Change the schedule from once a day to twice a day (03:00 and 15:00
UTC) and raise the default max_prs from 16 to 24, so more open PRs
get covered now that the per-PR trigger has been removed.
Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Drop the pull_request_target trigger so the LLM review no longer runs
on opened/reopened PRs. We are limited to 15 Claude routine runs per
day, and the automatic per-PR trigger exhausted that budget on
several days, starving the nightly digest.
The nightly schedule and manual workflow_dispatch triggers remain.
Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Delete .github/workflows/claude-code-review.yml. It is superseded by
the LLM review action, which runs automatically and uses the Claude
routine API instead of the much more expensive Claude API.
Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Manual workflow_dispatch and push share the same ref on main, so
they previously landed in the same concurrency group
'Build Kernel-refs/heads/main' (and the equivalent for the packages
workflow). With cancel-in-progress: false for non-PR events, only
one run can be pending per group: a newer queued run cancels the
older pending one.
That made the manual trigger unreliable in both directions. A push
landing while a dispatch was queued displaced the dispatch (so the
ccache reseed never ran), and dispatching while a push was queued
displaced the push (so the legitimate per-commit build was lost).
Adding github.event_name to the concurrency group puts pushes,
dispatches, and pull_requests in separate buckets on the same ref,
so they no longer compete with each other.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/23283
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Allow the Build Kernel and Build all core packages workflows to be
launched manually from the Actions tab. The shared workflow side
detects workflow_dispatch and, for Build Kernel, rebuilds the full
target/subtarget matrix including testing kernel versions, so a
manual run can re-seed the s3 ccache when a queued push run got
displaced from the concurrency queue by the next commit on main.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/23283
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Drop-in wrapper that calls the reusable LLM review workflows in
openwrt/actions-shared-workflows. Triggers on pull_request_target
(incl. PRs from forks), a nightly cron (03:00 UTC), and manual
workflow_dispatch with a max_prs input override.
A detect-kernels pre-step builds the extra_repos list at workflow
runtime: it reads target/linux/generic/kernel-* in the base branch
to derive gregkh/linux:v<X.Y.Z> tags for each currently-targeted
kernel, then appends u-boot/u-boot:master. The list updates
automatically when kernel versions are bumped; the routine clones
only the entries actually needed for a given diff.
The bundled .github/llm-review-rules.md teaches the bot two
project-specific deprecations to flag even when other in-tree files
still use the legacy form:
- LED label syntax `label = "<color>:<function>";` -->
`color = <LED_COLOR_ID_*>;` + `function = "<func>";`
- `mediatek,mtd-eeprom` for MAC sourcing -->
`nvmem-cells` + `nvmem-cell-names = "mac-address";`
Repository settings need LLM_ROUTINE_ID_PR / LLM_ROUTINE_TOKEN_PR
and the *_NIGHTLY counterparts populated before the workflow can
fire. See openwrt/actions-shared-workflows/docs/llm-review-setup.md
for the full setup procedure.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23105
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Update to the most recent version.
The biggest change is the switch to Node.js 24.
Link: https://github.com/openwrt/openwrt/pull/22903
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Update the dependencies to the latest version.
The biggest change is the update to Node.js 24.
Link: https://github.com/openwrt/openwrt/pull/22903
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is based on version 1.0.93 plus these commits:
0ca689a fix: fetch base branch to ensure correct PR-only diffs
b7d533d fix: handle fork PRs by fetching via pull/N/head
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Fix links open the Claude Code desktop app which is not useful in the
OpenWrt contributor workflow.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
track_progress: true makes Claude post an initial comment immediately
when triggered and update it with a checklist as it works, so reviewers
can see what Claude is doing rather than waiting for a silent delay.
It also forces tag mode on PR/issue comment events, which is the
correct mode for interactive code review.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Instruct Claude to prefer inline comments for file/line-specific
findings and keep all feedback short and to the point.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Allow Bash(grep:*) so Claude can search the codebase for context
during PR reviews. Without this, grep calls using shell glob patterns
were denied even though plain directory greps were allowed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The workflow already uses contents: read which prevents GitHub from
accepting any push. The --disallowedTools setting adds a second layer
by stopping Claude from even attempting git write operations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Allow Claude to post inline comments on specific lines when reviewing
PRs via the /claude trigger phrase.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use a patched fork while waiting for
https://github.com/anthropics/claude-code-action/pull/963 to be
merged and released upstream.
Version v1.0.77 contains many improvments over 1.0.49 which was used
before. It uses Sonnet 4.6 instead of Sonnet 4.5.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Version 1.0.49 added support for PRs from forked repositories.
This feature was reverted in v1.0.50, see:
https://github.com/anthropics/claude-code-action/pull/937
v1.0.49 broke commits made by Claude, but we do not use that
feature. Pin to v1.0.49 until
https://github.com/anthropics/claude-code-action/pull/963 is merged
and released.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Without a prompt the action auto-detected mode: tag instead of agent
when triggered via issue_comment, resulting in no review being posted.
Remove the prompt so the action can correctly use its built-in agent
mode with full PR context.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The claude-code-action uses mcp__github_ci__get_ci_status and related
tools to check workflow run status as part of the review. Without
actions: read the GitHub API calls for CI status are rejected.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The whitelist was too restrictive, causing permission denials when
Claude tried to use basic tools like Read or Grep to analyse the diff.
Remove it and let the action use its default toolset.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add claude-code-review.yml using anthropics/claude-code-action@v1.
The review runs when a PR comment containing "/claude" is posted,
avoiding unnecessary API usage on every push.
Uses issue_comment trigger restricted to PR comments only. Only
triggers for users with write access (OWNER, MEMBER, COLLABORATOR)
and when the comment body contains "/claude", preventing any runner
from being allocated for unrelated comments. A short domain hint
steers the review toward OpenWrt embedded Linux conventions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22556
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Run this only when a PR is created, so either author or anyone who can
edit the PR message (all maintainers) can trigger such build.
Instead of maintaining it in the main repository, move it to the
external repository to bloat this repository less with further CI
commits.
Signed-off-by: Paul Spooren <mail@aparcar.org>
While this worked during testing, the repository of a organization requires
extra permissions. Add write access to pull requests, like we do over at
packages.git.
Signed-off-by: Paul Spooren <mail@aparcar.org>
This has been requested many times, so let's add this to speed up reviews. When
a member of the "reviewers" group comments the magic word written below, that
specific firmware is created and attached by a bot.
build <target>/<subtarget>/<profile>
Members of the "reviewers" group have no extra privileges, they can not commit
to the repository nor perform any action outside the `build-on-comment` action.
Motivation is to speedup reviews and have a better source for sharing compiled
firmware.
Signed-off-by: Paul Spooren <mail@aparcar.org>
* Version 5 of this action updated the runtime to Node.js 20.
All scripts are now run with Node.js 20 instead of Node.js 16
and are affected by any breaking changes between Node.js 16 and 20.
* adapt the labeler configuration to the new format
Follow-up to #16251 this was reverted with b870c16534
Link: https://github.com/openwrt/openwrt/pull/16451
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16451
Signed-off-by: Robert Marko <robimarko@gmail.com>
* Version 5 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16251
Signed-off-by: Robert Marko <robimarko@gmail.com>
Use shared workflow in actions-shared-workflows instead of keeping the
workflow in openwrt main branch to make it easier to maintain and update
without bloating the main repository commit history.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add issue labeler action. This action will parse BUG issue from the
template and will make validation on the insert data.
The action will:
- Tag the issue with SNAPSHOT or release based on the provided release
- Tag the issue with the reported tag
- Tag the issue with the image kind (Official or Self Built)
- Validate the reported version exist
- Validate the reported release exist
- Validate the reported device exist
Will also tag the issue with useful tag or flag the issue as invalid.
Will also comment the issue with the invalid info provided.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Implement a GitHub Actions workflow for automated project releases.
The workflow triggers on Git tags, ensuring that a GitHub release is
created whenever a new tag is pushed.
That new release is going to be created in draft and pre-release mode
and needs to be manually promoted to the proper release, once its
decided, that its good enough and prepared.
This is a start of a streamlined and consistent release process for
GitHub, reducing manual intervention.
Acked-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Provide new required secret for S3 endpoint and bucket name to permit an
easier migration to new services.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Drop unused reusable workflow and dockerfiles now that we moved them to
a dedicated repository.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Migrate each workflow to use reusable workflow from dedicated repo to
skip pushing CI related commits to openwrt and better track versioning
of CI workflow.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Now that we build also core packages, we need more host tools. Compile
all of them to reduce compile time on other actions.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add support to label-kernel for compiling testing kernel version and
check patches. To trigger this special build appent :testing to the
normal label.
Example:
- ci:kernel:ipq806x:generic:testing
Test will fail if the requested target doesn't have a defined kernel
testing version.
Also add support for testing all target and subtarget. To trigger this
some special pattern are added:
- ci:kernel:all:all
Trigger test for all target and subtarget
- ci:kernel:all:first
Trigger test for all target and the first subtarget in alphabetical
order for the target.
With these special case :testing can also be used and every target and
subtarget that supports kernel testing version will be selected:
- ci:kernel:all:all:testing
Trigger test for all target and subtarget that have a kernel testing
version defined.
- ci:kernel:all:first:testing
Trigger test for all target and the first subtarget in alphabetical
order for the target that, if they have a kernel testing version
defined.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
CDNs are known to ship outdated or corrupted files, if it unpacks
correctly, it necessarily doesn't mean, that we're using the desired
content. So lets fix it by checking the tarball as well.
I'm adding GPG checking explicitly, its not needed, but just double
checking, that everything is working as expected on build
infrastructure.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Its being used by buildbot workers, adds g++-multilib to fix node
cross-compilation from a 64-bit build machine to 32-bit host.
References: https://github.com/openwrt/buildbot/pull/7
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Add support for getting ccache cache from S3.
ccache is archieved in a tar and downloaded from S3 Cloud Storage.
For push events, ccache is then uplodaed back to S3 to refresh and have
a ccache cache always fresh.
An additional workflow is added to upload files to an S3 Cloud Storage
from artifacts uplodaed to github. The minio tool is used to upload
files to S3.
If the ccache can't be downloaded from s3, we fallback to github cache
system.
Also limit s3 upload to the openwrt repository since external fork won't
have (obviously) the required secrtes to upload data to the S3 Cloud
Storage.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Limit ccache cache save/delete only on push events. Saving ccache
cache for pull request will result in bloat and refreshing ccache is not
possible due to security measure on enforcing read permission on
pull_request events.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
CCache cache is currently broken due to a funny bug in ccache compiler
type detection. It seems ccache compiler type detection is very fragile
and with the use of external toolchain doesn't correctly detect the
type.
The type detected is set to other instead of gcc resulting in ccache
complaining for unsupported compiler options.
To handle this problem, force the compiler type to gcc to make ccache
correctly work and speedup compilation.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add new input to define custom ccache cache type. This is useful to use
a different ccache cache for some special workflow that may do more test
than simple kernel compilation.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add option to disable use of ccache. This can be useful for some
sensible test that should not use ccache as they can cause side effects
of any sort. (example Coverity Scan)
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
