ci: replace generated artifact-matrix workflows with one reusable + thin callers

.github/actionlint.yaml

@@ -0,0 +1,10 @@
+self-hosted-runner:
+  # Armbian self-hosted runner labels (not known to actionlint)
+  labels:
+    - super
+    - repository
+    - repo
+    - fast
+    - alfa
+    - images
+    - aarch64

.github/workflows/build-all-stable.yml

@@ -0,0 +1,63 @@
+# Track caller: Build All Stable Artifacts (cronjob). Thin wrapper over complete-artifact-matrix.yml.
+name: "Build All Stable Artifacts (cronjob)"
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+    inputs:
+      skipImages:
+        description: 'Skip building images? no = build images, yes = skip images'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      checkOci:
+        description: 'Check OCI for existing artifacts? yes = check OCI, no = always build everything'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      extraParamsAllBuilds:
+        description: 'Extra params for all builds/jobs (eg: DEBUG=yes)'
+        type: string
+        default: ''
+      branch:
+        description: 'Framework build branch'
+        type: string
+        default: 'main'
+      targetsFilterInclude:
+        description: 'TARGETS_FILTER_INCLUDE, example: "BOARD:odroidhc4,BOARD:odroidn2"'
+        type: string
+        default: ''
+      nightlybuild:
+        description: 'yes = nightly, no = stable'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'no'
+      bumpversion:
+        description: 'Bump version'
+        type: boolean
+        default: false
+      versionOverride:
+        description: 'Version override'
+        type: string
+        default: ''
+
+concurrency:
+  group: pipeline
+  cancel-in-progress: false
+
+jobs:
+  build:
+    uses: ./.github/workflows/complete-artifact-matrix.yml
+    with:
+      release_repository: "os"
+      target_path: "stable/"
+      team: "Board Maintainers"
+      repository_ref: "all"
+      prepare_config: "armbian-images"
+      targets_filename: "targets-all-not-eos.yaml"
+      skipimages_default: "yes"
+      checkoci_default: "yes"
+      nightlybuild_default: "no"
+      bumpversion_default: false
+    secrets: inherit

.github/workflows/build-all.yml

@@ -0,0 +1,64 @@
+# Track caller: Build All Artifacts (cronjob). Thin wrapper over complete-artifact-matrix.yml.
+name: "Build All Artifacts (cronjob)"
+
+on:
+  schedule:
+    - cron: "0 20-23/2,0-4/2 * * *"
+    - cron: "0 8,14 * * *"
+  workflow_dispatch:
+    inputs:
+      skipImages:
+        description: 'Skip building images? no = build images, yes = skip images'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      checkOci:
+        description: 'Check OCI for existing artifacts? yes = check OCI, no = always build everything'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      extraParamsAllBuilds:
+        description: 'Extra params for all builds/jobs (eg: DEBUG=yes)'
+        type: string
+        default: ''
+      branch:
+        description: 'Framework build branch'
+        type: string
+        default: 'main'
+      targetsFilterInclude:
+        description: 'TARGETS_FILTER_INCLUDE, example: "BOARD:odroidhc4,BOARD:odroidn2"'
+        type: string
+        default: ''
+      nightlybuild:
+        description: 'yes = nightly, no = stable'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      bumpversion:
+        description: 'Bump version'
+        type: boolean
+        default: true
+      versionOverride:
+        description: 'Version override'
+        type: string
+        default: ''
+
+concurrency:
+  group: pipeline
+  cancel-in-progress: false
+
+jobs:
+  build:
+    uses: ./.github/workflows/complete-artifact-matrix.yml
+    with:
+      release_repository: "os"
+      target_path: "cron/"
+      team: "Board Maintainers"
+      repository_ref: "all"
+      prepare_config: "armbian-images"
+      targets_filename: "targets-all-not-eos.yaml"
+      skipimages_default: "yes"
+      checkoci_default: "yes"
+      nightlybuild_default: "yes"
+      bumpversion_default: true
+    secrets: inherit

.github/workflows/build-apps.yml

@@ -0,0 +1,61 @@
+# Track caller: Build Apps Images (cronjob). Thin wrapper over complete-artifact-matrix.yml.
+name: "Build Apps Images (cronjob)"
+
+on:
+  workflow_dispatch:
+    inputs:
+      skipImages:
+        description: 'Skip building images? no = build images, yes = skip images'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'no'
+      checkOci:
+        description: 'Check OCI for existing artifacts? yes = check OCI, no = always build everything'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      extraParamsAllBuilds:
+        description: 'Extra params for all builds/jobs (eg: DEBUG=yes)'
+        type: string
+        default: ''
+      branch:
+        description: 'Framework build branch'
+        type: string
+        default: 'main'
+      targetsFilterInclude:
+        description: 'TARGETS_FILTER_INCLUDE, example: "BOARD:odroidhc4,BOARD:odroidn2"'
+        type: string
+        default: ''
+      nightlybuild:
+        description: 'yes = nightly, no = stable'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'no'
+      bumpversion:
+        description: 'Bump version'
+        type: boolean
+        default: false
+      versionOverride:
+        description: 'Version override'
+        type: string
+        default: ''
+
+concurrency:
+  group: ${{ github.run_id }}-appsapps
+  cancel-in-progress: false
+
+jobs:
+  build:
+    uses: ./.github/workflows/complete-artifact-matrix.yml
+    with:
+      release_repository: "distribution"
+      target_path: "apps/"
+      team: "Release manager"
+      repository_ref: "stable"
+      prepare_config: "armbian-images"
+      targets_filename: "targets-release-apps.yaml"
+      skipimages_default: "no"
+      checkoci_default: "yes"
+      nightlybuild_default: "no"
+      bumpversion_default: false
+    secrets: inherit

userpatches/gha/chunks/550.per-chunk-artifacts_job.yaml → .github/workflows/build-artifacts-chunk.yml

@@ -1,25 +1,51 @@
-on: # <TEMPLATE-IGNORE>
-  workflow_dispatch:  # <TEMPLATE-IGNORE>
-jobs: # <TEMPLATE-IGNORE>
-  "TEMPLATE-JOB-NAME": # <TEMPLATE-JOB-NAME>
-    if: ${{ github.repository_owner == '[[org]]' && needs.matrix_prep.outputs.artifacts-chunk-not-empty-[[chunk]] == 'yes' }}  # <-- HERE: Chunk number.
-    needs: [ "matrix_prep" ]
+# Reusable: build ONE chunk of artifacts.
+#
+# Called (once per chunk) by complete-artifact-matrix.yml via a matrix. The chunk's
+# build matrix arrives as JSON in `chunk_json`; everything board/branch-specific lives
+# inside that JSON (produced at runtime by `compile.sh gha-matrix`). This file holds the
+# artifact-build job body exactly once -- there are no per-chunk copies anywhere.
+name: "Build artifacts chunk (reusable)"
+
+on:
+  workflow_call:
+    inputs:
+      chunk_json:              { required: true,  type: string }   # fromJSON -> strategy.matrix
+      not_empty:               { required: true,  type: string }   # 'yes' if this chunk has builds
+      version:                 { required: true,  type: string }
+      build_sha1:              { required: true,  type: string }
+      build_repository:        { required: false, type: string, default: "armbian/build" }
+      userpatches_repository:  { required: false, type: string, default: "armbian/os" }
+      userpatches_ref:         { required: false, type: string, default: "main" }
+      userpatches_dir:         { required: false, type: string, default: "userpatches" }
+      extra_params_all_builds: { required: false, type: string, default: "UPLOAD_TO_OCI_ONLY=yes" }
+
+# Re-exposed as env so the step bodies read the same names as the rest of the pipeline.
+env:
+  BUILD_REPOSITORY: ${{ inputs.build_repository }}
+  USERPATCHES_REPOSITORY: ${{ inputs.userpatches_repository }}
+  USERPATCHES_REF: ${{ inputs.userpatches_ref }}
+  USERPATCHES_DIR: ${{ inputs.userpatches_dir }}
+  EXTRA_PARAMS_ALL_BUILDS: ${{ inputs.extra_params_all_builds }}
+
+jobs:
+  build:
+    if: ${{ github.repository_owner == 'armbian' && inputs.not_empty == 'yes' }}
     strategy:
       fail-fast: false # let other jobs try to complete if one fails
-      matrix: ${{ fromJSON(needs.matrix_prep.outputs.artifacts-chunk-json-[[chunk]]) }} # <-- HERE: Chunk number.
-    name: ${{ matrix.desc || 'Empty A[[chunk]]' }} # <-- HERE: Chunk number.
+      matrix: ${{ fromJSON(inputs.chunk_json) }}
+    name: ${{ matrix.desc || 'Empty artifact chunk' }}
     runs-on: ${{ matrix.runs_on }}
     steps:
 
-      - name: "Runner clean ${{ needs.matrix_prep.outputs.version }}"
+      - name: "Runner clean ${{ inputs.version }}"
         uses: armbian/actions/runner-clean@main
 
       # Login to ghcr.io, for later uploading rootfs to ghcr.io
       - name: Docker Login to GitHub Container Registry
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
-          username: "[[ghcr_user]]" # GitHub username or org
+          username: "${{ github.repository_owner }}" # GitHub username or org
           password: "${{ secrets.GITHUB_TOKEN }}"    # GitHub actions builtin token. repo has to have pkg access.
 
       # cleanup the place where we will clone the userpatches repo, to avoid git going insane and cleaning everything later
@@ -31,7 +57,7 @@ jobs: # <TEMPLATE-IGNORE>
         uses: actions/checkout@v6 # We don't need to clone git, really. A wget would suffice for GH-hosted runners. But using clone is better for Igor-hosted runners.
         with:
           repository: ${{ env.BUILD_REPOSITORY }}
-          ref: ${{ needs.matrix_prep.outputs.build-sha1 }}
+          ref: ${{ inputs.build_sha1 }}
           fetch-depth: ${{ matrix.fdepth }}
           clean: false # true is default. it *will* delete the hosts /dev if mounted inside.
 
@@ -86,7 +112,21 @@ jobs: # <TEMPLATE-IGNORE>
           if [ -n "${CCACHE_REMOTE_STORAGE}" ]; then
             CCACHE_PARAMS+=( "CCACHE_REMOTE_STORAGE=${CCACHE_REMOTE_STORAGE}" "ENABLE_EXTENSIONS=ccache-remote" )
           fi
-          bash ./compile.sh ${{ matrix.invocation }} REVISION="${{ needs.matrix_prep.outputs.version }}" SHOW_DEBUG=yes SHARE_LOG=yes "${CCACHE_PARAMS[@]}" ${{env.EXTRA_PARAMS_ALL_BUILDS}}
+          # Repeat on failure: retry the build up to BUILD_ATTEMPTS times to ride out transient
+          # runner/network failures. Replaces the old external watchdog cron job.
+          BUILD_ATTEMPTS="${BUILD_ATTEMPTS:-3}"
+          for attempt in $(seq 1 "$BUILD_ATTEMPTS"); do
+            echo "::group::Build attempt ${attempt}/${BUILD_ATTEMPTS}"
+            if bash ./compile.sh ${{ matrix.invocation }} REVISION="${{ inputs.version }}" SHOW_DEBUG=yes SHARE_LOG=yes "${CCACHE_PARAMS[@]}" ${{env.EXTRA_PARAMS_ALL_BUILDS}}; then
+              echo "::endgroup::"
+              exit 0
+            fi
+            echo "::endgroup::"
+            echo "::warning::build attempt ${attempt}/${BUILD_ATTEMPTS} failed"
+            [ "$attempt" -lt "$BUILD_ATTEMPTS" ] && sleep 30
+          done
+          echo "::error::build failed after ${BUILD_ATTEMPTS} attempts"
+          exit 1
 
       - name: "Logs: ${{ steps.build.outputs.logs_url }}"
         if: always()

.github/workflows/build-community.yml

@@ -0,0 +1,63 @@
+# Track caller: Build Community Images (cronjob). Thin wrapper over complete-artifact-matrix.yml.
+name: "Build Community Images (cronjob)"
+
+on:
+  schedule:
+    - cron: "0 23 * * THU"
+  workflow_dispatch:
+    inputs:
+      skipImages:
+        description: 'Skip building images? no = build images, yes = skip images'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'no'
+      checkOci:
+        description: 'Check OCI for existing artifacts? yes = check OCI, no = always build everything'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      extraParamsAllBuilds:
+        description: 'Extra params for all builds/jobs (eg: DEBUG=yes)'
+        type: string
+        default: ''
+      branch:
+        description: 'Framework build branch'
+        type: string
+        default: 'main'
+      targetsFilterInclude:
+        description: 'TARGETS_FILTER_INCLUDE, example: "BOARD:odroidhc4,BOARD:odroidn2"'
+        type: string
+        default: ''
+      nightlybuild:
+        description: 'yes = nightly, no = stable'
+        type: choice
+        options: [ 'yes', 'no' ]
+        default: 'yes'
+      bumpversion:
+        description: 'Bump version'
+        type: boolean
+        default: true
+      versionOverride:
+        description: 'Version override'
+        type: string
+        default: ''
+
+concurrency:
+  group: ${{ github.run_id }}-unsupportedstable
+  cancel-in-progress: false
+
+jobs:
+  build:
+    uses: ./.github/workflows/complete-artifact-matrix.yml
+    with:
+      release_repository: "community"
+      target_path: "community/"
+      team: "Release manager"
+      repository_ref: "stable"
+      prepare_config: "armbian-community"
+      targets_filename: "targets-release-community-maintained.yaml"
+      skipimages_default: "no"
+      checkoci_default: "yes"
+      nightlybuild_default: "yes"
+      bumpversion_default: true
+    secrets: inherit