosdns/Makefile
-        make -j4 | tee ./build_log.log || make -j1 V=s
-        [ "$?" == 0 ] && echo "Result=true" >> $GITHUB_ENV || echo "Result=false" >> $GITHUB_ENV
+        sed -i "s/CGO_ENABLED=0/CGO_ENABLED=1/g" feeds/packages/net/mosdns/Makefile
+        set -o pipefail
+        if make -j${BUILD_JOBS} 2>&1 | tee ./build_log.log
+        then
+            build_status=0
+        else
+            make -j1 V=s 2>&1 | tee -a ./build_log.log
+            build_status=$?
+        fi
+        [ "${build_status}" == 0 ] && echo "Result=true" >> $GITHUB_ENV || echo "Result=false" >> $GITHUB_ENV



    - name: Check Build Update
+      if: env.Result == 'true' && env.Release == 'true' && env.UPLOAD_RELEASES == 'true' && !cancelled()
      run: |
        export NOW_DATA_VERSION=${{env.NOW_DATA_VERSION}}
        export GITHUB_WORKSPACE=$GITHUB_WORKSPACE
@@ -256,16 +318,19 @@ jobs:
        cd openwrt
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_Function.sh
        Firmware_Diy_End
+        cd ..
+        mkdir ${{ steps.date.outputs.date }}
+        cp openwrt/bin/Firmware/* ./${{ steps.date.outputs.date }} -r

    - name: Upload Firmware to Artifacts
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      if: env.UPLOAD_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled()
      with:
        name: ${{ env.CONFIG_FILE }}_firmware_${{ env.Compile_Date }}
        path: openwrt/bin/Firmware

    - name: Upload bin to Artifacts
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      if: env.UPLOAD_BIN_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled()
      with:
        name: ${{ env.CONFIG_FILE }}_bin_${{ env.Compile_Date }}
@@ -308,93 +373,45 @@ jobs:
        echo SP_LEGACY_VDI=$(echo $SP_LEGACY_VDI) >> $GITHUB_ENV
        echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV

-    - name: 1 Upload SP_UEFI_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_UEFI_IMG_GZ }}
-        file: openwrt/bin/Firmware/${{ env.SP_UEFI_IMG_GZ }}
+    - name: 1 Upload SP_UEFI_VMDK to SharePoint
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_IMG_GZ }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  2 Upload SP_UEFI_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_UEFI_VMDK }}
-        file: openwrt/bin/Firmware/${{ env.SP_UEFI_VMDK }}
-
-    # - name: 3 Upload SP_UEFI_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_UEFI_VDI }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VDI }}
-
-    # - name: 4 Upload SP_UEFI_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_UEFI_VHDX }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VHDX }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_VMDK }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  5 Upload SP_LEGACY_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_LEGACY_IMG_GZ }}
-        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_IMG_GZ }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_IMG_GZ }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  6 Upload SP_LEGACY_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_LEGACY_VMDK }}
-        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VMDK }}
-
-    # - name: 7 Upload SP_LEGACY_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_LEGACY_VDI }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VDI }}
-
-    # - name: 8 Upload SP_LEGACY_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_LEGACY_VHDX }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VHDX }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_VMDK }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name: Delete VM Disk File
      if: env.Release=='true' && env.UPLOAD_RELEASES == 'true' && env.Result == 'true' && !cancelled()
@@ -422,7 +439,7 @@ jobs:
        overwrite: true

    - name: Delete old Workflow Runs
-      uses: GitRML/delete-workflow-runs@main
+      uses: GitRML/delete-workflow-runs@6c7cf4852e73c46502ee79494d99f5b504cacc6d
      if: env.DELETE_OLD_WORKFLOW == 'true' && !cancelled()
      with:
        retain_days: 1
@@ -170,7 +170,7 @@ jobs:
        ./scripts/feeds uninstall luci-theme-argon
        # Update golang to 1.22 for xray-core build
        rm -rf feeds/packages/lang/golang
-        git clone https://github.com/sbwml/packages_lang_golang -b 22.x feeds/packages/lang/golang
+        git clone https://github.com/sbwml/packages_lang_golang -b 25.x feeds/packages/lang/golang
 #        sed -i 's/^\s*$[(]call\sEnsureVendoredVersion/#&/' $GITHUB_WORKSPACE/openwrt/feeds/packages/utils/dockerd/Makefile
 #fix dockerd bug

@@ -299,7 +299,7 @@ jobs:
        echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV

    - name: 1 Upload SP_UEFI_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -310,7 +310,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_UEFI_IMG_GZ }}

    - name: 2 Upload SP_UEFI_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -321,7 +321,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_UEFI_VMDK }}

    # - name: 3 Upload SP_UEFI_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -332,7 +332,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VDI }}

    # - name: 4 Upload SP_UEFI_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -343,7 +343,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VHDX }}

    - name: 5 Upload SP_LEGACY_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -354,7 +354,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_IMG_GZ }}

    - name: 6 Upload SP_LEGACY_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -365,7 +365,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VMDK }}

    # - name: 7 Upload SP_LEGACY_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -376,7 +376,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VDI }}

    # - name: 8 Upload SP_LEGACY_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -13,10 +13,12 @@ on:
    inputs:
      Release:
        description: '是否上传到Github'
-        default: 'true'
+        type: boolean
+        default: true
      SharePoint:
        description: '是否上传到SharePoint'
-        default: 'true'
+        type: boolean
+        default: true
      Tempoary_IP:
        description: '固件 IP 地址 [可选]'
        default: '192.168.2.200'
@@ -38,6 +40,14 @@ on:
  #watch:
  #  types: [started]

+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
@@ -56,6 +66,10 @@ env:
  DELETE_OLD_WORKFLOW: true
 # Cache 加速编译
  CACHE_ACCELERATE: true
+# 下载并行数
+  DOWNLOAD_JOBS: 8
+# 编译并行数
+  BUILD_JOBS: 4
 ### 结束

 jobs:
@@ -63,16 +77,16 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Maximize Build Space
-      uses: easimon/maximize-build-space@master
+      uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794
      with:
-        root-reserve-mb: 5120
+        root-reserve-mb: 4096
        swap-size-mb: 512
+        temp-reserve-mb: 1024
        remove-dotnet: 'true'
        remove-android: 'true'
-        remove-haskell: 'true'

    - name: Checkout
-      uses: actions/checkout@main
+      uses: actions/checkout@b9e0990d219a03df7633c93f6f005a8fecbcab22
      with:
        fetch-depth: 0

@@ -80,9 +94,9 @@ jobs:
    - name: Set env & Echo System Info
      id: date
      run: |
-        echo "::set-output name=date::$(date +'%Y-%m-%d')"
-        echo "Release=${{ github.event.inputs.Release }}" >> $GITHUB_ENV
-        echo "SharePoint=${{ github.event.inputs.SharePoint }}" >> $GITHUB_ENV
+        echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
+        echo "Release=${{ github.event.inputs.Release || 'true' }}" >> $GITHUB_ENV
+        echo "SharePoint=${{ github.event.inputs.SharePoint || 'true' }}" >> $GITHUB_ENV
        echo "data2=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
        echo "NOW_DATA_VERSION=v$(date +'%Y-%m-%d')" >> $GITHUB_ENV

@@ -101,11 +115,19 @@ jobs:
      run: |
        echo "Free space:"
        df -h
-        if [ -n "${{ github.event.inputs.Tempoary_CONFIG }}" ]
+        INPUT_CONFIG="${{ github.event.inputs.Tempoary_CONFIG || '' }}"
+        INPUT_IP="${{ github.event.inputs.Tempoary_IP || '' }}"
+        INPUT_FLAG="${{ github.event.inputs.Tempoary_FLAG || '' }}"
+
+        if [ -n "${INPUT_CONFIG}" ]
        then
-            if [ -f "$GITHUB_WORKSPACE/Configs/${{ github.event.inputs.Tempoary_CONFIG }}" ]
+            if [[ ! "${INPUT_CONFIG}" =~ ^[A-Za-z0-9._-]+$ ]]
            then
-                CONFIG_FILE=${{ github.event.inputs.Tempoary_CONFIG }}
+                echo "Invalid CONFIG_FILE input: [${INPUT_CONFIG}]"
+                exit 1
+            elif [ -f "$GITHUB_WORKSPACE/Configs/${INPUT_CONFIG}" ]
+            then
+                CONFIG_FILE="${INPUT_CONFIG}"
            else
                CONFIG_FILE=${{ env.CONFIG_FILE }}
            fi
@@ -120,15 +142,34 @@ jobs:
            echo "CONFIG_FILE: [/Config/$CONFIG_FILE]"
            echo "CONFIG_FILE=$CONFIG_FILE" >> $GITHUB_ENV
        fi
-        if [ -n "${{ github.event.inputs.Tempoary_IP }}" ]
+        if [ -n "${INPUT_IP}" ]
        then
-            echo "IP: [${{ github.event.inputs.Tempoary_IP }}]"
-            echo "Tempoary_IP=${{ github.event.inputs.Tempoary_IP }}" >> $GITHUB_ENV
+            if [[ ! "${INPUT_IP}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]
+            then
+                echo "Invalid Tempoary_IP input: [${INPUT_IP}]"
+                exit 1
            fi
-        if [ -n "${{ github.event.inputs.Tempoary_FLAG }}" ]
+            IFS=. read -r ip1 ip2 ip3 ip4 <<< "${INPUT_IP}"
+            for octet in "$ip1" "$ip2" "$ip3" "$ip4"
+            do
+                if (( octet < 0 || octet > 255 ))
                then
-            echo "FLAG: [${{ github.event.inputs.Tempoary_FLAG }}]"
-            echo "Tempoary_FLAG=${{ github.event.inputs.Tempoary_FLAG }}" >> $GITHUB_ENV
+                    echo "Invalid Tempoary_IP input: [${INPUT_IP}]"
+                    exit 1
+                fi
+            done
+            echo "IP: [${INPUT_IP}]"
+            echo "Tempoary_IP=${INPUT_IP}" >> $GITHUB_ENV
+        fi
+        if [ -n "${INPUT_FLAG}" ]
+        then
+            if [[ ! "${INPUT_FLAG}" =~ ^[A-Za-z0-9]+$ ]]
+            then
+                echo "Invalid Tempoary_FLAG input: [${INPUT_FLAG}]"
+                exit 1
+            fi
+            echo "FLAG: [${INPUT_FLAG}]"
+            echo "Tempoary_FLAG=${INPUT_FLAG}" >> $GITHUB_ENV
        fi
        REPO_URL="https://github.com/$(cut -d \: -f 1 <<< ${{ env.DEFAULT_SOURCE }})"
        REPO_BRANCH=$(cut -d \: -f 2 <<< ${{ env.DEFAULT_SOURCE }})
@@ -142,14 +183,13 @@ jobs:
        DEBIAN_FRONTEND: noninteractive
      run: |
        sudo -E apt-get update
-        sudo -E apt-get -y install build-essential cmake asciidoc binutils bzip2 gawk gettext git libncurses5-dev zlib1g-dev patch unzip zlib1g-dev lib32gcc-s1 libc6-dev-i386 subversion flex uglifyjs git gcc-multilib g++-multilib p7zip p7zip-full msmtp libssl-dev texinfo libreadline-dev libglib2.0-dev xmlto qemu-utils upx-ucl libelf-dev autoconf automake libtool autopoint ccache curl wget vim nano python3 python3-pip python3-ply haveged lrzsz device-tree-compiler scons antlr3 gperf intltool genisoimage rsync
+        sudo -E apt-get -y install build-essential cmake binutils bzip2 gawk gettext git libncurses5-dev zlib1g-dev patch unzip lib32gcc-s1 libc6-dev-i386 subversion flex uglifyjs gcc-multilib g++-multilib p7zip p7zip-full msmtp libssl-dev texinfo libreadline-dev libglib2.0-dev qemu-utils upx-ucl libelf-dev autoconf automake libtool autopoint ccache curl wget python3 python3-pip python3-ply haveged device-tree-compiler scons antlr3 gperf intltool genisoimage rsync
        sudo -E apt-get -y install llvm clang
        sudo timedatectl set-timezone "Asia/Shanghai"
        sudo mkdir -p /workdir
        sudo chown $USER:$GROUPS /workdir
        if [ "${{ env.DELETE_USELESS_FILES }}" == true ]
        then
-          docker rmi node:18 node:20 node:22 node:18-alpine node:20-alpine node:22-alpine alpine:3.16 alpine:3.17 alpine:3.18 moby/buildkit:latest ubuntu:20.04 debian:10 debian:11
          sudo rm -rf /usr/share/dotnet /etc/mysql /etc/php
          sudo -E apt-get -y autoremove --purge
          sudo -E apt-get clean
@@ -157,12 +197,12 @@ jobs:

    - name: Clone Openwrt Source Code
      run: |
-        git clone -b $REPO_BRANCH $REPO_URL openwrt
+        git clone -b $REPO_BRANCH $REPO_URL /workdir/openwrt
        ln -sf /workdir/openwrt $GITHUB_WORKSPACE/openwrt

    - name: Accelerate
      if: env.CACHE_ACCELERATE == 'true'
-      uses: klever1988/cachewrtbuild@main
+      uses: klever1988/cachewrtbuild@b729f807837dbc3455d02fd35192660d9b662121
      with:
        ccache: false
        toolchain: true
@@ -178,7 +218,7 @@ jobs:
        ./scripts/feeds uninstall luci-theme-argon
        # Update golang to 1.22 for xray-core build
        rm -rf feeds/packages/lang/golang
-        git clone https://github.com/sbwml/packages_lang_golang -b 22.x feeds/packages/lang/golang
+        git clone https://github.com/sbwml/packages_lang_golang -b 26.x feeds/packages/lang/golang
 #        sed -i 's/^\s*$[(]call\sEnsureVendoredVersion/#&/' $GITHUB_WORKSPACE/openwrt/feeds/packages/utils/dockerd/Makefile
 #fix dockerd bug

@@ -186,16 +226,20 @@ jobs:
      run: |
        chmod +x Scripts/AutoBuild_*.sh
        cd openwrt
+        cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
        if [ "${{ env.CACHE_ACCELERATE }}" == true ]
        then
-            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> $GITHUB_WORKSPACE/Configs/$CONFIG_FILE
+            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> .config
        fi
-        cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_DiyScript.sh
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_Function.sh
        make defconfig
        Firmware_Diy_Before
        rm -f .config && cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
+        if [ "${{ env.CACHE_ACCELERATE }}" == true ]
+        then
+            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> .config
+        fi
        Firmware_Diy_Main
        Firmware_Diy
        Firmware_Diy_Other
@@ -205,21 +249,39 @@ jobs:
        cd openwrt
        ./scripts/feeds install -a
        make defconfig
-        make download -j8
+        mkdir -p dl
+        if ! make download -j${DOWNLOAD_JOBS}
+        then
+            echo "Parallel package download failed; retrying serially with verbose output."
+            find dl -type f -size -1024c -print -delete
+            make download -j1 V=s
+        fi
+        find dl -type f -size -1024c -print -delete

    - name: Build OpenWrt
      run: |
        cd openwrt
+        rm -rf package/feeds/packages/net/{xray-core,v2ray-geodata,sing-box,chinadns-ng,dns2socks,hysteria,ipt2socks,microsocks,naiveproxy,shadowsocks-rust,shadowsocksr-libev,simple-obfs,tcping,v2ray-plugin,xray-plugin,geoview,shadow-tls}
+        rm -rf package/feeds/luci/applications/luci-app-passwall
        rm package/feeds/packages/adguardhome -rf
        rm feeds/packages/net/adguardhome -rf
+        rm feeds/luci/applications/luci-app-adguardhome -rf
        ln -s ../../../package/other/AutoBuild-Packages/adguardhome package/feeds/packages/adguardhome
        # 2024.03.03 mosdns build fail by golang 1.22
-        sed -i 's/CGO_ENABLED=0/CGO_ENABLED=1/g' feeds/packages/net/mosdns/Makefile
-        make -j4 | tee ./build_log.log || make -j1 V=s
-        [ "$?" == 0 ] && echo "Result=true" >> $GITHUB_ENV || echo "Result=false" >> $GITHUB_ENV
+        sed -i "s/CGO_ENABLED=0/CGO_ENABLED=1/g" feeds/packages/net/mosdns/Makefile
+        set -o pipefail
+        if make -j${BUILD_JOBS} 2>&1 | tee ./build_log.log
+        then
+            build_status=0
+        else
+            make -j1 V=s 2>&1 | tee -a ./build_log.log
+            build_status=$?
+        fi
+        [ "${build_status}" == 0 ] && echo "Result=true" >> $GITHUB_ENV || echo "Result=false" >> $GITHUB_ENV


    - name: Check Build Update
+      if: env.Result == 'true' && env.Release == 'true' && env.UPLOAD_RELEASES == 'true' && !cancelled()
      run: |
        export NOW_DATA_VERSION=${{env.NOW_DATA_VERSION}}
        export GITHUB_WORKSPACE=$GITHUB_WORKSPACE
@@ -251,16 +313,19 @@ jobs:
        cd openwrt
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_Function.sh
        Firmware_Diy_End
+        cd ..
+        mkdir ${{ steps.date.outputs.date }}
+        cp openwrt/bin/Firmware/* ./${{ steps.date.outputs.date }} -r

    - name: Upload Firmware to Artifacts
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      if: env.UPLOAD_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled()
      with:
        name: ${{ env.CONFIG_FILE }}_firmware_${{ env.Compile_Date }}
        path: openwrt/bin/Firmware

    - name: Upload bin to Artifacts
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      if: env.UPLOAD_BIN_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled()
      with:
        name: ${{ env.CONFIG_FILE }}_bin_${{ env.Compile_Date }}
@@ -303,93 +368,45 @@ jobs:
        echo SP_LEGACY_VDI=$(echo $SP_LEGACY_VDI) >> $GITHUB_ENV
        echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV

-    - name: 1 Upload SP_UEFI_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_UEFI_IMG_GZ }}
-        file: openwrt/bin/Firmware/${{ env.SP_UEFI_IMG_GZ }}
+    - name: 1 Upload SP_UEFI_VMDK to SharePoint
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_IMG_GZ }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  2 Upload SP_UEFI_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_UEFI_VMDK }}
-        file: openwrt/bin/Firmware/${{ env.SP_UEFI_VMDK }}
-
-    # - name: 3 Upload SP_UEFI_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_UEFI_VDI }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VDI }}
-
-    # - name: 4 Upload SP_UEFI_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_UEFI_VHDX }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VHDX }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_VMDK }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  5 Upload SP_LEGACY_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_LEGACY_IMG_GZ }}
-        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_IMG_GZ }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_IMG_GZ }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  6 Upload SP_LEGACY_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_LEGACY_VMDK }}
-        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VMDK }}
-
-    # - name: 7 Upload SP_LEGACY_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_LEGACY_VDI }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VDI }}
-
-    # - name: 8 Upload SP_LEGACY_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
-    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-    #   with:
-    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-    #     sp_username: ${{ secrets.USERNAME }}
-    #     sp_password: ${{ secrets.PASSWORD }}
-    #     sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-    #     sp_file_name: ${{ env.SP_LEGACY_VHDX }}
-    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VHDX }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_VMDK }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name: Delete VM Disk File
      if: env.Release=='true' && env.UPLOAD_RELEASES == 'true' && env.Result == 'true' && !cancelled()
@@ -417,7 +434,7 @@ jobs:
        overwrite: true

    - name: Delete old Workflow Runs
-      uses: GitRML/delete-workflow-runs@main
+      uses: GitRML/delete-workflow-runs@6c7cf4852e73c46502ee79494d99f5b504cacc6d
      if: env.DELETE_OLD_WORKFLOW == 'true' && !cancelled()
      with:
        retain_days: 1
@@ -13,10 +13,12 @@ on:
    inputs:
      Release:
        description: '是否上传到Github'
-        default: 'true'
+        type: boolean
+        default: true
      SharePoint:
        description: '是否上传到SharePoint'
-        default: 'true'
+        type: boolean
+        default: true
      Tempoary_IP:
        description: '固件 IP 地址 [可选]'
        default: '192.168.2.200'
@@ -38,6 +40,14 @@ on:
  #watch:
  #  types: [started]

+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
@@ -56,6 +66,10 @@ env:
  DELETE_OLD_WORKFLOW: true
 # Cache 加速编译
  CACHE_ACCELERATE: true
+# 下载并行数
+  DOWNLOAD_JOBS: 8
+# 编译并行数
+  BUILD_JOBS: 4
 ### 结束

 jobs:
@@ -63,15 +77,16 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Maximize Build Space
-      uses: easimon/maximize-build-space@master
+      uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794
      with:
-        root-reserve-mb: 5120
+        root-reserve-mb: 4096
        swap-size-mb: 512
+        temp-reserve-mb: 1024
        remove-dotnet: 'true'
        remove-android: 'true'

    - name: Checkout
-      uses: actions/checkout@main
+      uses: actions/checkout@b9e0990d219a03df7633c93f6f005a8fecbcab22
      with:
        fetch-depth: 0

@@ -80,9 +95,9 @@ jobs:
    - name: Set env & Echo System Info
      id: date
      run: |
-        echo "::set-output name=date::$(date +'%Y-%m-%d')"
-        echo "Release=${{ github.event.inputs.Release }}" >> $GITHUB_ENV
-        echo "SharePoint=${{ github.event.inputs.SharePoint }}" >> $GITHUB_ENV
+        echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
+        echo "Release=${{ github.event.inputs.Release || 'true' }}" >> $GITHUB_ENV
+        echo "SharePoint=${{ github.event.inputs.SharePoint || 'true' }}" >> $GITHUB_ENV
        echo "data2=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
        echo "NOW_DATA_VERSION=v$(date +'%Y-%m-%d')" >> $GITHUB_ENV

@@ -98,11 +113,19 @@ jobs:
      run: |
        echo "Free space:"
        df -h
-        if [ -n "${{ github.event.inputs.Tempoary_CONFIG }}" ]
+        INPUT_CONFIG="${{ github.event.inputs.Tempoary_CONFIG || '' }}"
+        INPUT_IP="${{ github.event.inputs.Tempoary_IP || '' }}"
+        INPUT_FLAG="${{ github.event.inputs.Tempoary_FLAG || '' }}"
+
+        if [ -n "${INPUT_CONFIG}" ]
        then
-            if [ -f "$GITHUB_WORKSPACE/Configs/${{ github.event.inputs.Tempoary_CONFIG }}" ]
+            if [[ ! "${INPUT_CONFIG}" =~ ^[A-Za-z0-9._-]+$ ]]
            then
-                CONFIG_FILE=${{ github.event.inputs.Tempoary_CONFIG }}
+                echo "Invalid CONFIG_FILE input: [${INPUT_CONFIG}]"
+                exit 1
+            elif [ -f "$GITHUB_WORKSPACE/Configs/${INPUT_CONFIG}" ]
+            then
+                CONFIG_FILE="${INPUT_CONFIG}"
            else
                CONFIG_FILE=${{ env.CONFIG_FILE }}
            fi
@@ -117,15 +140,34 @@ jobs:
            echo "CONFIG_FILE: [/Config/$CONFIG_FILE]"
            echo "CONFIG_FILE=$CONFIG_FILE" >> $GITHUB_ENV
        fi
-        if [ -n "${{ github.event.inputs.Tempoary_IP }}" ]
+        if [ -n "${INPUT_IP}" ]
        then
-            echo "IP: [${{ github.event.inputs.Tempoary_IP }}]"
-            echo "Tempoary_IP=${{ github.event.inputs.Tempoary_IP }}" >> $GITHUB_ENV
+            if [[ ! "${INPUT_IP}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]
+            then
+                echo "Invalid Tempoary_IP input: [${INPUT_IP}]"
+                exit 1
            fi
-        if [ -n "${{ github.event.inputs.Tempoary_FLAG }}" ]
+            IFS=. read -r ip1 ip2 ip3 ip4 <<< "${INPUT_IP}"
+            for octet in "$ip1" "$ip2" "$ip3" "$ip4"
+            do
+                if (( octet < 0 || octet > 255 ))
                then
-            echo "FLAG: [${{ github.event.inputs.Tempoary_FLAG }}]"
-            echo "Tempoary_FLAG=${{ github.event.inputs.Tempoary_FLAG }}" >> $GITHUB_ENV
+                    echo "Invalid Tempoary_IP input: [${INPUT_IP}]"
+                    exit 1
+                fi
+            done
+            echo "IP: [${INPUT_IP}]"
+            echo "Tempoary_IP=${INPUT_IP}" >> $GITHUB_ENV
+        fi
+        if [ -n "${INPUT_FLAG}" ]
+        then
+            if [[ ! "${INPUT_FLAG}" =~ ^[A-Za-z0-9]+$ ]]
+            then
+                echo "Invalid Tempoary_FLAG input: [${INPUT_FLAG}]"
+                exit 1
+            fi
+            echo "FLAG: [${INPUT_FLAG}]"
+            echo "Tempoary_FLAG=${INPUT_FLAG}" >> $GITHUB_ENV
        fi
        REPO_URL="https://github.com/$(cut -d \: -f 1 <<< ${{ env.DEFAULT_SOURCE }})"
        REPO_BRANCH=$(cut -d \: -f 2 <<< ${{ env.DEFAULT_SOURCE }})
@@ -139,15 +181,13 @@ jobs:
        DEBIAN_FRONTEND: noninteractive
      run: |
        sudo -E apt-get update
-        sudo -E apt-get -y install build-essential cmake asciidoc binutils bzip2 gawk gettext git libncurses5-dev zlib1g-dev patch unzip zlib1g-dev lib32gcc-s1 libc6-dev-i386 subversion flex uglifyjs git gcc-multilib g++-multilib p7zip p7zip-full msmtp libssl-dev texinfo libreadline-dev libglib2.0-dev xmlto qemu-utils upx-ucl libelf-dev autoconf automake libtool autopoint ccache curl wget vim nano python3 python3-pip python3-ply haveged lrzsz device-tree-compiler scons antlr3 gperf intltool genisoimage rsync
+        sudo -E apt-get -y install build-essential cmake binutils bzip2 gawk gettext git libncurses5-dev zlib1g-dev patch unzip lib32gcc-s1 libc6-dev-i386 subversion flex uglifyjs gcc-multilib g++-multilib p7zip p7zip-full msmtp libssl-dev texinfo libreadline-dev libglib2.0-dev qemu-utils upx-ucl libelf-dev autoconf automake libtool autopoint ccache curl wget python3 python3-pip python3-ply haveged device-tree-compiler scons antlr3 gperf intltool genisoimage rsync
        sudo -E apt-get -y install llvm clang
        sudo timedatectl set-timezone "Asia/Shanghai"
        sudo mkdir -p /workdir
        sudo chown $USER:$GROUPS /workdir
        if [ "${{ env.DELETE_USELESS_FILES }}" == true ]
        then
-          docker images
-          docker rmi node:18 node:20 node:22 node:18-alpine node:20-alpine node:22-alpine alpine:3.16 alpine:3.17 alpine:3.18 moby/buildkit:latest ubuntu:20.04 debian:10 debian:11
          sudo rm -rf /usr/share/dotnet /etc/mysql /etc/php
          sudo -E apt-get -y autoremove --purge
          sudo -E apt-get clean
@@ -155,12 +195,12 @@ jobs:

    - name: Clone Openwrt Source Code
      run: |
-        git clone -b $REPO_BRANCH $REPO_URL openwrt
+        git clone -b $REPO_BRANCH $REPO_URL /workdir/openwrt
        ln -sf /workdir/openwrt $GITHUB_WORKSPACE/openwrt

    - name: Accelerate
      if: env.CACHE_ACCELERATE == 'true'
-      uses: klever1988/cachewrtbuild@main
+      uses: klever1988/cachewrtbuild@b729f807837dbc3455d02fd35192660d9b662121
      with:
        ccache: false
        toolchain: true
@@ -176,7 +216,7 @@ jobs:
        ./scripts/feeds uninstall luci-theme-argon
        # Update golang to 1.22 for xray-core build
        rm -rf feeds/packages/lang/golang
-        git clone https://github.com/sbwml/packages_lang_golang -b 22.x feeds/packages/lang/golang
+        git clone https://github.com/sbwml/packages_lang_golang -b 26.x feeds/packages/lang/golang
 #        sed -i 's/^\s*$[(]call\sEnsureVendoredVersion/#&/' $GITHUB_WORKSPACE/openwrt/feeds/packages/utils/dockerd/Makefile
 #fix dockerd bug

@@ -184,16 +224,20 @@ jobs:
      run: |
        chmod +x Scripts/AutoBuild_*.sh
        cd openwrt
+        cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
        if [ "${{ env.CACHE_ACCELERATE }}" == true ]
        then
-            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> $GITHUB_WORKSPACE/Configs/$CONFIG_FILE
+            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> .config
        fi
-        cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_DiyScript.sh
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_Function.sh
        make defconfig
        Firmware_Diy_Before
        rm -f .config && cp $GITHUB_WORKSPACE/Configs/$CONFIG_FILE .config
+        if [ "${{ env.CACHE_ACCELERATE }}" == true ]
+        then
+            echo -e "\nCONFIG_DEVEL=y\nCONFIG_CCACHE=n\n" >> .config
+        fi
        Firmware_Diy_Main
        Firmware_Diy
        Firmware_Diy_Other
@@ -203,20 +247,38 @@ jobs:
        cd openwrt
        ./scripts/feeds install -a
        make defconfig
-        make download -j8
+        mkdir -p dl
+        if ! make download -j${DOWNLOAD_JOBS}
+        then
+            echo "Parallel package download failed; retrying serially with verbose output."
+            find dl -type f -size -1024c -print -delete
+            make download -j1 V=s
+        fi
+        find dl -type f -size -1024c -print -delete

    - name: Build OpenWrt
      run: |
        cd openwrt
+        rm -rf package/feeds/packages/net/{xray-core,v2ray-geodata,sing-box,chinadns-ng,dns2socks,hysteria,ipt2socks,microsocks,naiveproxy,shadowsocks-rust,shadowsocksr-libev,simple-obfs,tcping,v2ray-plugin,xray-plugin,geoview,shadow-tls}
+        rm -rf package/feeds/luci/applications/luci-app-passwall
        rm package/feeds/packages/adguardhome -rf
        rm feeds/packages/net/adguardhome -rf
+        rm feeds/luci/applications/luci-app-adguardhome -rf
        ln -s ../../../package/other/AutoBuild-Packages/adguardhome package/feeds/packages/adguardhome
-        make -j4 | tee ./build_log.log || make -j1 V=s
        # 2024.03.03 mosdns build fail by golang 1.22
-        sed -i 's/CGO_ENABLED=0/CGO_ENABLED=1/g' feeds/packages/net/mosdns/Makefile
-        [ "$?" == 0 ] && echo "Result=true" >> $GITHUB_ENV || echo "Result=false" >> $GITHUB_ENV
+        sed -i "s/CGO_ENABLED=0/CGO_ENABLED=1/g" feeds/packages/net/mosdns/Makefile
+        set -o pipefail
+        if make -j${BUILD_JOBS} 2>&1 | tee ./build_log.log
+        then
+            build_status=0
+        else
+            make -j1 V=s 2>&1 | tee -a ./build_log.log
+            build_status=$?
+        fi
+        [ "${build_status}" == 0 ] && echo "Result=true" >> $GITHUB_ENV || echo "Result=false" >> $GITHUB_ENV

    - name: Check Build Update
+      if: env.Result == 'true' && env.Release == 'true' && env.UPLOAD_RELEASES == 'true' && !cancelled()
      run: |
        export NOW_DATA_VERSION=${{env.NOW_DATA_VERSION}}
        export GITHUB_WORKSPACE=$GITHUB_WORKSPACE
@@ -248,16 +310,19 @@ jobs:
        cd openwrt
        source $GITHUB_WORKSPACE/Scripts/AutoBuild_Function.sh
        Firmware_Diy_End
+        cd ..
+        mkdir ${{ steps.date.outputs.date }}
+        cp openwrt/bin/Firmware/* ./${{ steps.date.outputs.date }} -r

    - name: Upload Firmware to Artifacts
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      if: env.UPLOAD_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled()
      with:
        name: ${{ env.CONFIG_FILE }}_firmware_${{ env.Compile_Date }}
        path: openwrt/bin/Firmware

    - name: Upload bin to Artifacts
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      if: env.UPLOAD_BIN_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled()
      with:
        name: ${{ env.CONFIG_FILE }}_bin_${{ env.Compile_Date }}
@@ -300,30 +365,28 @@ jobs:
        echo SP_LEGACY_VDI=$(echo $SP_LEGACY_VDI) >> $GITHUB_ENV
        echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV

-    - name: 1 Upload SP_UEFI_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_UEFI_IMG_GZ }}
-        file: openwrt/bin/Firmware/${{ env.SP_UEFI_IMG_GZ }}
+    - name: 1 Upload SP_UEFI_VMDK to SharePoint
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_IMG_GZ }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  2 Upload SP_UEFI_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_UEFI_VMDK }}
-        file: openwrt/bin/Firmware/${{ env.SP_UEFI_VMDK }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_VMDK }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    # - name: 3 Upload SP_UEFI_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -334,7 +397,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VDI }}

    # - name: 4 Upload SP_UEFI_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -345,29 +408,27 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VHDX }}

    - name:  5 Upload SP_LEGACY_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_LEGACY_IMG_GZ }}
-        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_IMG_GZ }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_IMG_GZ }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    - name:  6 Upload SP_LEGACY_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
-      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
-      with:
-        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
-        sp_username: ${{ secrets.USERNAME }}
-        sp_password: ${{ secrets.PASSWORD }}
-        sp_folder: /Shared Documents/OpenWrt/${{ steps.date.outputs.date }}
-        sp_file_name: ${{ env.SP_LEGACY_VMDK }}
-        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VMDK }}
+      uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e
+      if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()
+      env:
+        FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_VMDK }}
+        S3_ENDPOINT: 's3.openwrt.115115.xyz'
+        S3_BUCKET: ${{ secrets.S3_BUCKET }}
+        S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+        S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

    # - name: 7 Upload SP_LEGACY_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -378,7 +439,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VDI }}

    # - name: 8 Upload SP_LEGACY_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -414,7 +475,7 @@ jobs:
        overwrite: true

    - name: Delete old Workflow Runs
-      uses: GitRML/delete-workflow-runs@main
+      uses: GitRML/delete-workflow-runs@6c7cf4852e73c46502ee79494d99f5b504cacc6d
      if: env.DELETE_OLD_WORKFLOW == 'true' && !cancelled()
      with:
        retain_days: 1
@@ -166,7 +166,7 @@ jobs:
        ./scripts/feeds uninstall luci-theme-argon
        # Update golang to 1.22 for xray-core build
        rm -rf feeds/packages/lang/golang
-        git clone https://github.com/sbwml/packages_lang_golang -b 22.x feeds/packages/lang/golang
+        git clone https://github.com/sbwml/packages_lang_golang -b 25.x feeds/packages/lang/golang
 #        sed -i 's/^\s*$[(]call\sEnsureVendoredVersion/#&/' $GITHUB_WORKSPACE/openwrt/feeds/packages/utils/dockerd/Makefile
 #fix dockerd bug

@@ -291,7 +291,7 @@ jobs:
        echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV

    - name: 1 Upload SP_UEFI_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -302,7 +302,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_UEFI_IMG_GZ }}

    - name: 2 Upload SP_UEFI_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -313,7 +313,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_UEFI_VMDK }}

    # - name: 3 Upload SP_UEFI_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -324,7 +324,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VDI }}

    # - name: 4 Upload SP_UEFI_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -335,7 +335,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_UEFI_VHDX }}

    - name: 5 Upload SP_LEGACY_IMG_GZ to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -346,7 +346,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_IMG_GZ }}

    - name: 6 Upload SP_LEGACY_VMDK to SharePoint
-      uses: su-dont/share-point-uploader@v2.1
+      uses: xopenwrt/share-point-uploader@v2.3
      if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
      with:
        sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -357,7 +357,7 @@ jobs:
        file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VMDK }}

    # - name: 7 Upload SP_LEGACY_VDI to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -368,7 +368,7 @@ jobs:
    #     file: openwrt/bin/Firmware/${{ env.SP_LEGACY_VDI }}

    # - name: 8 Upload SP_LEGACY_VHDX to SharePoint
-    #   uses: su-dont/share-point-uploader@v2.1
+    #   uses: xopenwrt/share-point-uploader@v2.3
    #   if: env.SharePoint=='true' && !cancelled() && env.Result == 'true'
    #   with:
    #     sp_url: https://xinbyte.sharepoint.com/:f:/r/sites/OpenWrt
@@ -166,7 +166,7 @@ jobs:
        ./scripts/feeds uninstall luci-theme-argon
        # Update golang to 1.22 for xray-core build
        rm -rf feeds/packages/lang/golang
-        git clone https://github.com/sbwml/packages_lang_golang -b 22.x feeds/packages/lang/golang
+        git clone https://github.com/sbwml/packages_lang_golang -b 25.x feeds/packages/lang/golang
 #        sed -i 's/^\s*$[(]call\sEnsureVendoredVersion/#&/' $GITHUB_WORKSPACE/openwrt/feeds/packages/utils/dockerd/Makefile
 #fix dockerd bug

@@ -0,0 +1,12 @@
+# AI Modification Log: Apt Package Cleanup
+
+Date: 2026-06-29
+
+## Change
+
+- Removed duplicate `zlib1g-dev` and duplicate `git` entries from X/Y/Z workflow apt package lists.
+- Removed interactive/debug utilities that are not needed in CI package installation: `vim`, `nano`, and `lrzsz`.
+
+## Reason
+
+The package list had duplicate entries and editor/transfer tools that add install time without supporting the automated build path.
@@ -0,0 +1,11 @@
+# AI Modification Log: Autoupdate Config Target
+
+Date: 2026-06-29
+
+## Change
+
+- Updated `Scripts/AutoBuild_Function.sh` so `CONFIG_PACKAGE_luci-app-autoupdate=y` is appended to `${CONFIG_TEMP}`.
+
+## Reason
+
+`Firmware_Diy_Main` runs after changing into the OpenWrt worktree. Appending to `${CONFIG_FILE}` can create or edit a file named after the config profile inside `openwrt`; `${CONFIG_TEMP}` points to the active `.config` generated for the build.
@@ -0,0 +1,14 @@
+# AI Modification Log: Build Result Detection
+
+Date: 2026-06-29
+
+## Change
+
+- Updated X/Y/Z workflow build steps to use `set -o pipefail` before `make | tee`.
+- Captured the build status immediately after the primary build or fallback build.
+- Appended fallback build output to `build_log.log`.
+- Moved the Z workflow mosdns `CGO_ENABLED=1` fix before `make` runs.
+
+## Reason
+
+Without `pipefail`, `make | tee` could report success when `make` failed. In the Z workflow, the mosdns fix ran after `make`, so it was applied too late and the final `$?` reflected `sed` instead of the build result.
@@ -0,0 +1,12 @@
+# AI Modification Log: Build Update Condition
+
+Date: 2026-06-29
+
+## Change
+
+- Added an `if` condition to the `Check Build Update` step in X/Y/Z workflows.
+- The step now runs only when the build succeeded, release upload is enabled, and the workflow was not cancelled.
+
+## Reason
+
+The update checker depends on the build log and release metadata. Running it after a failed build or when release upload is disabled can cause unnecessary failures or remote API work.
@@ -0,0 +1,12 @@
+# AI Modification Log: CI Config Mutation
+
+Date: 2026-06-29
+
+## Change
+
+- Updated X/Y/Z `Run Diy Scripts` steps so CI-only `CONFIG_DEVEL` and `CONFIG_CCACHE` settings are appended to `openwrt/.config` instead of `$GITHUB_WORKSPACE/Configs/$CONFIG_FILE`.
+- Re-applied those CI-only settings after `.config` is regenerated before `Firmware_Diy_Main`.
+
+## Reason
+
+The workflow previously mutated tracked config files during CI runs. Writing CI-only options to `.config` keeps repository configs clean while preserving the intended build-time ccache/devel settings.
@@ -0,0 +1,12 @@
+# AI Modification Log: Getenv Robustness
+
+Date: 2026-06-29
+
+## Change
+
+- Fixed `Get_Release_Info` so it prints the kernel patch version instead of executing grep output as a command.
+- Added timeouts and failure tolerance to external IP lookup calls in `Get_Action_Info`.
+
+## Reason
+
+The old backtick command substitution could try to execute the matched `KERNEL_PATCHVER:=...` line. The IP lookup is only diagnostic, so it should not block or fail the build when the external services are unavailable.
@@ -0,0 +1,11 @@
+# AI Modification Log: GitHub Output Date
+
+Date: 2026-06-29
+
+## Change
+
+- Replaced deprecated `::set-output` date output usage in X/Y/Z workflows with `$GITHUB_OUTPUT`.
+
+## Reason
+
+GitHub Actions deprecated `::set-output`. Writing `date=...` to `$GITHUB_OUTPUT` preserves the `steps.date.outputs.date` value using the supported output mechanism.
@@ -0,0 +1,20 @@
+# AI Modification Log: GRUB2 Download Retry
+
+Date: 2026-06-29
+
+## Summary
+
+- Updated the X/Y/Z x86_64 workflows so `make download` retries serially with `V=s` after a parallel download failure.
+- Added cleanup for tiny incomplete files in `dl/` before the retry and after download completion.
+- Updated `CODEX_HANDOFF.md` to record that the config-comment task was interrupted by this build failure fix.
+
+## Reason
+
+The reported failure stopped at `package/boot/grub2` with build variant `efi` during `make package/download`. Retrying `make download` serially follows the OpenWrt error guidance and avoids common parallel download or cached partial-file failures while preserving detailed logs if the upstream package still fails.
+
+## Verification
+
+- Inspected the workflow diff and confirmed only the X/Y/Z pre-download blocks changed.
+- Parsed the edited X/Y/Z workflow files with PyYAML.
+- Checked workflow line endings and confirmed X stayed LF while Y/Z stayed CRLF.
+- Ran whitespace validation with `git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check` because Y/Z intentionally still use CRLF.
@@ -0,0 +1,12 @@
+# AI Modification Log: OpenWrt Clone Workdir
+
+Date: 2026-06-29
+
+## Change
+
+- Updated X/Y/Z workflows to clone OpenWrt source into `/workdir/openwrt`.
+- Kept `$GITHUB_WORKSPACE/openwrt` as a symlink to `/workdir/openwrt` for existing later steps.
+
+## Reason
+
+The workflows created `/workdir` but cloned into the workspace. The symlink then pointed at `/workdir/openwrt`, which did not contain the clone. Cloning directly into `/workdir/openwrt` makes the workspace symlink and subsequent `openwrt` paths consistent.
@@ -0,0 +1,17 @@
+# AI Modification Log: Pinned Workflow Actions
+
+Date: 2026-06-29
+
+## Change
+
+- Pinned moving-branch GitHub Actions in X/Y/Z workflows to commit SHAs:
+  - `actions/checkout@main` -> `b9e0990d219a03df7633c93f6f005a8fecbcab22`
+  - `actions/upload-artifact@main` -> `043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
+  - `easimon/maximize-build-space@master` -> `c28619d8999a147d5e09c1199f84ff6af6ad5794`
+  - `klever1988/cachewrtbuild@main` -> `b729f807837dbc3455d02fd35192660d9b662121`
+  - `GitRML/delete-workflow-runs@main` -> `6c7cf4852e73c46502ee79494d99f5b504cacc6d`
+  - `xopenwrt/s3-upload-github-action@master` -> `3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e`
+
+## Reason
+
+Pinning actions to immutable commits improves workflow reproducibility and reduces supply-chain drift from moving branch references.
@@ -0,0 +1,12 @@
+# AI Modification Log: Release Repository Selection
+
+Date: 2026-06-29
+
+## Change
+
+- Updated `Scripts/AutoBuild_Upcheck.sh` to use `${GITHUB_REPOSITORY}` for release history and previous package-version downloads.
+- Kept `X-OpenWrt/X-OpenWrt-Dev` as a fallback when the script is run outside GitHub Actions.
+
+## Reason
+
+The workflows upload releases to the current repository, but the update checker fetched release history and previous logs from a hard-coded repository. Using `${GITHUB_REPOSITORY}` keeps the checker aligned with the workflow repository.
@@ -0,0 +1,13 @@
+# AI Modification Log: Release Tag Comparison
+
+Date: 2026-06-29
+
+## Change
+
+- Updated `Scripts/AutoBuild_Upcheck.sh` release tag selection to filter tags as `vYYYY-MM-DD`.
+- Sorted release tags with `sort -V` and selected the latest tag older than `${NOW_DATA_VERSION}`.
+- Normalized the fallback tag to `v2023-01-01`.
+
+## Reason
+
+The old logic compared release tags lexically and used a non-normalized `v2023-1-1` fallback. Filtering and version sorting make date-tag selection predictable.
@@ -0,0 +1,14 @@
+# AI Modification Log: S3 Upload Conditions
+
+Date: 2026-06-29
+
+## Change
+
+- Added `if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()` to enabled S3 upload steps in:
+  - `.github/workflows/X-x86_64_X.yml`
+  - `.github/workflows/X-x86_64_Y.yml`
+  - `.github/workflows/X-x86_64_Z.yml`
+
+## Reason
+
+The S3 upload steps used the SharePoint/S3 upload path but did not honor the `SharePoint` input or the build `Result`. The new condition prevents uploads when SharePoint upload is disabled, the build failed, or the workflow was cancelled.
@@ -0,0 +1,13 @@
+# AI Modification Log: Task Backlog Refresh
+
+Date: 2026-06-29
+
+## Summary
+
+- Updated `CODEX_HANDOFF.md` to reflect that the active working branch is `ai` tracking `origin/ai`.
+- Recorded the current requested follow-up task before editing the X/Y/Z x86_64 config files.
+- Added backlog item #35 to track config intent comments and config-specific optimization todos.
+
+## Verification
+
+- Confirmed the worktree was clean on `ai...origin/ai` before this documentation update.
@@ -0,0 +1,12 @@
+# AI Modification Log: Workflow Input Defaults
+
+Date: 2026-06-29
+
+## Change
+
+- Added `type: boolean` to the `Release` and `SharePoint` workflow dispatch inputs in X/Y/Z workflows.
+- Changed env export lines to default `Release` and `SharePoint` to `true` when `github.event.inputs` is absent, such as repository dispatch runs.
+
+## Reason
+
+The workflows also support `repository_dispatch`, where `github.event.inputs` is not populated. Without explicit fallback values, release and SharePoint conditions can see empty strings and skip expected upload steps.
@@ -0,0 +1,13 @@
+# AI Modification Log: Workflow Input Validation
+
+Date: 2026-06-29
+
+## Change
+
+- Updated X/Y/Z `Load Custom Variables` steps to copy dispatch inputs into shell variables before use.
+- Added validation for `Tempoary_CONFIG` file names, IPv4 `Tempoary_IP`, and alphanumeric `Tempoary_FLAG`.
+- Kept the existing fallback to default `CONFIG_FILE` when a valid config-shaped input does not match a file in `Configs/`.
+
+## Reason
+
+Dispatch inputs were interpolated directly into shell commands. Validating and quoting them reduces accidental shell breakage and rejects unsafe config names, invalid IPs, and unsupported flag characters.
@@ -0,0 +1,12 @@
+# AI Modification Log: Workflow Parallelism Variables
+
+Date: 2026-06-29
+
+## Change
+
+- Added `DOWNLOAD_JOBS: 8` and `BUILD_JOBS: 4` to X/Y/Z workflow env blocks.
+- Replaced hard-coded `make download -j32` / `-j8` and `make -j4` with those variables.
+
+## Reason
+
+X/Y/Z had drifted download parallelism while sharing the same build logic. Central variables keep the workflows consistent and make later tuning explicit.
@@ -0,0 +1,15 @@
+# AI Modification Log: Workflow Permissions And Concurrency
+
+Date: 2026-06-29
+
+## Change
+
+- Added explicit workflow permissions to X/Y/Z workflows:
+  - `contents: write`
+  - `actions: write`
+- Added workflow-level concurrency grouped by `openwrt-release-${{ github.ref }}`.
+- Set `cancel-in-progress: false` so existing long-running builds are not cancelled automatically.
+
+## Reason
+
+Release uploads need content write permission, and workflow-run cleanup needs actions write permission. Concurrency prevents multiple runs of the same workflow/ref from racing on shared release tags and dated upload paths.
@@ -0,0 +1,21 @@
+# AI Modification Log: x86_64 Config Comments
+
+Date: 2026-06-29
+
+## Summary
+
+- Added purpose and maintenance comment headers to `Configs/x86_64-X`, `Configs/x86_64-Y`, and `Configs/x86_64-Z`.
+- Added `NOTES_X86_CONFIG_OPTIMIZATION.md` with config-specific optimization todos.
+- Updated the handoff and backlog notes to mark item #35 as completed.
+
+## Behavior Impact
+
+- No `CONFIG_*` selections were added, removed, or changed.
+- The config comment update is documentation-only.
+
+## Verification
+
+- Inspected the config diff and confirmed the three config files only gained comment headers.
+- Compared `CONFIG_*` lines against `HEAD` and confirmed no config selections changed.
+- Checked line endings and confirmed X stayed LF, Y stayed LF without EOF newline, and Z stayed CRLF without EOF newline.
+- Ran CRLF-aware whitespace validation before commit.
@@ -0,0 +1,14 @@
+# AI Modification Log: Z Workflow Debug Noise
+
+Date: 2026-06-29
+
+## Change
+
+- Removed Z-only debug output from `.github/workflows/X-x86_64_Z.yml`:
+  - `docker images`
+  - `ls bin/Firmware`
+  - `ls openwrt/bin/Firmware`
+
+## Reason
+
+These commands were useful during debugging but do not affect build artifacts. Removing them reduces log noise and keeps the Z workflow closer to X/Y behavior.
@@ -0,0 +1,12 @@
+# AI Modification Log: Z S3 Upload Path
+
+Date: 2026-06-28
+
+## Change
+
+- Fixed the Z workflow UEFI VMDK S3 upload path in `.github/workflows/X-x86_64_Z.yml`.
+- Changed `./${{ steps.date.outputs.date }}e/${{ env.SP_UEFI_VMDK }}` to `./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_VMDK }}`.
+
+## Reason
+
+The extra `e` after the date output made the upload action look in a non-existent directory, causing the UEFI VMDK upload to miss the generated firmware artifact.
@@ -0,0 +1,93 @@
+# Codex Handoff
+
+Last updated: 2026-06-29
+
+## Purpose
+
+This file is the stable restart point for future Codex sessions in this repository. If a session is closed, the next session should read this file first, then continue from the listed state and backlog.
+
+## Current State
+
+- Repository: `X-OpenWrt-New`
+- Branch: `ai`
+- Remote tracking branch: `origin/ai`
+- Latest completed task batch: continued the GitHub Actions X/Y/Z optimization backlog through multiple high-priority and low-risk maintainability/script items.
+- Latest task context: package download retry fix completed; #35 config documentation task completed in the current working series.
+- Current requested task: #35 completed by documenting X/Y/Z x86_64 config intent and adding `NOTES_X86_CONFIG_OPTIMIZATION.md`.
+- Backlog file: `NOTES_GHA_XYZ_OPTIMIZATION.md`
+
+## Completed Backlog Items
+
+Completed in this task series:
+
+- #1: Fixed Z workflow S3 upload path typo.
+- #2: Added S3 upload `if` conditions.
+- #3: Fixed `make | tee` build result detection.
+- #4: Moved Z mosdns `sed` fix before build.
+- #5: Stopped CI from mutating tracked `Configs/*` for ccache/devel options.
+- #6: Fixed autoupdate config append target in `Firmware_Diy_Main`.
+- #7: Fixed OpenWrt clone path/workdir usage.
+- #8: Made `Check Build Update` conditional.
+- #9: Removed hard-coded release repository from update checker.
+- #10: Replaced deprecated `::set-output`.
+- #11: Added explicit workflow permissions.
+- #12: Added workflow concurrency.
+- #14: Pinned moving-branch workflow actions to commit SHAs.
+- #15: Added typed boolean workflow inputs and defaults for repository dispatch.
+- #16: Added validation for config, IP, and flag dispatch inputs.
+- #20: Removed Z-only debug/noise commands.
+- #21: Normalized workflow download/build parallelism variables.
+- #22: Trimmed duplicate/unneeded apt packages.
+- #27: Fixed `Get_Release_Info` command substitution bug.
+- #28: Made diagnostic external IP lookup non-blocking.
+- #30: Improved release tag comparison.
+- #35: Added x86_64 X/Y/Z config intent comments and a dedicated config optimization todo list.
+- Unplanned: Added serial verbose retry for X/Y/Z package downloads after a parallel `make download` failure.
+
+Each code fix has a corresponding `AI_CHANGELOG_*.md` file.
+
+## Remaining Work
+
+Immediate continuation:
+
+- Config-specific cleanup follow-ups now live in `NOTES_X86_CONFIG_OPTIMIZATION.md`. Treat those todos as the source of truth for x86_64 config cleanup.
+
+The next unresolved backlog items need broader design or more careful behavior decisions:
+
+- #13: Consolidate X/Y/Z workflows. This is a large refactor; prefer a reusable workflow or matrix workflow with a separate review pass.
+- #17: Replace repeated S3 upload steps with a loop or matrix.
+- #18: Make firmware glob handling robust with `nullglob`/arrays and missing-file skips.
+- #23: Move package replacement before defconfig/download where possible.
+- #24: Pin or document external package repositories such as golang/passwall/xopenwrt package sources.
+- #25/#26/#29: Larger shell robustness cleanup in `Scripts/AutoBuild_*.sh`.
+- #31/#32: Rework x86_64 config maintenance and shrink configs with OpenWrt diffconfig; needs a successful build environment.
+- #33: Decide whether Z Image Builder artifacts should be uploaded, ignored, or disabled.
+- #34: Clean stale kernel comments in config files.
+
+## Continuation Rule
+
+When continuing this work, start with:
+
+```bash
+git status --short
+git log --oneline -10
+sed -n '1,220p' CODEX_HANDOFF.md
+sed -n '1,260p' NOTES_GHA_XYZ_OPTIMIZATION.md
+```
+
+Then choose the next remaining item based on risk. For a small next step, #18 is a good candidate because it is scoped to firmware file detection/upload preparation. For a structural next step, start with #13 but plan it as a larger workflow refactor.
+
+## Commit Discipline
+
+- Fix one backlog issue per commit unless the user asks for a batch.
+- Keep each fix scoped to the files required for that issue.
+- Add a separate `AI_CHANGELOG_*.md` file for each AI-made fix.
+- Do not revert unrelated user changes.
+- Before committing, check `git status --short` and staged diff.
+- For workflow edits, run YAML parsing and whitespace checks. Remember that Y/Z currently use CRLF line endings.
+
+## Suggested Prompt For Next Session
+
+```text
+继续之前的任务。请先读取 CODEX_HANDOFF.md 和 NOTES_GHA_XYZ_OPTIMIZATION.md，从 Remaining Work 中选择下一个合适的问题修复，并为本次修复创建单独的 AI 修改日志和合适的 commit。
+```
@@ -1,3 +1,16 @@
+# X-OpenWrt x86_64-X compile config notes
+# Purpose: X profile for generic x86_64 firmware. It includes SmartDNS,
+# Docker, WiFi firmware/drivers, IPv6, common storage/network modules,
+# and a broader LuCI package set.
+# Maintenance:
+# - Keep this file limited to OpenWrt .config selections; CI-only options
+#   are appended by the workflow to openwrt/.config.
+# - Keep shared target/image/IPv6/base package choices aligned with Y/Z
+#   unless a profile intentionally differs.
+# - Use OpenWrt scripts/diffconfig.sh after a successful build before
+#   shrinking or reorganizing this profile.
+# - See NOTES_X86_CONFIG_OPTIMIZATION.md for follow-up optimization todos.
+#
 # My Changes
 # 挂载WebDav
 CONFIG_PACKAGE_davfs2=y
@@ -1,3 +1,16 @@
+# X-OpenWrt x86_64-Y compile config notes
+# Purpose: Y profile for generic x86_64 firmware. It keeps SmartDNS,
+# Passwall, AdGuardHome, Docker/Diskman, IPv6, common network services,
+# and the standard x86 image formats.
+# Maintenance:
+# - Keep this file limited to OpenWrt .config selections; CI-only options
+#   are appended by the workflow to openwrt/.config.
+# - Keep shared target/image/IPv6/base package choices aligned with X/Z
+#   unless a profile intentionally differs.
+# - Use OpenWrt scripts/diffconfig.sh after a successful build before
+#   shrinking or reorganizing this profile.
+# - See NOTES_X86_CONFIG_OPTIMIZATION.md for follow-up optimization todos.
+#
 # 挂载WebDav
 CONFIG_PACKAGE_davfs2=y
 # Smart DNS
@@ -87,6 +100,10 @@ CONFIG_TARGET_ROOTFS_PARTSIZE=800
 CONFIG_TARGET_IMAGES_GZIP=y
 CONFIG_PACKAGE_ntfs3-mount=y

+
+CONFIG_PACKAGE_xz=y
+CONFIG_PACKAGE_xz-utils=y
+
 # CONFIG_SIGNATURE_CHECK is not set
 # CONFIG_SIGNED_PACKAGES is not set
 # CONFIG_PACKAGE_luci-app-unblockmusic is not set
@@ -1,3 +1,16 @@
+# X-OpenWrt x86_64-Z compile config notes
+# Purpose: Z profile for generic x86_64 firmware. It is the compact
+# Passwall/AdGuardHome/Diskman/Netdata profile and also enables Image
+# Builder options.
+# Maintenance:
+# - Keep this file limited to OpenWrt .config selections; CI-only options
+#   are appended by the workflow to openwrt/.config.
+# - Keep shared target/image/IPv6/base package choices aligned with X/Y
+#   unless a profile intentionally differs.
+# - Decide whether CONFIG_IB/CONFIG_IB_STANDALONE outputs should be
+#   uploaded, ignored, or disabled.
+# - See NOTES_X86_CONFIG_OPTIMIZATION.md for follow-up optimization todos.
+#
 # 挂载WebDav
 CONFIG_PACKAGE_davfs2=y
 # Smart DNS
@@ -60,6 +73,9 @@ CONFIG_TARGET_IMAGES_GZIP=y
 CONFIG_PACKAGE_ntfs3-mount=y


+CONFIG_PACKAGE_xz=y
+CONFIG_PACKAGE_xz-utils=y
+
 # CONFIG_SIGNATURE_CHECK is not set
 # CONFIG_SIGNED_PACKAGES is not set
 # CONFIG_PACKAGE_luci-app-unblockmusic is not set
@@ -0,0 +1,262 @@
+# GitHub Actions X/Y/Z Scan Notes
+
+Scan date: 2026-06-28
+
+## Scope
+
+Target GitHub Actions:
+
+- `.github/workflows/X-x86_64_X.yml`
+- `.github/workflows/X-x86_64_Y.yml`
+- `.github/workflows/X-x86_64_Z.yml`
+
+Target OpenWrt config files:
+
+- `Configs/x86_64-X`
+- `Configs/x86_64-Y`
+- `Configs/x86_64-Z`
+
+Build scripts used by these workflows:
+
+- `Scripts/AutoBuild_Getenv.sh`
+- `Scripts/AutoBuild_DiyScript.sh`
+- `Scripts/AutoBuild_Function.sh`
+- `Scripts/AutoBuild_Upcheck.sh`
+
+Related directories:
+
+- `.github/workflows`: GitHub Actions workflow definitions.
+- `Configs`: OpenWrt `.config` profiles.
+- `Scripts`: shared build/env/update helper scripts.
+- `CustomFiles`: patches, dependency files and Kconfig fragments injected by scripts.
+
+## Current Progress
+
+Updated: 2026-06-29
+
+- Active work branch: `ai`, tracking `origin/ai`.
+- Completed backlog items in the current AI task series: #1-#12, #14-#16, #20-#22, #27, #28, #30, and #35.
+- Config-specific cleanup follow-ups now live in `NOTES_X86_CONFIG_OPTIMIZATION.md`.
+- Unplanned build fix added a serial verbose retry path for `make download` after a reported `package/boot/grub2` EFI package download failure.
+- Larger unresolved items remain below; prefer one scoped commit per backlog item unless batching is requested.
+
+## Optimization Backlog
+
+### High Priority
+
+1. Fix Z workflow S3 upload path typo.
+   - File: `.github/workflows/X-x86_64_Z.yml`
+   - Location: around line 322
+   - Problem: `FILE: ./${{ steps.date.outputs.date }}e/${{ env.SP_UEFI_VMDK }}` has an extra `e`, so UEFI VMDK upload will look in the wrong directory.
+
+2. Add `if` conditions to all S3/SharePoint upload steps.
+   - Files: `.github/workflows/X-x86_64_X.yml`, `.github/workflows/X-x86_64_Y.yml`, `.github/workflows/X-x86_64_Z.yml`
+   - Locations: X around lines 316-350, Y around lines 311-345, Z around lines 310-366
+   - Problem: `SharePoint` input is written to `$GITHUB_ENV`, but these upload steps do not check `env.SharePoint == 'true'` or `env.Result == 'true'`.
+   - Suggested condition: `if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled()`.
+
+3. Fix build result detection for `make | tee`.
+   - Files: all X/Y/Z workflows
+   - Locations: X around line 223, Y around line 220, Z around lines 217-220
+   - Problems:
+     - X/Y use `make -j4 | tee ... || make -j1 V=s`; without `set -o pipefail`, the pipeline can succeed because `tee` succeeds even when `make` fails.
+     - Z adds `pipefail`, but then runs `sed` after `make`; `$?` is likely checking `sed`, not the build.
+   - Suggested pattern: run `set -o pipefail`, run primary build, run fallback build on failure, store the build exit code immediately, then write `Result=true/false`.
+
+4. Move Z mosdns `sed` fix before build.
+   - File: `.github/workflows/X-x86_64_Z.yml`
+   - Location: around lines 217-219
+   - Problem: `sed -i 's/CGO_ENABLED=0/CGO_ENABLED=1/g' feeds/packages/net/mosdns/Makefile` is after `make`, so the intended fix is applied too late. X/Y apply it before `make`.
+
+5. Stop mutating tracked config files during workflow execution.
+   - Files: all X/Y/Z workflows
+   - Locations: X around lines 191-195, Y around lines 188-192, Z around lines 187-191
+   - Problem: `CONFIG_DEVEL` and `CONFIG_CCACHE` are appended to `$GITHUB_WORKSPACE/Configs/$CONFIG_FILE`. This mutates the checked-out repo copy and can duplicate lines during reruns or debugging.
+   - Suggested fix: copy the selected config to a temp file or `.config` first, then append CI-only options there.
+
+6. Fix likely wrong config append in `Firmware_Diy_Main`.
+   - File: `Scripts/AutoBuild_Function.sh`
+   - Location: around line 133
+   - Problem: `echo -e "\nCONFIG_PACKAGE_luci-app-autoupdate=y" >> ${CONFIG_FILE}` runs after `cd openwrt`; `${CONFIG_FILE}` is the config name such as `x86_64-Z`, not `.config` or the full config path. This probably creates/edits an unintended file under `openwrt`.
+   - Suggested target: `${CONFIG_TEMP}` or the generated `.config`.
+
+7. Fix clone path/workdir usage.
+   - Files: all X/Y/Z workflows
+   - Locations: X around lines 160-163, Y around lines 157-160, Z around lines 156-159
+   - Problem: `/workdir` is created, but `git clone ... openwrt` clones into the workspace, then `ln -sf /workdir/openwrt $GITHUB_WORKSPACE/openwrt` does not move the clone into `/workdir`.
+   - Suggested fix: `git clone -b "$REPO_BRANCH" "$REPO_URL" /workdir/openwrt` then symlink `/workdir/openwrt` into `$GITHUB_WORKSPACE/openwrt`, or remove `/workdir` entirely.
+
+8. Make `Check Build Update` conditional.
+   - Files: all X/Y/Z workflows
+   - Locations: X around lines 228-232, Y around lines 224-228, Z around lines 222-226
+   - Problem: update checking runs even if the build failed or release upload is disabled. It depends on `openwrt/build_log.log` and remote release files.
+   - Suggested condition: `if: env.Result == 'true' && env.Release == 'true' && env.UPLOAD_RELEASES == 'true' && !cancelled()`.
+
+9. Remove hard-coded release repository from update checker.
+   - File: `Scripts/AutoBuild_Upcheck.sh`
+   - Locations: around lines 97 and 114
+   - Problem: release history is fetched from `X-OpenWrt/X-OpenWrt-Dev`, while workflows upload to `${{ github.repository }}`.
+   - Suggested fix: use `${GITHUB_REPOSITORY}` or pass the repository as an argument.
+
+10. Replace deprecated `::set-output`.
+    - Files: all X/Y/Z workflows
+    - Locations: X around line 68, Y around line 83, Z around line 84
+    - Problem: `::set-output` is deprecated.
+    - Suggested fix: `echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"`.
+
+11. Add explicit workflow permissions.
+    - Files: all X/Y/Z workflows
+    - Problem: releases and workflow-run deletion need write permissions. Current workflows rely on defaults.
+    - Suggested block: `permissions: contents: write, actions: write` with the minimum needed per workflow.
+
+12. Add concurrency control.
+    - Files: all X/Y/Z workflows
+    - Problem: multiple runs can upload to the same `AutoUpdate` tag and same date tag, causing races and overwrites.
+    - Suggested fix: add `concurrency` keyed by workflow/config, or include run id in per-run release tags.
+
+### Maintainability
+
+13. Consolidate X/Y/Z workflows.
+    - Files: all X/Y/Z workflows
+    - Problem: the three files are mostly copies, and drift has already produced Z-only bugs.
+    - Suggested fix: create one reusable workflow with `config_file` and `flag` inputs, or one matrix workflow for X/Y/Z.
+
+14. Pin actions to stable versions or SHAs.
+    - Files: all X/Y/Z workflows
+    - Examples: `actions/checkout@main`, `actions/upload-artifact@main`, `easimon/maximize-build-space@master`, `klever1988/cachewrtbuild@main`, `GitRML/delete-workflow-runs@main`, `xopenwrt/s3-upload-github-action@master`
+    - Problem: moving branches reduce reproducibility and increase supply-chain risk.
+    - Suggested fix: use versioned tags such as `actions/checkout@v4`, `actions/upload-artifact@v4`, or commit SHAs for third-party actions.
+
+15. Use typed `workflow_dispatch` inputs and normalize defaults.
+    - Files: all X/Y/Z workflows
+    - Locations: inputs around lines 14-28
+    - Problems:
+      - `Release` and `SharePoint` are free-form strings.
+      - `repository_dispatch` has no `github.event.inputs`, so manual defaults may not apply.
+      - `Tempoary_*` is misspelled and spread across workflows/scripts.
+    - Suggested fix: use boolean typed inputs where possible; add safe defaults in shell; keep old `Tempoary_*` as compatibility aliases if renaming.
+
+16. Validate user inputs before using them in shell.
+    - Files: all X/Y/Z workflows and `Scripts/AutoBuild_Function.sh`
+    - Problems: dispatch inputs are interpolated directly into shell blocks and `$GITHUB_ENV`.
+    - Suggested fix: pass inputs through `env:`, quote variables, validate config names against `Configs/*`, validate IP by regex plus octet range, and restrict flag characters.
+
+17. Replace repeated S3 upload steps with a loop or matrix.
+    - Files: all X/Y/Z workflows
+    - Problem: four nearly identical upload steps make path/name mistakes easy.
+    - Suggested fix: generate a list of existing firmware files and upload in a small script, or use a matrix with `FILE` values.
+
+18. Make firmware glob handling robust.
+    - Files: all X/Y/Z workflows
+    - Locations: `Download Github Release API` step, X around lines 279-314, Y around lines 274-309, Z around lines 273-308
+    - Problem: if a glob has no match, the literal pattern can be exported and uploaded.
+    - Suggested fix: use `shopt -s nullglob`, arrays, and skip missing files explicitly.
+
+19. Normalize line endings and final newlines.
+    - Files: `.github/workflows/X-x86_64_Y.yml`, `.github/workflows/X-x86_64_Z.yml`, `Configs/x86_64-Y`, `Configs/x86_64-Z`
+    - Problem: diff showed CRLF-style content and missing newline at EOF in config files.
+    - Suggested fix: standardize on LF and add final newline.
+
+20. Remove debug/noise differences between X/Y/Z.
+    - File: `.github/workflows/X-x86_64_Z.yml`
+    - Examples: `docker images` around line 150, extra `ls` around lines 254 and 394
+    - Problem: useful while debugging, but causes drift and noisy logs if kept permanently.
+
+### Build Efficiency
+
+21. Revisit download/build parallelism.
+    - Files: X/Y/Z workflows
+    - Examples: X uses `make download -j32`; Y/Z use `-j8`; all build with `make -j4`.
+    - Suggested fix: use a shared variable such as `BUILD_JOBS: $(nproc)` or a conservative configured number, then keep all workflows consistent.
+
+22. Trim duplicate and unnecessary apt packages.
+    - Files: all X/Y/Z workflows
+    - Locations: init environment package list
+    - Examples: `zlib1g-dev` and `git` appear more than once; editors like `vim`, `nano`, `lrzsz` are probably unnecessary in CI.
+    - Suggested fix: keep only required build dependencies and split comments by category.
+
+23. Move package replacement before defconfig/download where possible.
+    - Files: all X/Y/Z workflows
+    - Locations: adguardhome/passwall package deletion and symlink in build step
+    - Problem: package replacement happens after `feeds install`, `make defconfig`, and `make download`; selected package metadata/download behavior may drift from the package actually built.
+    - Suggested fix: perform package overrides before final `make defconfig` and `make download`.
+
+24. Pin external package repositories or document why moving branches are used.
+    - Files: workflows and `Scripts/AutoBuild_DiyScript.sh`
+    - Examples: `sbwml/packages_lang_golang -b 26.x`, `OpenWrt-Passwall main`, `fw876 master`, `xopenwrt master`
+    - Problem: builds can change without repo changes.
+    - Suggested fix: pin to commits/tags for reproducible builds, or accept moving branches but document it.
+
+### Script Robustness
+
+25. Add stricter error handling carefully to scripts.
+    - Files: `Scripts/AutoBuild_*.sh`
+    - Problem: helper functions often log failures but return success, so missing packages/files can be hidden.
+    - Suggested fix: introduce `set -euo pipefail` only after auditing expected non-fatal commands, or make critical helpers return non-zero on failure.
+
+26. Quote variables in shell scripts.
+    - Files: `Scripts/AutoBuild_Function.sh`, `Scripts/AutoBuild_Upcheck.sh`, `Scripts/AutoBuild_DiyScript.sh`
+    - Examples: `cd $1`, `grep $1`, `find $2`, `rm ${SVN_REPO_NAME} -rf`, many `cat openwrt/${build_pkg_dir}/Makefile`
+    - Problem: spaces, glob characters, or empty variables can cause unintended behavior.
+
+27. Fix `Get_Release_Info`.
+    - File: `Scripts/AutoBuild_Getenv.sh`
+    - Location: around line 28
+    - Problem: backticks around `cat ... | grep ...` execute the grep output as a command.
+    - Suggested fix: `grep 'KERNEL_PATCHVER:=' "${OPENWRT_BUILD_DIR}/target/linux/x86/Makefile"`.
+
+28. Make external IP lookup non-blocking.
+    - File: `Scripts/AutoBuild_Getenv.sh`
+    - Locations: around lines 18-21
+    - Problem: build info step depends on external APIs for logging.
+    - Suggested fix: add `curl --connect-timeout 5 --max-time 10` and tolerate failures.
+
+29. Improve `AutoBuild_Upcheck.sh` parsing.
+    - File: `Scripts/AutoBuild_Upcheck.sh`
+    - Locations: around lines 23-93
+    - Problems: parses build logs with multiple `cat | grep` chains, assumes Makefiles exist, and may duplicate package entries.
+    - Suggested fix: use `awk/sort -u`, quote paths, skip missing Makefiles, and record warnings.
+
+30. Improve release tag comparison.
+    - File: `Scripts/AutoBuild_Upcheck.sh`
+    - Locations: around lines 97-114
+    - Problem: date tags are compared lexically and initialized with `v2023-1-1`.
+    - Suggested fix: normalize tags to `vYYYY-MM-DD`, sort with `sort -V` or parse dates explicitly.
+
+### Config Maintenance
+
+31. Split common x86_64 config fragments from X/Y/Z differences.
+    - Files: `Configs/x86_64-X`, `Configs/x86_64-Y`, `Configs/x86_64-Z`
+    - Problem: target/image/IPv6/theme/base package settings are repeated, while X/Y/Z differ mainly by feature level.
+    - Suggested fix: maintain `x86_64-common`, `x86_64-X.fragment`, `x86_64-Y.fragment`, `x86_64-Z.fragment`, then concatenate into `.config` in the workflow.
+
+32. Shrink configs with OpenWrt diffconfig.
+    - Files: `Configs/x86_64-X`, `Configs/x86_64-Y`, `Configs/x86_64-Z`
+    - Problem: configs include redundant selected dependencies and stale comments.
+    - Suggested fix: after a successful build, use OpenWrt `scripts/diffconfig.sh` to keep only meaningful deltas.
+
+33. Re-check Z Image Builder expectations.
+    - File: `Configs/x86_64-Z`
+    - Locations: around lines 8-10
+    - Problem: Z enables `CONFIG_IB` and `CONFIG_IB_STANDALONE`, but the workflow still processes/uploads only firmware image patterns.
+    - Suggested fix: decide whether Image Builder artifacts should be uploaded, ignored, or disabled.
+
+34. Clean stale kernel comments.
+    - Files: `Configs/x86_64-X`, `Configs/x86_64-Y`, `Configs/x86_64-Z`
+    - Problem: commented `KERNEL_PATCHVER` lines do not affect OpenWrt config and can mislead later edits.
+    - Suggested fix: remove stale comments or move kernel selection into the correct build mechanism.
+
+35. Document X/Y/Z config intent and optimization todos.
+    - Files: `Configs/x86_64-X`, `Configs/x86_64-Y`, `Configs/x86_64-Z`, `NOTES_X86_CONFIG_OPTIMIZATION.md`
+    - Problem: the three x86_64 profiles do not clearly state their intended role, shared maintenance rules, or follow-up cleanup path.
+    - Suggested fix: add safe comment headers to each config and maintain a dedicated todo list for config-specific optimization work.
+    - Status: completed; follow-up cleanup todos are tracked in `NOTES_X86_CONFIG_OPTIMIZATION.md`.
+
+## Suggested First Fix Batch
+
+1. Fix Z upload path typo and Z mosdns build-order issue.
+2. Add S3 upload `if` conditions using `SharePoint`, `Result`, and `!cancelled()`.
+3. Replace all build commands with a shared pipefail-safe result pattern.
+4. Stop appending CI-only config options to tracked `Configs/*`.
+5. Replace deprecated `set-output` with `$GITHUB_OUTPUT`.
+
@@ -0,0 +1,37 @@
+# x86_64 X/Y/Z Config Optimization Todo
+
+Updated: 2026-06-29
+
+## Scope
+
+- `Configs/x86_64-X`
+- `Configs/x86_64-Y`
+- `Configs/x86_64-Z`
+- `.github/workflows/X-x86_64_X.yml`
+- `.github/workflows/X-x86_64_Y.yml`
+- `.github/workflows/X-x86_64_Z.yml`
+
+## Current Profile Notes
+
+- X: broad x86_64 profile with SmartDNS, Docker, WiFi firmware/drivers, IPv6, storage/network modules, and a larger LuCI package set.
+- Y: service-heavy x86_64 profile with SmartDNS, Passwall, AdGuardHome, Docker/Diskman, IPv6, and standard x86 image outputs.
+- Z: compact x86_64 profile with Passwall, AdGuardHome, Diskman/Netdata, standard x86 image outputs, and Image Builder enabled.
+
+## Todo
+
+- [ ] Extract shared target/image basics into one common x86_64 fragment, then keep X/Y/Z as small profile fragments.
+- [ ] After a successful build, run OpenWrt `scripts/diffconfig.sh` for X/Y/Z and remove redundant selected dependencies.
+- [ ] Decide the Z Image Builder policy: upload generated Image Builder artifacts, intentionally ignore them, or disable `CONFIG_IB`/`CONFIG_IB_STANDALONE`.
+- [ ] Standardize line endings and final newlines for `Configs/x86_64-Y` and `Configs/x86_64-Z` in a dedicated formatting-only commit.
+- [ ] Build a profile matrix that records intentional package deltas between X, Y, and Z.
+- [ ] Remove or relocate stale `KERNEL_PATCHVER` comments because they do not affect OpenWrt `.config` behavior.
+- [ ] Confirm each profile's `CONFIG_GRUB_IMAGES`, `CONFIG_VMDK_IMAGES`, `CONFIG_VDI_IMAGES`, `CONFIG_VHDX_IMAGES`, and upload globs still match the intended release artifacts.
+- [ ] Keep `CONFIG_DEVEL`, `CONFIG_CCACHE`, and other CI-only build toggles out of tracked config files.
+- [ ] If config fragments are introduced, add a small generation/check script so committed full configs can be reproduced.
+- [ ] Re-test X/Y/Z after cleanup with `make defconfig` and compare generated `.config` changes before committing behavior changes.
+
+## Do Not Mix
+
+- Do not normalize CRLF/LF while changing config semantics.
+- Do not remove dependency-selected `CONFIG_PACKAGE_*` lines until a successful `diffconfig.sh` pass proves they are redundant.
+- Do not change package selections in the same commit as documentation-only comment updates.
@@ -95,8 +95,8 @@ EOF
 		# done ; unset x
 		
 		patch < ${CustomFiles}/Patches/fix_coremark.patch -p1 -d ${WORK}
-		#patch < ${CustomFiles}/Patches/fix_aria2_auto_create_download_path.patch -p1 -d ${WORK}
-		patch < ${CustomFiles}/Patches/fix_luci-app-autoreboot-generic.patch -p1 -d ${WORK}
+		# patch < ${CustomFiles}/Patches/fix_aria2_auto_create_download_path.patch -p1 -d ${WORK}
+		# patch < ${CustomFiles}/Patches/fix_luci-app-autoreboot-generic.patch -p1 -d ${WORK}
 		# delete adguardhome in lede package
 		# rm package/feeds/packages/net/adguardhome -rf

@@ -114,16 +114,16 @@ EOF
 		;;
 		x86_64)
 			Copy ${CustomFiles}/Depends/cpuset ${BASE_FILES}/bin
-			AddPackage git passwall-depends openwrt-passwall-packages xiaorouji main
-			AddPackage git passwall-luci openwrt-passwall xiaorouji main
-			AddPackage git passwall2-luci openwrt-passwall2 xiaorouji main
+			AddPackage git passwall-packages openwrt-passwall-packages Openwrt-Passwall main
+			AddPackage git passwall-luci openwrt-passwall Openwrt-Passwall main
+			AddPackage git passwall2-luci openwrt-passwall2 Openwrt-Passwall main
 			AddPackage git other luci-app-dockerman lisaac master
 			rm -rf packages/lean/autocore # May Can Delete
 			AddPackage git lean autocore-modify xopenwrt master
 			sed -i -- 's:/bin/ash:'/bin/bash':g' ${BASE_FILES}/etc/passwd
 			#sed -i "s?6.0?5.19?g" ${WORK}/target/linux/x86/Makefile
 			# patch < ${CustomFiles}/Patches/upgrade_intel_igpu_drv.patch -p1 -d ${WORK}
-			patch < ${CustomFiles}/Patches/fix_mac80211.patch -p1 -d ${WORK}
+			# patch < ${CustomFiles}/Patches/fix_mac80211.patch -p1 -d ${WORK}
 			#fix hostapd
 			sed -i "s/\#CONFIG_AP/CONFIG_AP/g" ${WORK}/package/network/services/hostapd/files/wpa*
 		;;
@@ -23,8 +23,11 @@ Firmware_Diy_Before() {
 	fi
 	case "${OP_AUTHOR}/${OP_REPO}" in
 	coolsnowwolf/lede)
+		# Version_File=package/lean/default-settings/files/zzz-default-settings
+		# zzz_Default_Version="$(egrep -o "R[0-9]+\.[0-9]+\.[0-9]+" ${Version_File})"
 		Version_File=package/lean/default-settings/files/zzz-default-settings
-		zzz_Default_Version="$(egrep -o "R[0-9]+\.[0-9]+\.[0-9]+" ${Version_File})"
+		Version_Raw=$(cat package/lean/default-settings/files/zzz-default-settings | grep DISTRIB_REVISION)
+		zzz_Default_Version="$(echo $Version_Raw | egrep -o "R[0-9]+\.[0-9]+\.[0-9]+")"
 		OP_VERSION="${zzz_Default_Version}-${Compile_Date}"
 	;;
 	immortalwrt/immortalwrt)
@@ -127,7 +130,7 @@ Firmware_Diy_Main() {
 	if [[ ${AutoBuild_Features} == true ]]
 	then
 		AddPackage git other AutoBuild-Packages xopenwrt master
-		echo -e "\nCONFIG_PACKAGE_luci-app-autoupdate=y" >> ${CONFIG_FILE}
+		echo -e "\nCONFIG_PACKAGE_luci-app-autoupdate=y" >> ${CONFIG_TEMP}
 		for i in ${GITHUB_ENV} $(PKG_Finder d package AutoBuild-Packages)/autoupdate/files/etc/autoupdate/default
 		do
 			cat >> ${i} <<EOF
@@ -15,15 +15,16 @@ df -h

 # Get IP Info
 echo "------------------------------- IP Address Info ------------------------------"
-IP=`curl ip.115115.xyz -s`
-curl ip.115115.xyz -s
-curl -s https://searchplugin.csdn.net/api/v1/ip/get?ip=${IP} | jq -r .data.address
+IP="$(curl --connect-timeout 5 --max-time 10 -fsS ip.115115.xyz 2>/dev/null || true)"
+printf "%s\n" "${IP}"
+# curl -s https://searchplugin.csdn.net/api/v1/ip/get?ip=${IP} | jq -r .data.address
+[ -n "${IP}" ] && curl --connect-timeout 5 --max-time 10 -fsS "https://api.vore.top/api/IPdata?ip=${IP}" 2>/dev/null | jq -r .adcode.o || true
 }

 Get_Release_Info() {
 echo "------------------------------- Build Version Data ----------------------------"
 echo ${NOW_DATA_VERSION}
 echo "------------------------------ Build Kernel Version ---------------------------"
-`cat ${OPENWRT_BUILD_DIR}/target/linux/x86/Makefile | grep KERNEL_PATCHVER:=`
+grep "KERNEL_PATCHVER:=" "${OPENWRT_BUILD_DIR}/target/linux/x86/Makefile"

 }
@@ -94,24 +94,16 @@ done < "build_package.log"

        # export NOW_DATA_VERSION=${{env.NOW_DATA_VERSION}}
        # export GITHUB_WORKSPACE=$GITHUB_WORKSPACE
-wget https://api.github.com/repos/X-OpenWrt/X-OpenWrt-Dev/releases -O releases.json
-cat releases.json | jq  '.[].tag_name' -r > version.old
+RELEASE_REPOSITORY="${GITHUB_REPOSITORY:-X-OpenWrt/X-OpenWrt-Dev}"
+wget "https://api.github.com/repos/${RELEASE_REPOSITORY}/releases" -O releases.json
+jq -r '.[].tag_name' releases.json | grep -E '^v[0-9]{4}-[0-9]{2}-[0-9]{2}$' | sort -V > version.old
 echo ${NOW_DATA_VERSION}
-diff_version=v2023-1-1
-while read -r last_version
-do
-        if [[ "$last_version" != "AutoUpdate" ]]
-        then
-                if [[ "$last_version" < ${NOW_DATA_VERSION} ]]
-                then
-                        if [[ "$last_version" > ${diff_version} ]]
-                        then
-                                diff_version=$last_version
-                        fi
-                fi
-        fi
-done < "version.old"
-wget -O ${1}_build_pkg_ver_old.log https://github.com/X-OpenWrt/X-OpenWrt-Dev/releases/download/${diff_version}/${1}_build_pkg_ver.log
+diff_version=$(awk -v current="${NOW_DATA_VERSION}" '$0 < current { previous=$0 } END { print previous }' version.old)
+if [[ -z "${diff_version}" ]]
+then
+        diff_version=v2023-01-01
+fi
+wget -O ${1}_build_pkg_ver_old.log "https://github.com/${RELEASE_REPOSITORY}/releases/download/${diff_version}/${1}_build_pkg_ver.log"

 # Check_build_Version "LINUX_VERSION=${X_LINUX_VERSION}" ${1}
 echo "Tag:${1} Vesion Check" >> ${1}_build_pkg_up.log
Author	SHA1	Message	Date
xopenwrt	4f313f75d1	docs annotate x86 config profiles	2026-06-30 23:40:39 +08:00
xopenwrt	9059134344	ci retry package downloads serially	2026-06-30 23:31:42 +08:00
xopenwrt	d782c1a458	docs refresh ai task backlog	2026-06-29 23:31:49 +08:00
xopenwrt	1629605bbf	docs update codex handoff	2026-06-29 22:31:12 +08:00
xopenwrt	5f3650c671	validate workflow dispatch inputs	2026-06-29 22:28:58 +08:00
xopenwrt	f5492f01c6	normalize workflow input defaults	2026-06-29 22:23:30 +08:00
xopenwrt	e1a8af7f83	trim workflow apt packages	2026-06-29 22:17:16 +08:00
xopenwrt	c41abe2d3e	fix release tag comparison	2026-06-29 22:14:08 +08:00
xopenwrt	a48a5246a0	fix getenv diagnostics robustness	2026-06-29 22:12:06 +08:00
xopenwrt	2f177ace71	normalize workflow parallelism	2026-06-29 22:09:33 +08:00
xopenwrt	d8063acc06	remove z workflow debug noise	2026-06-29 22:06:23 +08:00
xopenwrt	3b9f12901e	pin workflow actions	2026-06-29 22:03:40 +08:00
xopenwrt	e79a0414be	add workflow permissions and concurrency	2026-06-29 21:57:48 +08:00
xopenwrt	cde11ef052	replace deprecated set output	2026-06-29 21:52:11 +08:00
xopenwrt	68666506d0	fix release repository lookup	2026-06-29 21:49:49 +08:00
xopenwrt	66269d4895	fix build update condition	2026-06-29 21:47:40 +08:00
xopenwrt	05acafa10f	fix openwrt clone workdir	2026-06-29 21:41:26 +08:00
xopenwrt	b327ffddd6	fix autoupdate config target	2026-06-29 21:33:49 +08:00
xopenwrt	5f897afd41	fix ci config mutation	2026-06-29 21:22:47 +08:00
xopenwrt	9769cda745	fix workflow build result detection	2026-06-29 21:09:28 +08:00
xopenwrt	2c1f06e0f2	fix s3 upload conditions	2026-06-29 20:53:12 +08:00
xopenwrt	db2c0eb598	docs add codex handoff notes	2026-06-28 23:57:17 +08:00
xopenwrt	175b2680b4	fix z s3 upload path	2026-06-28 22:27:29 +08:00
xopenwrt	13e85ab847	fix adguardhome err	2026-06-14 15:16:40 +08:00
xopenwrt	b6ca8b944c	add err log	2026-06-14 12:45:37 +08:00
xopenwrt	61444d2c11	disable lede adguardhome	2026-06-13 18:21:49 +08:00
xopenwrt	ce4d832d49	fix apt err	2026-06-13 10:18:24 +08:00
xopenwrt	c6944feabf	sync err fix	2026-06-13 01:07:51 +08:00
xopenwrt	57513cf4f8	update golang	2026-06-12 23:18:48 +08:00
xopenwrt	da8ae4c8ef	fix bug	2026-06-12 21:42:14 +08:00
xopenwrt	44c434d397	fix passwall	2026-06-12 21:37:32 +08:00
xopenwrt	762d1ecd06	fix passwall	2026-06-11 23:47:24 +08:00
xopenwrt	0e31ac6248	fix	2026-06-11 23:09:31 +08:00
xopenwrt	856ce8b5b5	fix	2026-06-11 22:54:58 +08:00
xopenwrt	dc6091db1a	fix	2026-06-11 22:46:43 +08:00
xopenwrt	daf9fdc776	fix	2026-06-11 22:42:56 +08:00
xopenwrt	54f624a756	fIx	2026-06-11 22:34:16 +08:00
xopenwrt	a665e75fa7	fix	2026-06-11 22:20:43 +08:00
xopenwrt	c62782c5d0	fix	2026-05-12 00:24:23 +08:00
xopenwrt	8770c61074	fix	2026-05-10 23:52:56 +08:00
xopenwrt	313bebb686	fix	2026-05-10 23:38:47 +08:00
xopenwrt	48675fbfc8	Release New Version	2025-11-27 10:30:50 +08:00
xopenwrt	4e37e8d084	fix action upload	2025-11-26 19:34:44 +08:00
xopenwrt	732b5f3844	Test	2025-11-26 19:17:39 +08:00
xopenwrt	d0be16a8cb	Test upload	2025-11-26 19:15:12 +08:00
xopenwrt	e4a1159b3a	fix upload path	2025-11-26 02:09:51 +08:00
xopenwrt	d24793566c	fix s3 upload	2025-11-25 23:48:50 +08:00
xopenwrt	a34b742edd	fix S3 upload bug	2025-11-25 23:45:29 +08:00
xopenwrt	d5ab5a6b2c	update	2025-11-25 23:43:05 +08:00
xopenwrt	225c014e56	update	2025-11-25 23:41:10 +08:00
xopenwrt	bff723d35c	test	2025-11-25 23:32:32 +08:00
xopenwrt	c80752ddf7	Add API Test	2025-11-25 23:20:35 +08:00
xopenwrt	4e0ccaf038	test S3 upload	2025-11-25 19:49:01 +08:00
xopenwrt	5e08d7e060	update uploader	2025-11-25 12:55:09 +08:00
xopenwrt	caf11ba27e	fix sharepoint uploader	2025-11-25 09:55:51 +08:00
xopenwrt	2e53d1b1f1	update golang version	2025-11-25 00:14:07 +08:00
xopenwrt	de3b57e64e	fix	2025-11-22 21:58:53 +08:00
xopenwrt	c43892ad94	test	2025-11-22 19:38:19 +08:00
xopenwrt	71e6f55a4e	remove mac80211 patch	2025-11-22 15:16:25 +08:00
xopenwrt	6c7873d959	fix Release get	2025-11-22 15:08:39 +08:00
xopenwrt	f9b26dbad4	rm docker image rm	2025-11-22 14:49:26 +08:00
xopenwrt	dfc88ebf8a	fix ip API	2025-11-22 14:29:58 +08:00