OpenCCA CI Scripts

This repository stores the build and workflow scripts to run a CI builder for OpenCCA.

Runner Setup

We use a stock Ubuntu LTS image.

Dependencies:

docker
kvm (must have user access to /dev/kvm)
make
git
repo

All jobs pull opencca-build and run the payload inside the opencca-build docker image.

Commit Builds

For selected repositories and branches, we build artifacts upon new commits. We follow these conventions:

• Do not clutter a forked repository. Only include a minimal workflow that calls a workflow in this repository.
• The workflows can optionally create temporary build artifacts that are kept in the job for 90 days. However, we use a dedicated release job for a snapshot release.
• The build jobs are stored in .github/workflows/build-*.yml. They are included in the source repositories workflow file.

Example: Opencca's kvmtool includes a workflow as follows:

name: opencca-build

permissions:
  contents: write

on:
  push:
    branches: [opencca/main, opencca/systex25, opencca/next]
  workflow_dispatch:

jobs:
  trigger-external:
    uses: opencca/ci-scripts/.github/workflows/build-kvmtool.yml@opencca/main
    with:
      branch: ${{ github.ref_name }}

CI Jobs:

Name	Repository	Workflow File
Build Linux	opencca/linux	build-linux.yml
Build U-Boot	opencca/u-boot	build-u-boot.yml
Build TF-RMM	opencca/tf-rmm	build-tf-rmm.yml
Build TFA	opencca/arm-trusted-firmware	opencca-tfa.yml
Build kvmtool	opencca/kvmtool	build-kvmtool.yml

Releases

Releases are stored as Github Releases in opencca-releases.

Naming convention:

• {project}/snapshot/{branch-name}/latest: Always points to the latest release
• {project}/snapshot/{branch-name}/{date}: A snapshot with date

• project = {firmware | linux | kvmtool | rootfs}

This allows us to have predicatable download links. For instance:

# Download latest firmware for opencca/main branch
wget https://github.com/opencca/opencca-releases/releases/download/firmware/snapshot/opencca/main/latest/firmware.tar.gz

The release workflows are triggered from this repository. They are in .github/workflows/release-*.yml

CI Jobs:

Name	Workflow File
Release Linux	release-linux.yml
Release Firmware	release-firmware.yml
Release Kvmtool	release-kvmtool.yml
Release Rootfs	release-debos-rootfs.yml