Skip to content

ci/oelint: Pin the yocto-env.nix lint shell and key the cache on it - #149

Merged
otavio merged 1 commit into
OSSystemsEmbeddedLinux:masterfrom
lucianogdittgen:ci/oelint-pin-yocto-env
Nov 10, 2026
Merged

otavio merged 1 commit into
OSSystemsEmbeddedLinux:masterfrom
lucianogdittgen:ci/oelint-pin-yocto-env

Conversation

@lucianogdittgen

Copy link
Copy Markdown
Contributor

OE Lint took its tools from the tip of OSSystems/yocto-env.nix#lint. The oelint-adv 9.11.3 bump there (oelint.task.nocopy) failed master and every open pull request (#134 to #147) at once, with no change in this layer. This pins the yocto-env.nix revision (e181bff, oelint-adv 9.11.3), so an oelint-adv bump becomes its own pull request, which lints the layer before it lands.

It also fixes the Nix store cache. The layer has no flake.* for nix-actions to hash, so the key was always nix-Linux-, the cache saved in August was never replaced, and every run built oelint-adv from source. The key now ends in the pinned revision, and only master pushes save it; pull requests restore master's cache. The job token is limited to contents: read.

Checked: actionlint is clean, and contrib/oelint/run-oelint.sh in the pinned shell passes on master + #148. This needs #148 merged first to go green, since it lints the same master tree.

wrynose has the same workflow, hence the backport wrynose label.

The workflow took the lint shell from the tip of yocto-env.nix, so the
oelint-adv 9.11.3 bump there (oelint.task.nocopy) failed OE Lint on
master and on every open pull request at once, with no change in this
layer. Pin the yocto-env.nix revision instead; a bump becomes its own
pull request, which lints the layer with the new oelint-adv first.

The layer has no flake.* for nix-actions to hash, so the store cache
key was a constant 'nix-Linux-'. The first cache saved was never
replaced, and every run built oelint-adv from source again. Append the
pinned revision to the key, so each bump saves a cache with its tools.
Save it only from master pushes; pull requests restore master's cache
instead of each saving a private copy.

Also limit the token to 'contents: read'; the job only reads the tree.

Signed-off-by: Luciano Dittgen <luciano.dittgen@ossystems.com.br>
@otavio
otavio merged commit 2c756c8 into OSSystemsEmbeddedLinux:master Nov 10, 2026
1 check failed
@github-actions

Copy link
Copy Markdown

Successfully created backport PR for wrynose:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants