Export generated kernel configs

.github/workflows/build.yml

@@ -121,180 +121,14 @@ jobs:
         timeout-minutes: 8
         working-directory: ./kernel/linux
         run: |
-          set -euxo pipefail
-          run_olddefconfig() {
-            if [ "${{ matrix.arch }}" = "arm64" ]; then
-              timeout 300 make ARCH=arm64 olddefconfig < /dev/null
-            else
-              timeout 300 make olddefconfig < /dev/null
-            fi
-          }
+          bash "$GITHUB_WORKSPACE/scripts/prepare-kernel-config.sh" "${{ matrix.arch }}"
 
-          if [ "${{ matrix.arch }}" = "arm64" ]; then
-            cp "$GITHUB_WORKSPACE/arm64.config" .config
-          else
-            cp "$GITHUB_WORKSPACE/x86-64.config" .config
-          fi
-
-          scripts/config --disable SYSTEM_TRUSTED_KEYS
-          scripts/config --disable SYSTEM_REVOCATION_KEYS
-          scripts/config --enable TCP_CONG_BBR
-          scripts/config --disable DEFAULT_CUBIC
-          scripts/config --enable DEFAULT_BBR
-          scripts/config --set-str DEFAULT_TCP_CONG bbr
-          scripts/config --enable NET_SCH_DEFAULT
-          scripts/config --enable NET_SCH_FQ
-          scripts/config --disable DEFAULT_FQ_CODEL
-          scripts/config --disable DEFAULT_PFIFO_FAST
-          scripts/config --enable DEFAULT_FQ
-          scripts/config --set-str DEFAULT_NET_SCH fq
-          scripts/config --module NETFILTER_XTABLES
-          scripts/config --enable NETFILTER_XTABLES_LEGACY
-          scripts/config --module IP_NF_IPTABLES_LEGACY
-          scripts/config --module IP_NF_FILTER
-          scripts/config --module IP_NF_NAT
-          scripts/config --module IP_NF_TARGET_MASQUERADE
-          scripts/config --module IP_NF_MANGLE
-          scripts/config --module IP_NF_RAW
-          scripts/config --module IP6_NF_IPTABLES_LEGACY
-          scripts/config --module IP6_NF_FILTER
-          scripts/config --module IP6_NF_NAT
-          scripts/config --module IP6_NF_MANGLE
-          scripts/config --module IP6_NF_RAW
-          # Avoid generating kernel debug info and linux-image-*-dbg packages.
-          scripts/config --disable DEBUG_INFO
-          scripts/config --enable DEBUG_INFO_NONE
-          scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
-          scripts/config --disable DEBUG_INFO_DWARF4
-          scripts/config --disable DEBUG_INFO_DWARF5
-          scripts/config --disable DEBUG_INFO_REDUCED
-          scripts/config --disable DEBUG_INFO_COMPRESSED
-          scripts/config --disable DEBUG_INFO_SPLIT
-          scripts/config --disable DEBUG_INFO_BTF
-          scripts/config --disable DEBUG_INFO_BTF_MODULES
-          scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
-          # Mitigation for Dirty Frag attack surface.
-          scripts/config --disable AFS_FS
-          scripts/config --disable XFRM_ESP
-          scripts/config --disable INET_ESP
-          scripts/config --disable INET6_ESP
-          scripts/config --disable AF_RXRPC
-          scripts/config --disable RXKAD
-          
-          run_olddefconfig
-
-          scripts/config --disable AFS_FS
-          scripts/config --disable XFRM_ESP
-          scripts/config --disable INET_ESP
-          scripts/config --disable INET6_ESP
-          scripts/config --disable AF_RXRPC
-          scripts/config --disable RXKAD
-          scripts/config --enable TCP_CONG_BBR
-          scripts/config --disable DEFAULT_CUBIC
-          scripts/config --enable DEFAULT_BBR
-          scripts/config --set-str DEFAULT_TCP_CONG bbr
-          scripts/config --enable NET_SCH_DEFAULT
-          scripts/config --enable NET_SCH_FQ
-          scripts/config --disable DEFAULT_FQ_CODEL
-          scripts/config --disable DEFAULT_PFIFO_FAST
-          scripts/config --enable DEFAULT_FQ
-          scripts/config --set-str DEFAULT_NET_SCH fq
-          scripts/config --module NETFILTER_XTABLES
-          scripts/config --enable NETFILTER_XTABLES_LEGACY
-          scripts/config --module IP_NF_IPTABLES_LEGACY
-          scripts/config --module IP_NF_FILTER
-          scripts/config --module IP_NF_NAT
-          scripts/config --module IP_NF_TARGET_MASQUERADE
-          scripts/config --module IP_NF_MANGLE
-          scripts/config --module IP_NF_RAW
-          scripts/config --module IP6_NF_IPTABLES_LEGACY
-          scripts/config --module IP6_NF_FILTER
-          scripts/config --module IP6_NF_NAT
-          scripts/config --module IP6_NF_MANGLE
-          scripts/config --module IP6_NF_RAW
-          scripts/config --disable DEBUG_INFO
-          scripts/config --enable DEBUG_INFO_NONE
-          scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
-          scripts/config --disable DEBUG_INFO_DWARF4
-          scripts/config --disable DEBUG_INFO_DWARF5
-          scripts/config --disable DEBUG_INFO_REDUCED
-          scripts/config --disable DEBUG_INFO_COMPRESSED
-          scripts/config --disable DEBUG_INFO_SPLIT
-          scripts/config --disable DEBUG_INFO_BTF
-          scripts/config --disable DEBUG_INFO_BTF_MODULES
-          scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
-
-          run_olddefconfig
-
-          if grep -q '^CONFIG_XFRM_ESP=' .config; then
-            echo "ERROR: CONFIG_XFRM_ESP is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_INET_ESP=' .config; then
-            echo "ERROR: CONFIG_INET_ESP is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_INET6_ESP=' .config; then
-            echo "ERROR: CONFIG_INET6_ESP is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_AF_RXRPC=' .config; then
-            echo "ERROR: CONFIG_AF_RXRPC is enabled; refusing to continue."
-            exit 1
-          fi
-          if grep -q '^CONFIG_DEBUG_INFO=' .config; then
-            echo "ERROR: CONFIG_DEBUG_INFO is enabled; refusing to build debug kernel packages."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_TCP_CONG_BBR=y' .config; then
-            echo "ERROR: CONFIG_TCP_CONG_BBR is not built in."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_BBR=y' .config; then
-            echo "ERROR: CONFIG_DEFAULT_BBR is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_TCP_CONG="bbr"' .config; then
-            echo "ERROR: CONFIG_DEFAULT_TCP_CONG is not bbr."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_NET_SCH_FQ=y' .config; then
-            echo "ERROR: CONFIG_NET_SCH_FQ is not built in."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_NET_SCH_DEFAULT=y' .config; then
-            echo "ERROR: CONFIG_NET_SCH_DEFAULT is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_FQ=y' .config; then
-            echo "ERROR: CONFIG_DEFAULT_FQ is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_DEFAULT_NET_SCH="fq"' .config; then
-            echo "ERROR: CONFIG_DEFAULT_NET_SCH is not fq."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_NETFILTER_XTABLES_LEGACY=y' .config; then
-            echo "ERROR: CONFIG_NETFILTER_XTABLES_LEGACY is not enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_IPTABLES_LEGACY=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_IPTABLES_LEGACY is not module-enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_NAT=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_NAT is not module-enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_FILTER=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_FILTER is not module-enabled."
-            exit 1
-          fi
-          if ! grep -q '^CONFIG_IP_NF_TARGET_MASQUERADE=m' .config; then
-            echo "ERROR: CONFIG_IP_NF_TARGET_MASQUERADE is not module-enabled."
-            exit 1
-          fi
-          grep -E 'CONFIG_(DEBUG_INFO_NONE|TCP_CONG_BBR|DEFAULT_BBR|DEFAULT_TCP_CONG|NET_SCH_DEFAULT|NET_SCH_FQ|DEFAULT_FQ|DEFAULT_NET_SCH|NETFILTER_XTABLES_LEGACY|IP_NF_IPTABLES_LEGACY|IP_NF_NAT|IP_NF_FILTER|IP_NF_TARGET_MASQUERADE|IP6_NF_IPTABLES_LEGACY|IP6_NF_NAT|IP6_NF_FILTER)=' .config
+      - name: 上传最终配置文件
+        if: env.BUILD_NEEDED == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: config-${{ matrix.arch }}-${{ env.KERNEL_VERSION }}
+          path: ./build-configs/${{ matrix.arch }}*.config
 
       - name: 构建内核 Debian 包
         if: env.BUILD_NEEDED == 'true'
@@ -316,14 +150,6 @@ jobs:
           fi
           find ./kernel -maxdepth 1 -name 'linux-*.deb' -print | sort
 
-      - name: 上传配置文件
-        if: env.BUILD_NEEDED == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-${{ matrix.arch }}
-          path: ./kernel/linux/.config
-          include-hidden-files: true
-
       - name: 上传 deb 包
         if: env.BUILD_NEEDED == 'true'
         uses: actions/upload-artifact@v4
@@ -336,5 +162,7 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ matrix.arch }}-${{ env.KERNEL_VERSION }}
-          files: ./kernel/linux-*.deb
+          files: |
+            ./kernel/linux-*.deb
+            ./build-configs/${{ matrix.arch }}-${{ env.KERNEL_VERSION }}.config
           body: "带有 BBRv3 的最新内核，适用于 ${{ matrix.arch }} 架构。Compiled & Optimized by Joey."