CI/CD Overview

GitHub Actions workflows in .github/workflows/ automate builds for all supported machines.

Workflow Types

Workflow type	Trigger	Use case
manual	GitHub Actions UI	On-demand builds
tag	Git tags	Release builds
onpush	Every push	Continuous validation (use sparingly, only for key machines)

Reusable workflows:

• buildkas-target.yaml — Reusable build workflow
• buildkas-upload.yaml — Artifact upload to S3

Machine Configuration

All machines are defined in .github/machines.json. This file is the single source of truth — workflow files are generated from it.

Adding or Modifying a Machine

Always follow this three-step process:

1. Edit .github/machines.json:

   {
       "config": "kas/machines/MACHINE.yaml:kas/scarthgap.yaml:kas/bsp-base.yaml:kas/build-configs/build-base-starter.yaml",
       "name": "MACHINE-NAME",
       "workflows": ["manual", "tag"]
   }

2. Regenerate workflows:

   .github/scripts/makeworkflows

3. Commit both — always commit machines.json and the generated workflow files together.

Optional Machine Properties

Property	Description
sdk: 1	Build SDK for this machine
output: "pattern"	Custom output file pattern
build_target: "recipe"	Override default build target
pvtest: ["local"]	Run pvtest suites against the build artifact in CI

Release config lockfiles

For every entry in machines.json, a pinned release config lives at kas/build-configs/release/<machine>-<branch>.yaml. These lockfiles are generated by:

.github/scripts/makemachines

The script runs kas dump --update --resolve-refs over each machine's snippet chain, resolving every layer repo to a concrete commit — so release builds are reproducible. --update fetches the latest upstream commits, so a plain run also bumps every repo to the current branch head.

Run it:

• when adding a machine to machines.json, to create its lockfile;
• with --remake after changing the snippet structure (adding a layer, changing a local_conf_header, …) to refresh all lockfiles without bumping the already-pinned repo commits.

Commit the regenerated lockfiles together with the change that triggered them.