From cc007521d57bcb1301440c7290314b2bdc5fcf24 Mon Sep 17 00:00:00 2001 From: Luciano Dittgen Date: Tue, 10 Nov 2026 15:42:34 -0300 Subject: [PATCH] ci/oelint: Pin the yocto-env.nix lint shell and key the cache on it The workflow took the lint shell from the tip of yocto-env.nix, so the oelint-adv 9.11.3 bump there (oelint.task.nocopy) failed OE Lint on master and on every open pull request at once, with no change in this layer. Pin the yocto-env.nix revision instead; a bump becomes its own pull request, which lints the layer with the new oelint-adv first. The layer has no flake.* for nix-actions to hash, so the store cache key was a constant 'nix-Linux-'. The first cache saved was never replaced, and every run built oelint-adv from source again. Append the pinned revision to the key, so each bump saves a cache with its tools. Save it only from master pushes; pull requests restore master's cache instead of each saving a private copy. Also limit the token to 'contents: read'; the job only reads the tree. Signed-off-by: Luciano Dittgen (cherry picked from commit a3a9ee37fa7dcb5ac24425a3183b3c14b2bb723f) --- .github/workflows/oelint.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/oelint.yaml b/.github/workflows/oelint.yaml index ec334d7..3002d55 100644 --- a/.github/workflows/oelint.yaml +++ b/.github/workflows/oelint.yaml @@ -11,6 +11,12 @@ concurrency: group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + +env: + YOCTO_ENV_REV: e181bffff69b534899b1f6af4ca3195cbdf5a6bd # oelint-adv 9.11.3 + jobs: oelint: runs-on: ubuntu-latest @@ -21,5 +27,7 @@ jobs: flake-check: false build-hosts: false build-devshells: false - devshell: github:OSSystems/yocto-env.nix#lint + devshell: github:OSSystems/yocto-env.nix/${{ env.YOCTO_ENV_REV }}#lint + cache-key-suffix: -yocto-env-${{ env.YOCTO_ENV_REV }} + cache-save: ${{ github.event_name == 'push' }} run: ./contrib/oelint/run-oelint.sh