update 2026-08-17 16:36:08

luci-app-dnsmasq-ipset/.github/workflows/build.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   build:
-    name: Build (${{ inputs.arch }}-${{ steps.version.outputs.release }})
+    name: Build (${{ inputs.arch }}-${{ inputs.version }})
     runs-on: ubuntu-latest
 
     steps:
@@ -27,12 +27,15 @@ jobs:
           set -eu
           case "${REQUESTED}" in
             latest)
-              # Resolve the latest stable OpenWrt release, skipping RCs / pre-releases.
+              # Resolve the latest stable OpenWrt release by semantic version
+              # (the GitHub releases API orders by created_at, so a newer point
+              # release of an older series, e.g. v24.10.8 created after v25.12.5,
+              # would otherwise be picked first). Skip RCs / pre-releases.
               tag="$(gh api \
                 -H "Accept: application/vnd.github+json" \
                 /repos/openwrt/openwrt/releases \
                 --paginate \
-                -q '[.[] | select(.prerelease == false and (.tag_name | test("-rc|-RC")) | not) | .tag_name] | .[0]')"
+                -q '[.[] | select(.prerelease == false and (.tag_name | test("-rc|-RC")) | not) | .tag_name] | sort_by(ltrimstr("v") | split(".") | map(tonumber? // 0)) | last')"
               if [ -z "${tag}" ]; then
                 echo "Could not determine latest OpenWrt release" >&2
                 exit 1
@@ -49,24 +52,78 @@ jobs:
           esac
           echo "release=${release}" >> "${GITHUB_OUTPUT}"
 
-      # Checkout the repository into a subdirectory named after the package.
-      # openwrt/gh-action-sdk mounts the workspace as a feed (src-link -> /feed)
-      # and the OpenWrt feed scanner skips a Makefile at the feed root, so the
-      # package must live one directory level deep to be discovered.
       - name: Checkout package
         uses: actions/checkout@v4
         with:
           path: luci-app-dnsmasq-ipset
 
-      - name: Build package
-        uses: openwrt/gh-action-sdk@v4
+      - name: Build package with OpenWrt SDK
         env:
           ARCH: ${{ inputs.arch }}-${{ steps.version.outputs.release }}
-          PACKAGES: luci-app-dnsmasq-ipset
+          PKG_NAME: luci-app-dnsmasq-ipset
+        run: |
+          set -eu
+          mkdir -p artifacts
+          # The SDK container runs as the non-root `buildbot` user (uid 1000),
+          # so the bind-mounted artifacts dir (owned by the runner, uid 1001,
+          # mode 755) is not writable by default — the in-container `cp ...
+          # /artifacts/` would fail with "Permission denied". Make it writable
+          # by any uid so the built package can be copied out.
+          chmod 777 artifacts
+
+          # The OpenWrt SDK containers are x86_64-native (the SDK is a Linux
+          # x86_64 toolchain that cross-compiles target packages), so this runs
+          # natively on the amd64 GitHub runner without QEMU.
+
+          docker run --rm \
+            -v "$GITHUB_WORKSPACE:/feed" \
+            -v "$GITHUB_WORKSPACE/artifacts:/artifacts" \
+            -e PKG_NAME \
+            "ghcr.io/openwrt/sdk:${ARCH}" \
+            /bin/bash -lc '
+              set -eu
+              cd /builder
+
+              # Snapshot containers ship a setup.sh that extracts the SDK;
+              # release containers already have it, so this is effectively a
+              # no-op there.
+              [ ! -f setup.sh ] || bash setup.sh
+
+              # Mount our repo as a feed. The OpenWrt feed scanner skips a
+              # Makefile at the feed root (find -mindepth 1), so the package
+              # is checked out one directory level deep (luci-app-dnsmasq-ipset/).
+              echo "src-link packages_ci /feed/" >> feeds.conf
+
+              ./scripts/feeds update -a
+
+              # Install our package into package/feeds/ BEFORE defconfig so it
+              # is part of Config.in and can actually be selected — defconfig
+              # only reflects packages known at the time it runs.
+              ./scripts/feeds install -p packages_ci -f "$PKG_NAME"
+
+              # Explicitly select the package, then expand dependencies.
+              echo "CONFIG_PACKAGE_${PKG_NAME}=y" >> .config
+              make defconfig
+
+              echo "::group::.config (selected package)"
+              grep -E "CONFIG_PACKAGE_(luci-app-dnsmasq-ipset|dnsmasq-full)=" .config || true
+              echo "::endgroup::"
+
+              make "package/$PKG_NAME/compile" V=s -j"$(nproc)"
+
+              if [ -d bin/ ]; then
+                find bin/ -name "${PKG_NAME}*.ipk" -exec cp -v -t /artifacts/ {} +
+                find bin/ -name "${PKG_NAME}*.apk" -exec cp -v -t /artifacts/ {} +
+              fi
+            '
+
+      - name: List artifacts
+        if: always()
+        run: ls -la artifacts/ 2>/dev/null || true
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: luci-app-dnsmasq-ipset-${{ steps.version.outputs.release }}-${{ inputs.arch }}
-          path: bin/**/luci-app-dnsmasq-ipset*.ipk
-          if-no-files-found: error
+          path: artifacts/luci-app-dnsmasq-ipset*.*pk
+          if-no-files-found: warn