action.yml

name: kbuild-deb
description: >-
  Build a Linux kernel as Debian packages (bindeb-pkg) with a configurable
  base defconfig, target architecture, and config fragments merged from any
  repo. Cross-compiles automatically when the target arch differs from the
  runner; builds natively otherwise. Follows the qcom-deb-images
  build-linux-deb.py methodology (defconfig -> merge_config.sh -> olddefconfig
  -> bindeb-pkg) in a reusable, arch-agnostic form.

inputs:
  kernel-repo:
    description: Git URL of the kernel repository to build.
    required: true
  kernel-ref:
    description: Branch or tag of the kernel repo to build (git clone --branch).
    required: true
  arch:
    description: >-
      Kernel ARCH to build (e.g. arm64, x86_64, arm, riscv, powerpc, s390).
    required: false
    default: arm64
  defconfig:
    description: Base config make target (e.g. defconfig, x86_64_defconfig).
    required: false
    default: defconfig
  cross-compile:
    description: >-
      CROSS_COMPILE prefix. Leave empty to auto-derive from arch (and to build
      natively when the target arch matches the runner).
    required: false
    default: ""
  deb-arch:
    description: >-
      Debian package architecture (DEB_HOST_ARCH). Leave empty to auto-derive
      from arch.
    required: false
    default: ""
  fragments:
    description: >-
      Newline-separated list of kconfig fragment paths or globs to merge on top
      of the base defconfig. Resolved inside fragments-repo when set, otherwise
      relative to the kernel tree. Empty = build the plain defconfig.
    required: false
    default: ""
  fragments-repo:
    description: >-
      Optional owner/repo to source fragments from (e.g.
      qualcomm-linux/qcom-deb-images). When set, the 'fragments' globs are
      resolved within a checkout of this repo.
    required: false
    default: ""
  fragments-ref:
    description: Ref for fragments-repo (default - its default branch).
    required: false
    default: ""

outputs:
  deb-dir:
    description: Directory containing the built .deb packages and SHA256SUMS.
    value: ${{ steps.collect.outputs.deb-dir }}
  config-file:
    description: Path to the published kernel .config used for the build.
    value: ${{ steps.collect.outputs.config-file }}
  kernelversion:
    description: Output of 'make kernelversion' for the built tree.
    value: ${{ steps.collect.outputs.kernelversion }}

runs:
  using: composite
  steps:
    - name: Resolve arch / toolchain settings
      shell: bash
      env:
        IN_ARCH: ${{ inputs.arch }}
        IN_CROSS: ${{ inputs.cross-compile }}
        IN_DEBARCH: ${{ inputs.deb-arch }}
        IN_DEFCONFIG: ${{ inputs.defconfig }}
      run: |
        set -eux
        karch="$IN_ARCH"
        debarch="$IN_DEBARCH"
        triple=""
        case "$IN_ARCH" in
          arm64)            karch=arm64;   debarch="${debarch:-arm64}";   triple=aarch64-linux-gnu ;;
          arm)              karch=arm;     debarch="${debarch:-armhf}";   triple=arm-linux-gnueabihf ;;
          x86_64|x86|amd64) karch=x86_64;  debarch="${debarch:-amd64}";   triple=x86_64-linux-gnu ;;
          riscv|riscv64)    karch=riscv;   debarch="${debarch:-riscv64}"; triple=riscv64-linux-gnu ;;
          powerpc|ppc64|ppc64el) karch=powerpc; debarch="${debarch:-ppc64el}"; triple=powerpc64le-linux-gnu ;;
          s390|s390x)       karch=s390;    debarch="${debarch:-s390x}";   triple=s390x-linux-gnu ;;
          *)
            # Unknown arch: require explicit cross-compile + deb-arch.
            if [ -z "$IN_CROSS" ] || [ -z "$IN_DEBARCH" ]; then
              echo "::error::arch '$IN_ARCH' is not auto-mapped; set both cross-compile and deb-arch inputs." >&2
              exit 1
            fi ;;
        esac

        host_debarch="$(dpkg --print-architecture)"
        if [ -n "$IN_CROSS" ]; then
          cross="$IN_CROSS"
        elif [ "$debarch" = "$host_debarch" ]; then
          cross=""                       # native build
        else
          cross="${triple}-"
        fi

        {
          echo "KBUILD_ARCH=${karch}"
          echo "KBUILD_DEBARCH=${debarch}"
          echo "KBUILD_CROSS_COMPILE=${cross}"
          echo "KBUILD_DEFCONFIG=${IN_DEFCONFIG}"
          echo "KBUILD_HOST_DEBARCH=${host_debarch}"
        } >> "$GITHUB_ENV"

    - name: Checkout fragments repo
      if: ${{ inputs.fragments-repo != '' }}
      uses: actions/checkout@v4
      with:
        repository: ${{ inputs.fragments-repo }}
        ref: ${{ inputs.fragments-ref }}
        path: .kbuild-fragments
        fetch-depth: 1

    - name: Install build dependencies
      shell: bash
      run: |
        set -eux
        export DEBIAN_FRONTEND=noninteractive

        cross_pkgs=""
        ssl_pkg="libssl-dev"
        if [ "${KBUILD_DEBARCH}" != "${KBUILD_HOST_DEBARCH}" ]; then
          # Cross build: enable the target as a foreign architecture so the
          # bindeb-pkg dependency check (libssl-dev:<target>) is satisfiable,
          # and pull the matching crossbuild toolchain.
          codename="$(. /etc/os-release && echo "$VERSION_CODENAME")"
          if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
            grep -q '^Architectures:' /etc/apt/sources.list.d/ubuntu.sources \
              || sudo sed -i "/^Signed-By:/i Architectures: ${KBUILD_HOST_DEBARCH}" \
                   /etc/apt/sources.list.d/ubuntu.sources
          fi
          if [ -s /etc/apt/sources.list ]; then
            sudo sed -i -E "s|^deb (\[[^]]*\] )?|deb [arch=${KBUILD_HOST_DEBARCH}] |" /etc/apt/sources.list
          fi
          printf 'Types: deb\nURIs: http://ports.ubuntu.com/ubuntu-ports\nSuites: %s %s-updates %s-security\nComponents: main universe restricted multiverse\nArchitectures: %s\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n' \
            "$codename" "$codename" "$codename" "${KBUILD_DEBARCH}" \
            | sudo tee /etc/apt/sources.list.d/kbuild-${KBUILD_DEBARCH}.sources >/dev/null
          sudo dpkg --add-architecture "${KBUILD_DEBARCH}"
          cross_pkgs="crossbuild-essential-${KBUILD_DEBARCH}"
          ssl_pkg="libssl-dev:${KBUILD_DEBARCH}"
        fi

        sudo apt-get update -qq
        sudo apt-get install -y --no-install-recommends \
          git make flex bison bc libdw-dev libelf-dev \
          dpkg-dev debhelper kmod python3 rsync coreutils \
          cpio xz-utils gzip dwarves \
          build-essential ${cross_pkgs} libssl-dev ${ssl_pkg}

    - name: Clone kernel
      shell: bash
      env:
        KERNEL_REPO: ${{ inputs.kernel-repo }}
        KERNEL_REF: ${{ inputs.kernel-ref }}
      run: |
        set -eux
        git clone --depth=1 --branch "$KERNEL_REF" "$KERNEL_REPO" linux

    - name: Configure (defconfig + fragments) and build bindeb-pkg
      shell: bash
      env:
        FRAGMENTS: ${{ inputs.fragments }}
        FRAGMENTS_REPO: ${{ inputs.fragments-repo }}
      run: |
        set -eux
        jobs="$(nproc)"
        mk=(make "-j${jobs}" "ARCH=${KBUILD_ARCH}" "CROSS_COMPILE=${KBUILD_CROSS_COMPILE}")

        # Resolve fragment globs to absolute paths. They live in the fragments
        # repo checkout when fragments-repo is set, else in the kernel tree.
        frag_base="$PWD/linux"
        [ -n "$FRAGMENTS_REPO" ] && frag_base="$PWD/.kbuild-fragments"
        frag_files=()
        if [ -n "${FRAGMENTS//[[:space:]]/}" ]; then
          while IFS= read -r pat; do
            [ -n "${pat//[[:space:]]/}" ] || continue
            matches=( $frag_base/$pat )
            if [ ! -e "${matches[0]}" ]; then
              echo "::error::no fragments matched '$pat' under $frag_base" >&2
              exit 1
            fi
            frag_files+=( "${matches[@]}" )
          done <<< "$FRAGMENTS"
        fi

        cd linux
        "${mk[@]}" "${KBUILD_DEFCONFIG}"
        if [ "${#frag_files[@]}" -gt 0 ]; then
          printf '==> merging %d fragment(s)\n' "${#frag_files[@]}"
          ARCH="${KBUILD_ARCH}" ./scripts/kconfig/merge_config.sh -m -r .config "${frag_files[@]}"
          "${mk[@]}" olddefconfig
        fi
        "${mk[@]}" "DEB_HOST_ARCH=${KBUILD_DEBARCH}" bindeb-pkg

    - name: Collect outputs (.deb + .config)
      id: collect
      shell: bash
      run: |
        set -eux
        shopt -s nullglob
        mkdir -p out
        # bindeb-pkg drops packages one dir above the kernel tree (./linux).
        debs=( *.deb )
        test "${#debs[@]}" -gt 0
        mv "${debs[@]}" out/
        kver="$(make -s -C linux kernelversion)"
        cp -v linux/.config "out/config-${kver}-${GITHUB_RUN_NUMBER:-0}"
        ( cd out && sha256sum *.deb config-* | tee SHA256SUMS )
        ls -la out
        {
          echo "deb-dir=out"
          echo "config-file=$(ls out/config-*)"
          echo "kernelversion=${kver}"
        } >> "$GITHUB_OUTPUT"