Enable Cppcheck alongside the other analyzers on master pushes and
manual dispatch, using the existing container and KUnit-enabled runner.
Keep failures for source findings and incomplete analysis, and list the
enabled job in the tooling guide. Use only analyzer names for job titles;
KUnit source coverage remains mandatory.
The Ginkgo VM job reports this runner warning:
Node.js 20 is deprecated. The following actions target Node.js 20
but are being forced to run on Node.js 24: actions/checkout@v4,
actions/upload-artifact@v4.
KUnit uses the same action versions. Update checkout and upload-artifact
to v7 in both VM workflows so they explicitly select Node.js 24, matching
the analyzer workflow. Retain checkout and artifact collection settings.
The analyzer image and runner already support Coccinelle, but its matrix
entry is commented out. Pushes to master and manual workflow runs
therefore skip semantic-patch analysis entirely.
Enable coccicheck as a parallel matrix job, using the existing runner to
invoke make coccicheck with KUnit sources included. Remaining source
findings fail the job, and parser/tool failures retain the separate
incomplete-analysis status. Existing diagnostics remain visible without
adding exclusions or changing analyzer models.
Update the CI guide to list the enabled target. Cppcheck remains disabled,
and workflow triggers remain push to master and manual dispatch.
Add a parallel make checkpatch job for pushes to master and manual
runs. Fail analyzer jobs on remaining source findings with status 1;
keep tool, build and coverage failures separate with status 2.
Validate the current report, Make status and native coverage before
classifying results. Checkpatch needs its script and data, not a
prepared KUnit kernel. Update the isolated CI report fixtures.
Run SCST style fixtures and make scs_lint in a separate job without a
kernel build, alongside the native analyzers. Pin uv and its setup
action; the linter supplies its pinned parser dependencies.
Retain the pull-request Checkpatch workflow for patch and commit
checks. Remove the standalone push Checkpatch workflow, whose role
is now covered by the common static-analyzer workflow.
Rename Tooling to Analyzer script tests and clarify that analyzer
jobs include KUnit sources without executing KUnit. Update Checkout
and Upload Artifact to v7 to replace their deprecated Node.js 20
runtimes, and align the CI documentation with the actual jobs.
Reserve the legacy-kernel fork checks for manual runs instead of adding
two VM jobs and extra kernel builds to the regular CI selection. Remove
the Linux 5.8/5.9 Ginkgo jobs and regression matrix entries, retaining the
kernel pins and local-only VM runner for reproduction.
Label the fork spec manual and exclude that label from both ci-pr and
ci-push. Move smoke to the READ CAPACITY entries so their existing CI
coverage remains intact. Keep full manual runs inclusive, update the
selection checks, and document focused manual execution.
dev_user_map_buf() now switches at Linux 5.9: get_user_pages() with
mmap_read_lock() on 5.8, pin_user_pages() from 5.9. The GitHub regression
subset goes from 5.10 to 5.4, so neither side of that boundary is compiled
on pull requests. Add the 5.9 and 5.8 selectors, which resolve to the
5.9.16 and 5.8.18 entries already in ABT_KERNELS.
scst_user pins its data buffers from Linux 5.9, the first release in
which fork() gives the child a copy of a pinned page (commit
70e806e4e645, "mm: Do early cow for pinned pages during fork() for
ptes"). The Ginkgo "handler forks" spec checks this, but CI boots only
the current Fedora kernel, so the boundary itself is never tested.
Add a Ginkgo job matrix that runs the local "user" specs on Fedora 33's
Linux 5.8.18 and 5.9.16, on both sides of the boundary. On 5.9.16 the
fork spec relies on the pin alone; on 5.8.18 the handler protects its
buffers with MADV_DONTFORK, as required there. Both must keep correct
geometry and data. The jobs are named after their kernels, like the
regression jobs.
- kernel-5.8.env, kernel-5.9.env and their SHA256SUMS pin those kernels'
rpms from Fedora's koji, like kernel.env and kernel.SHA256SUMS.
Fedora's only 5.9.0 build is a rawhide kernel that defines RHEL_MAJOR 8
and RHEL_MINOR 99, so SCST's backports treat it as RHEL and the build
fails; 5.9.16 has the same fork() behavior.
- build-image takes an optional pin name, such as "kernel-5.9", for
Ginkgo images. The image is otherwise built the same way.
- The Dockerfile downloads exactly the rpms listed in the selected
checksum file, since 5.9 has no kernel-modules-core package.
- vm.py --local-only boots only the target guest, without the iSCSI
initiator or the private network, and expects only the local report.
The guest then writes a config without an iscsi section. The label
filter is restricted to local specs: "local && (<filter>)", or "local"
without one.
Run isolated tooling checks and separate Sparse and Smatch Make targets
on pushes to master and manual dispatch. Use the pinned kernel with
KUnit enabled and preserve full logs, policy and tool provenance.
During the source-fix rollout, completed source findings are advisory.
Tool, build, parser and coverage failures remain blocking, including an
empty scan or missing KUnit inputs. Local Make targets stay strict.
Validate the current run's report together with Make's exit status,
since Make maps both findings and incomplete analysis to status 2.
Prepare the runner and container for Coccinelle and Cppcheck as well,
but leave their matrix entries commented out. Cover all four report
formats and GNU Make exit mapping with isolated tooling fixtures.
Use the dedicated native analyzer targets instead of regression wrappers
that return success after tool failures and summarize filtered output.
Remove their suffix switches and the analyzer-only IBM VIO option.
Update the regression caller and kernel-option parser together; the
maintained kernel list and compilation matrix are unchanged. Keep legacy
Checkpatch until its own integration series.
Pull requests that only change development guides or independent tooling
still compile kernels and run the VM suites. Select Ginkgo, KUnit, Clang
and kernel regression through one shared path policy before expensive
work. Compare the whole PR against its merge base, retaining deleted
paths and both sides of renames. Run checks for unclassified inputs.
Keep path rules in .github/ci-checks.toml and validate their structure,
check names, literal paths and conflicting entries before selection.
Provide a validation-only command. Changes to the config or selector
exercise every check.
Select kernel regression once in the preparation job and gate the build
job before expanding its matrix. Unrelated PRs do not allocate a runner
for every kernel. Selection failures fail the workflow and successful
skips include a reason in the job summary.
Run the Packages workflow only after pushes to master, preserving its
DEB/RPM builds and publication. Keep the separate Clang DEB build on PRs.
Retain full master and manual checks and the existing Checkpatch runs.
Cover path ownership, config validation and Git histories with tests,
and shorten the CI guide around all workflows, selection and results.
Quote the CC environment key so Checkpatch does not interpret unchanged
YAML diff context as a Cc trailer.
Refresh eight existing upstream series and add Linux 7.3, using the
kernel.org release feed and archives as of October 19, 2026. Keep older
series in the matrix, including the final Linux 7.1.13 release.
Update the existing Rocky 10.2, 9.8 and 8.10 kernels and the UEK entries
for Oracle Linux 10, 9 and 8. Also pick up the final AlmaLinux 9.3 and
8.8 source RPM updates. Preserve distribution releases and UEK generations.
Add the 7.3 regression selector. Both CI matrices resolve exact versions
from nightly.conf, so no workflow version lists need updating. Keep full
nightly checks on 7.3 and apply the usual -nc option to the previous head.
Keep RPM artifact creation, archive generation, package release preparation
and version updates in one directory. Switch all component archive targets,
the top-level RPM target and the RPM workflow to the relocated helpers.
Point archive generation at the shared source inventory in source/ while
preserving its caller-directory semantics and the existing package inputs.
Move patch generation, specialization, regression, kernel selection and
module signing helpers together, with their shared shell libraries. Update
component Makefiles, CI, nightly jobs, packaging metadata, documentation
and KUnit tooling references alongside the move.
Adjust repository-root and source-inventory lookups for the deeper path.
Resolve rhel-rpm-functions relative to kernel-functions through
BASH_SOURCE, since it is also sourced by the QLogic extraction helpers.
Keep the regression runner behavior and the nightly kernel matrix intact,
including the existing checkpatch, sparse and smatch switches and policy.
The checkpatch workflows fetch checkpatch.pl, spelling.txt and
const_structs.checkpatch with a plain curl. When raw.githubusercontent.com
rate-limits the runner, curl saves the HTTP 429 error page as
checkpatch.pl and exits successfully. The next step then runs that page
as a script, so every commit fails with
./checkpatch.pl: line 1: 429:: command not found
which looks like a checkpatch failure of the pull request.
Pass -f so that an HTTP error fails the download step, and --retry 5 so
that transient errors, including HTTP 429, are retried first. Also use
-sSL to keep the log quiet and follow redirects.
Keep CI selection policy in shared ci-pr and ci-push label sets. Resolve
them to ordinary Ginkgo expressions for local discovery and execution,
and before booting CI guests so report validation still checks the exact
filter. Preserve ordinary expressions and the full manual selection.
Mark both ACG teardown scenarios as race and exclude that category from
master push runs. Keep their strict overlap, recovery and cleanup checks
unchanged. PR runs retain basic/smoke coverage through ci-pr.
Document the named selections and check their filtering behavior and
propagation through the VM supervisor.
Build RPM packages only on pushes to master and remove the manual package
workflow trigger. Keep DEB checks on pull requests and retain the rolling
master publication with its current-head checks and release serialization.
Cancel outdated runs of the same pull request within each CI workflow.
Give other events a separate group per run so master package builds and
publication are not interrupted by newer pushes. Keep the full regression
matrix and all build and test steps unchanged.
Build kernel-matched images on GitHub-hosted runners and execute tests
under an external QEMU supervisor. Run KUnit and Ginkgo in independent
jobs that each build and test SCST. Keep guest images local to each job
and upload build logs and test reports.
Capture serial logs outside the guests, require complete matching
reports, and bound guest execution independently of kernel health.
Exercise guest panic and timeout handling before KUnit. Give Ginkgo an
isolated iSCSI peer and disposable block storage.
Print native test output and summaries in the job log. On failure, include
supervisor errors, kernel diagnostics and bounded serial tails while
retaining complete artifacts and the original test command exit status.
Select basic management and smoke SCSI/I/O tests on both transports for
pull requests. Run every Ginkgo spec after pushes to master and on manual
runs. Pass the label filter into the guest and require both transport
reports to confirm the requested selection.
Provide kunit-build for all test-owning modules and their dependencies,
kunit-run for existing artifacts, and kunit-test for a sequential build
and run even under make -j. Allow root builds and run every command with
the caller's privileges. Require root for module execution.
Map KUNIT_TEST and KUNIT_LOG to private Kbuild switches. Default
KUNIT_LABEL to ALL and use KUNIT_ARGS for other runner options and
module paths. Resolve artifacts from explicit arguments, configuration
or the recorded build, preserving spaces. Group and align the Makefile
help for component tests, KUnit and ordinary build targets.
Read label-to-suite mappings and dependency order from module metadata,
without a separate Python owner registry. Reject dependency cycles and
missing SCST core artifacts. Load external kernel dependencies with
modprobe before preparing KUnit; keep shared system
modules loaded. Load only selected SCST owners and their dependencies
from the supplied build and trigger suites through native KUnit debugfs.
Support built-in and modular KUnit with autorun disabled. Load modular
KUnit with known parameters when absent and release it after SCST
cleanup or a clean initial load failure. Reuse an existing instance only
after validating its effective parameters in sysfs; reject invalid or
unreadable values without changing the module. Never unload preloaded
KUnit. Check global filters before loading SCST.
Capture fresh kernel records and parse suites with the upstream KTAP
parser. Preserve logs and skip reasons, associating first-parameter
diagnostics with their case without changing plans or results. Stop
module operations on incomplete evidence, diagnostics or retained
fixtures. Continue after ordinary assertion failures. Finish capturing
output after command exit. Distinguish suites not started from missing
results, and count each Oops as one event. Print concise errors and
colored terminal statuses as suites finish. Group failure details after
progress. Normalize each assertion block independently of printk
messages while retaining value indentation. Follow with explicit stop
reasons and a compact SCST build summary. Reserve module headings,
author, license, source checksums, vermagic and other modules for
verbose output. Keep full case logs, module metadata and kernel
diagnostics in plain-text and JSON reports.
Cover build ordering, selection, kernel setup, dependency preparation,
runner lifecycle and reporting with mocked operations. Document VM
setup, build, execution and extension in the KUnit guide.
Add kunit-clean for test-owning component builds. Invalidate the recorded
module list and clear tooling caches on ordinary and component clean
paths too, including failed cleanup. Preserve reports and user settings.
Check all tooling, kunit-build and cleanup in one CI job. Pin the
Fedora container by digest and fetch a fixed kernel-devel package from
Koji with a SHA-256 check, independently of the regression matrix.
Save build evidence without building a kernel or loading modules.
Integrate optional native KUnit suites with out-of-tree SCST modules.
A single CONFIG_SCST_KUNIT_TEST switch includes all test objects of
each owner. Declare each suite name and label once and discover source
registrations for kunit-list without a build or loaded modules.
Preserve ordinary builds without KUnit.
Start with a fixed-wire LUN regression. Centralize private visibility
and task-scoped static-stub switches, and define retained-fixture
reporting for asynchronous tests. Use current native KUnit APIs
without compatibility shims. Keep optional execution messages behind
CONFIG_SCST_KUNIT_LOG while leaving failure diagnostics unconditional.
Add Makefile/Kbuild regression checks and document the shared switch.
Keep compatibility builds free of KUnit, including inherited test
options and allmodconfig. Generate ordinary in-tree SCST patches with
private declarations but without test suites or KUnit build options.
Check this boundary and preserve kernels without an unwinder option.
Mark the mounted GitHub workspace as a safe Git directory inside Ubuntu
package containers.
This keeps tracked source enumeration and version metadata available to
make dpkg.
Build Ubuntu 20.04 and 24.04 DEB artifacts in release-specific job
containers with explicit kernel headers.
Publish one bundle per Ubuntu LTS target and keep the README independent of
matrix versions.
Run CI and package builds for pull requests and for pushes to master.
Avoid running both event types for each same-repository PR update.
Keep manual package workflow runs available.
Enable WERROR=y for CI and package builds so warnings in SCST code
are fatal.
Keep WERROR=n for regression and Coverity because these workflows
must tolerate failures outside strict SCST package gates.
Publish a rolling prerelease after the complete master package
matrix succeeds. Validate and bundle every downloaded artifact before
replacing the previous master-rpm snapshot.
Build the six RPM targets resolved from ABT_KERNELS and portable
Ubuntu DKMS and user-space packages. Upload commit-specific GitHub Actions
artifacts for every target.
Keep exact kernel versions only in ABT_KERNELS. Resolve the bounded GitHub
regression and RPM subsets from stable selectors, and reject missing or
ambiguous matches.
The current action branch fails with "No recipients defined" when
envelope_from is set in this workflow. The SMTP username already
provides the sender address, so envelope_from is unnecessary here.
Show the kernel compilation output whenever the run reached the
compilation stage (both pass/fail cases) and add a readable prefix
with the actual filename. Also refactor to use variables for version,
workdir, and output; quote expansions; and switch to titled GitHub
Actions annotations. Drop `-k` and rely on explicit cleanup.
Add compatibility for RHEL 8.10 and RHEL 9.6 kernels. Update nightly build
and regression test configs, and adjust version checks in the codebase
to handle changes in these new RHEL kernel releases.
Gleb Chesnokov
wenlxieandGleb Chesnokov