Add daily auto-update workflow and fix overlay dirty tag

- Rewrite check-upstream.sh to parse RPi kernel version from patch file - Add auto-update.sh for automated version bumps with patch smoke test - Rewrite check-updates.yaml as daily auto-build with issue fallback - Update build.yaml release body to show Talos + kernel versions from tag - Fix overlay dirty tag: remove --dirty from SBCOVERLAY_TAG git describe (the sed rewrite of pkg.yaml is intentional, not an accidental change) Tag strategy: v{TALOS}-k{KERNEL}-{BUILD} (e.g. v1.12.3-k6.12.47-1) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-13 15:05:46 -05:00 · 2026-02-13 15:05:46 -05:00 · 0d3941eb91
commit 0d3941eb91
parent 3a824e960f
5 changed files with 234 additions and 125 deletions
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@ -96,10 +96,14 @@ jobs:
            SCOUT_SECTION=$(cat _out/scout-report.md)
          fi
          # Extract component versions from tag (format: v1.12.3-k6.12.47-1)
          TALOS_VER=$(echo "$TAG" | sed -E 's/^(v[0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
          KERNEL_VER=$(echo "$TAG" | sed -E 's/.*-k([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
          RELEASE_BODY="Custom Talos Linux image for Raspberry Pi 5 / CM5 (Compute Blade)
-          **Talos version**: ${TAG}
+          **Talos**: ${TALOS_VER}
-          **Kernel**: RPi downstream (CM5/RP1 support)
+          **Kernel**: RPi downstream ${KERNEL_VER} (CM5/RP1 support)
          **Extensions**: iscsi-tools, util-linux-tools
          **Overclock**: 2.6GHz (arm_freq=2600)
--- a/.gitea/workflows/check-updates.yaml
+++ b/.gitea/workflows/check-updates.yaml
@ -1,25 +1,32 @@
-# Check for upstream Talos and RPi kernel updates
+# Daily upstream update check with auto-build
 #
-# Runs on a schedule and creates a Gitea issue when new versions are found.
+# Detects new Talos OS and RPi kernel versions, applies updates,
-# This is notification-only — builds require manual tag push after verifying
+# smoke-tests patches, and pushes a release tag (which triggers build.yaml).
-# patches still apply.
+# Falls back to creating a Gitea issue if patches fail to apply.
 name: Check Upstream Updates
 on:
  schedule:
-    # Run weekly on Monday at 08:00 UTC
+    - cron: '0 8 * * *'    # Daily at 08:00 UTC
    - cron: '0 8 * * 1'
  workflow_dispatch:
 jobs:
-  check-updates:
+  check-and-build:
    runs-on: [self-hosted, macos]
-    timeout-minutes: 10
+    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0    # Need full history for tag-based build numbering
      - name: Install dependencies
        run: |
          for pkg in make gnu-sed crane jq; do
            brew list --formula "$pkg" &>/dev/null || brew install "$pkg"
          done
      - name: Check for upstream updates
        id: check
@ -27,95 +34,83 @@ jobs:
          chmod +x scripts/check-upstream.sh
          scripts/check-upstream.sh >> "$GITHUB_OUTPUT"
-      - name: Create issue for Talos update
+      - name: Run auto-update
-        if: steps.check.outputs.talos_update == 'true'
+        if: steps.check.outputs.talos_update == 'true' || steps.check.outputs.rpi_update == 'true'
-        uses: actions/github-script@v7
+        id: update
-        with:
+        env:
-          script: |
+          TALOS_UPDATE: ${{ steps.check.outputs.talos_update }}
-            const currentVersion = '${{ steps.check.outputs.talos_current }}';
+          RPI_UPDATE: ${{ steps.check.outputs.rpi_update }}
-            const latestVersion = '${{ steps.check.outputs.talos_latest }}';
+          LATEST_TALOS: ${{ steps.check.outputs.talos_latest }}
-            const title = `Talos update available: ${currentVersion} → ${latestVersion}`;
+          LATEST_RPI_TAG: ${{ steps.check.outputs.rpi_latest }}
        run: |
          chmod +x scripts/auto-update.sh
          scripts/auto-update.sh >> "$GITHUB_OUTPUT"
-            // Check if an open issue already exists
+      - name: Commit and tag
-            const issues = await github.rest.issues.listForRepo({
+        if: steps.update.outputs.patch_failed != 'true' && steps.update.outputs.new_tag != ''
-              owner: context.repo.owner,
+        env:
-              repo: context.repo.repo,
+          NEW_TAG: ${{ steps.update.outputs.new_tag }}
-              state: 'open',
+        run: |
-              labels: 'upstream-update',
+          git config user.name "Gitea Actions"
-            });
+          git config user.email "actions@openharbor.io"
          git add -A
          git commit -m "Bump upstream: ${NEW_TAG}"
          git tag "$NEW_TAG"
          git push origin main --tags
-            const existing = issues.data.find(i => i.title.includes('Talos update'));
+      - name: Create issue on patch failure
-            if (existing) {
+        if: steps.update.outputs.patch_failed == 'true'
-              console.log(`Issue already exists: #${existing.number}`);
+        env:
-              return;
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-            }
+          TALOS_CURRENT: ${{ steps.check.outputs.talos_current }}
          TALOS_LATEST: ${{ steps.check.outputs.talos_latest }}
          TALOS_UPDATE: ${{ steps.check.outputs.talos_update }}
          RPI_CURRENT: ${{ steps.check.outputs.rpi_current }}
          RPI_LATEST: ${{ steps.check.outputs.rpi_latest }}
          RPI_UPDATE: ${{ steps.check.outputs.rpi_update }}
        run: |
          GITEA_URL="${GITHUB_SERVER_URL}"
          REPO="${GITHUB_REPOSITORY}"
          API="${GITEA_URL}/api/v1"
-            await github.rest.issues.create({
+          BODY="## Upstream update requires manual patch porting
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: title,
              body: [
                `## Talos Update Available`,
                ``,
                `| | Version |`,
                `|---|---|`,
                `| Current | \`${currentVersion}\` |`,
                `| Latest  | \`${latestVersion}\` |`,
                ``,
                `### Steps`,
                `1. Update \`TALOS_VERSION\` in \`Makefile\``,
                `2. Verify patches still apply: \`make checkouts patches\``,
                `3. If patches fail, port them to the new version`,
                `4. Push a version tag to trigger the build pipeline`,
                ``,
                `### Links`,
                `- [Talos Release Notes](https://github.com/siderolabs/talos/releases/tag/${latestVersion})`,
              ].join('\n'),
              labels: ['upstream-update', 'talos'],
            });
-      - name: Create issue for RPi kernel update
+          Automated patch application failed. Manual intervention needed.
        if: steps.check.outputs.rpi_update == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            const currentVersion = '${{ steps.check.outputs.rpi_current }}';
            const latestVersion = '${{ steps.check.outputs.rpi_latest }}';
            const title = `RPi kernel update available: ${currentVersion} → ${latestVersion}`;
-            const issues = await github.rest.issues.listForRepo({
+          | Component | Current | Latest | Update? |
-              owner: context.repo.owner,
+          |-----------|---------|--------|---------|
-              repo: context.repo.repo,
+          | Talos     | \`${TALOS_CURRENT}\` | \`${TALOS_LATEST}\` | ${TALOS_UPDATE} |
-              state: 'open',
+          | RPi kernel | \`${RPI_CURRENT}\` | \`${RPI_LATEST}\` | ${RPI_UPDATE} |
              labels: 'upstream-update',
            });
-            const existing = issues.data.find(i => i.title.includes('RPi kernel update'));
+          ### Steps
-            if (existing) {
+          1. Check out this repo and run \`scripts/auto-update.sh\` to see what fails
-              console.log(`Issue already exists: #${existing.number}`);
+          2. Port patches to the new upstream version
-              return;
+          3. Verify: \`gmake checkouts patches && gmake checkouts-clean\`
-            }
+          4. Push changes — the next scheduled run will pick them up
-            await github.rest.issues.create({
+          ### Links
-              owner: context.repo.owner,
+          - [Talos Releases](https://github.com/siderolabs/talos/releases)
-              repo: context.repo.repo,
+          - [RPi Linux Tags](https://github.com/raspberrypi/linux/tags)"
-              title: title,
+
-              body: [
+          # Strip leading whitespace from heredoc-style indentation
-                `## RPi Kernel Update Available`,
+          BODY=$(echo "$BODY" | sed 's/^          //')
-                ``,
+          BODY_JSON=$(jq -Rs '.' <<< "$BODY")
-                `| | Version |`,
+
-                `|---|---|`,
+          # Check for existing open issue to avoid duplicates
-                `| Current (in pkgs patch) | \`${currentVersion}\` |`,
+          EXISTING=$(curl -sf \
-                `| Latest stable           | \`${latestVersion}\` |`,
+            -H "Authorization: token ${GITEA_TOKEN}" \
-                ``,
+            "${API}/repos/${REPO}/issues?state=open&type=issues&labels=upstream-update" \
-                `### Steps`,
+            | jq -r '[.[] | select(.title | contains("manual patch"))][0].id // empty')
-                `1. Update the kernel version in the pkgs patch`,
+
-                `2. Verify the patch still applies: \`make checkouts patches\``,
+          if [ -n "$EXISTING" ]; then
-                `3. Test build: \`make kernel\``,
+            echo "Issue already exists (id: $EXISTING), skipping creation"
-                `4. Push a version tag to trigger the full build pipeline`,
+            exit 0
-                ``,
+          fi
-                `### Links`,
+
-                `- [RPi Linux Releases](https://github.com/raspberrypi/linux/tags)`,
+          curl -sf -X POST \
-              ].join('\n'),
+            -H "Authorization: token ${GITEA_TOKEN}" \
-              labels: ['upstream-update', 'kernel'],
+            -H "Content-Type: application/json" \
-            });
+            -d "{\"title\":\"Upstream update requires manual patch porting\",\"body\":${BODY_JSON},\"labels\":[\"upstream-update\"]}" \
            "${API}/repos/${REPO}/issues"
          echo "Created issue for manual patch porting"
--- a/2
+++ b/2
@ -45,7 +45,7 @@ PATCHES_DIRECTORY := $(PWD)/patches
 PKGS_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/pkgs && git describe --tag --always --dirty --match v[0-9]\*)
 TALOS_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/talos && git describe --tag --always --dirty --match v[0-9]\*)
-SBCOVERLAY_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5 && git describe --tag --always --dirty)-$(PKGS_TAG)
+SBCOVERLAY_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5 && git describe --tag --always)-$(PKGS_TAG)
 # Build the --system-extension-image flags from the EXTENSIONS list
 EXTENSION_FLAGS = $(foreach ext,$(EXTENSIONS),--system-extension-image=$(ext))
--- a/scripts/auto-update.sh
+++ b/scripts/auto-update.sh
@ -0,0 +1,107 @@
 #!/usr/bin/env bash
 # Auto-update upstream versions, verify patches, and generate a release tag
 #
 # Expects environment variables from check-upstream.sh:
 #   TALOS_UPDATE, RPI_UPDATE, LATEST_TALOS, LATEST_RPI_TAG
 #
 # Outputs (for GitHub Actions):
 #   patch_failed=true   — if patches fail to apply (caller should create issue)
 #   new_tag=<tag>       — the computed release tag (e.g. v1.12.3-k6.12.47-1)
 #
 # Usage:
 #   TALOS_UPDATE=true LATEST_TALOS=v1.13.0 ./scripts/auto-update.sh >> "$GITHUB_OUTPUT"
 set -euo pipefail
 TALOS_UPDATE=${TALOS_UPDATE:-false}
 RPI_UPDATE=${RPI_UPDATE:-false}
 LATEST_TALOS=${LATEST_TALOS:-}
 LATEST_RPI_TAG=${LATEST_RPI_TAG:-}
 MAKEFILE="Makefile"
 PATCH_FILE="patches/siderolabs/pkgs/0001-Patched-for-Raspberry-Pi-5.patch"
 # Helper: extract kernel semver (e.g. 6.12.47) from the RPi repo Makefile
 get_kernel_version() {
  local tag="$1"
  curl -sf "https://raw.githubusercontent.com/raspberrypi/linux/${tag}/Makefile" \
    | awk '
      /^VERSION/     { version=$3 }
      /^PATCHLEVEL/  { patchlevel=$3 }
      /^SUBLEVEL/    { sublevel=$3 }
      END { print version "." patchlevel "." sublevel }
    '
 }
 # ── RPi kernel update ───────────────────────────────────────────────
 if [ "$RPI_UPDATE" = "true" ] && [ -n "$LATEST_RPI_TAG" ]; then
  echo "Updating RPi kernel to $LATEST_RPI_TAG ..." >&2
  # Download tarball and compute checksums
  TARBALL_URL="https://github.com/raspberrypi/linux/archive/refs/tags/${LATEST_RPI_TAG}.tar.gz"
  TMP=$(mktemp)
  curl -sL "$TARBALL_URL" -o "$TMP"
  NEW_SHA256=$(shasum -a 256 "$TMP" | awk '{print $1}')
  NEW_SHA512=$(shasum -a 512 "$TMP" | awk '{print $1}')
  rm -f "$TMP"
  echo "  SHA256: $NEW_SHA256" >&2
  echo "  SHA512: $NEW_SHA512" >&2
  # Get actual kernel version for the config header
  KERNEL_VERSION=$(get_kernel_version "$LATEST_RPI_TAG")
  echo "  Kernel version: $KERNEL_VERSION" >&2
  # Update patch file
  sed -i "s/+  linux_version: .*/+  linux_version: ${LATEST_RPI_TAG}/" "$PATCH_FILE"
  sed -i "s/+  linux_sha256: .*/+  linux_sha256: ${NEW_SHA256}/" "$PATCH_FILE"
  sed -i "s/+  linux_sha512: .*/+  linux_sha512: ${NEW_SHA512}/" "$PATCH_FILE"
  sed -i "s|+# Linux/arm64 .* Kernel Configuration|+# Linux/arm64 ${KERNEL_VERSION} Kernel Configuration|" "$PATCH_FILE"
 fi
 # ── Talos update ────────────────────────────────────────────────────
 if [ "$TALOS_UPDATE" = "true" ] && [ -n "$LATEST_TALOS" ]; then
  echo "Updating Talos to $LATEST_TALOS ..." >&2
  # Update TALOS_VERSION in Makefile
  sed -i "s/^TALOS_VERSION = .*/TALOS_VERSION = ${LATEST_TALOS}/" "$MAKEFILE"
  # Derive matching PKG_VERSION (same major.minor as Talos)
  PKG_MINOR=$(echo "$LATEST_TALOS" | sed -E 's/^(v[0-9]+\.[0-9]+)\..*/\1/')
  LATEST_PKG=$(curl -sf "https://api.github.com/repos/siderolabs/pkgs/tags?per_page=20" \
    | jq -r "[.[] | select(.name | startswith(\"${PKG_MINOR}\"))][0].name")
  if [ -n "$LATEST_PKG" ] && [ "$LATEST_PKG" != "null" ]; then
    echo "  Updating PKG_VERSION to $LATEST_PKG" >&2
    sed -i "s/^PKG_VERSION = .*/PKG_VERSION = ${LATEST_PKG}/" "$MAKEFILE"
  else
    echo "  WARNING: No matching pkgs tag for $PKG_MINOR — keeping current PKG_VERSION" >&2
  fi
 fi
 # ── Smoke test — verify patches apply ───────────────────────────────
 echo "Running patch smoke test ..." >&2
 if ! gmake checkouts patches; then
  echo "Patches failed to apply!" >&2
  gmake checkouts-clean 2>/dev/null || true
  echo "patch_failed=true"
  exit 0
 fi
 gmake checkouts-clean
 # ── Generate tag ────────────────────────────────────────────────────
 TALOS_VER=$(grep '^TALOS_VERSION' "$MAKEFILE" | awk '{print $NF}')
 RPI_TAG=$(grep '+  linux_version:' "$PATCH_FILE" | awk '{print $NF}')
 KERNEL_VER=$(get_kernel_version "$RPI_TAG")
 # Find next build number for this component combination
 TAG_PREFIX="${TALOS_VER}-k${KERNEL_VER}"
 LAST_BUILD=$(git tag -l "${TAG_PREFIX}-*" \
  | sed "s|${TAG_PREFIX}-||" \
  | sort -n \
  | tail -1)
 NEXT_BUILD=$(( ${LAST_BUILD:-0} + 1 ))
 NEW_TAG="${TAG_PREFIX}-${NEXT_BUILD}"
 echo "Generated tag: $NEW_TAG" >&2
 echo "new_tag=$NEW_TAG"
--- a/scripts/check-upstream.sh
+++ b/scripts/check-upstream.sh
@ -1,54 +1,57 @@
 #!/usr/bin/env bash
 # Check for upstream Talos and RPi kernel updates
 #
-# Compares current versions in Makefile against the latest GitHub releases.
+# Compares current versions (from Makefile + pkgs patch) against the
-# Outputs GitHub Actions-compatible variables for use in CI workflows.
+# latest GitHub releases/tags. Outputs GitHub Actions-compatible variables.
 #
 # Usage:
-#   ./scripts/check-upstream.sh           # Print results
+#   ./scripts/check-upstream.sh           # Print results to stdout/stderr
 #   ./scripts/check-upstream.sh >> "$GITHUB_OUTPUT"  # For CI
 set -euo pipefail
 MAKEFILE="${MAKEFILE:-Makefile}"
 PATCH_FILE="${PATCH_FILE:-patches/siderolabs/pkgs/0001-Patched-for-Raspberry-Pi-5.patch}"
-# Extract current versions from Makefile
+# ── Current versions ────────────────────────────────────────────────
-CURRENT_TALOS=$(grep '^TALOS_VERSION' "$MAKEFILE" | head -1 | awk '{print $NF}')
+CURRENT_TALOS=$(grep '^TALOS_VERSION' "$MAKEFILE" | awk '{print $NF}')
-CURRENT_PKG=$(grep '^PKG_VERSION' "$MAKEFILE" | head -1 | awk '{print $NF}')
+CURRENT_RPI_TAG=$(grep '+  linux_version:' "$PATCH_FILE" | awk '{print $NF}')
-echo "Current Talos version: $CURRENT_TALOS"
+echo "Current Talos version: $CURRENT_TALOS" >&2
-echo "Current PKG version:   $CURRENT_PKG"
+echo "Current RPi kernel tag: $CURRENT_RPI_TAG" >&2
-# Check latest Talos stable release
+# ── Latest versions from GitHub API ─────────────────────────────────
 LATEST_TALOS=$(curl -sf "https://api.github.com/repos/siderolabs/talos/releases/latest" \
-  | grep '"tag_name"' | sed -E 's/.*"tag_name": *"([^"]+)".*/\1/')
+  | jq -r '.tag_name')
-echo "Latest Talos release:  $LATEST_TALOS"
+LATEST_RPI_TAG=$(curl -sf "https://api.github.com/repos/raspberrypi/linux/tags?per_page=20" \
  | jq -r '[.[] | select(.name | startswith("stable_"))][0].name')
-# Check latest RPi kernel stable tag (format: stable_YYYYMMDD)
+echo "Latest Talos release:  $LATEST_TALOS" >&2
-LATEST_RPI_KERNEL=$(curl -sf "https://api.github.com/repos/raspberrypi/linux/tags?per_page=10" \
+echo "Latest RPi kernel tag: $LATEST_RPI_TAG" >&2
  | grep '"name"' | grep 'stable_' | head -1 | sed -E 's/.*"name": *"([^"]+)".*/\1/')
-echo "Latest RPi kernel tag: $LATEST_RPI_KERNEL"
+# ── Determine what needs updating ───────────────────────────────────
-
+TALOS_UPDATE=false
-# Output for GitHub Actions
+RPI_UPDATE=false
 echo "talos_current=$CURRENT_TALOS"
 echo "talos_latest=$LATEST_TALOS"
 if [ "$CURRENT_TALOS" != "$LATEST_TALOS" ]; then
-  echo "talos_update=true"
+  TALOS_UPDATE=true
  echo ">> Talos update available: $CURRENT_TALOS -> $LATEST_TALOS" >&2
 else
  echo "talos_update=false"
  echo ">> Talos is up to date" >&2
 fi
-# For RPi kernel, we output what we found — the actual version tracking
+if [ "$CURRENT_RPI_TAG" != "$LATEST_RPI_TAG" ]; then
-# depends on the pkgs patch content which references a specific kernel tag
+  RPI_UPDATE=true
-echo "rpi_current=check-patch"
+  echo ">> RPi kernel update available: $CURRENT_RPI_TAG -> $LATEST_RPI_TAG" >&2
-echo "rpi_latest=$LATEST_RPI_KERNEL"
+else
  echo ">> RPi kernel is up to date" >&2
 fi
-# We always flag RPi kernel for review since we can't easily parse the
+# ── Output for GitHub Actions ───────────────────────────────────────
-# patch to extract the exact pinned version
+echo "talos_current=$CURRENT_TALOS"
-echo "rpi_update=true"
+echo "talos_latest=$LATEST_TALOS"
-echo ">> RPi kernel latest stable: $LATEST_RPI_KERNEL (review patch manually)" >&2
+echo "talos_update=$TALOS_UPDATE"
 echo "rpi_current=$CURRENT_RPI_TAG"
 echo "rpi_latest=$LATEST_RPI_TAG"
 echo "rpi_update=$RPI_UPDATE"