Automate latest stable BBRv3 builds without debug packages

2026-06-09 17:22:27 +08:00
commit deff87f064
9 changed files with 20522 additions and 0 deletions
@@ -0,0 +1,263 @@
+name: 构建带有BBRv3的内核
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Daily automatic kernel refresh. BBRv3 itself stays pinned to the repo patch.
+    - cron: "17 3 * * *"
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: bbrv3-kernel-build
+  cancel-in-progress: false
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 删除旧的工作流运行记录
+        uses: Mattraks/delete-workflow-runs@main
+        with:
+          retain_days: 0
+          keep_minimum_runs: 0
+
+  build:
+    needs: cleanup
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runs_on: ubuntu-latest
+          - arch: arm64
+            runs_on: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runs_on }}
+    env:
+      ARCH: ${{ matrix.arch }}
+      KERNEL_VERSION: ""
+    steps:
+      - name: 获取内核版本
+        id: get_kernel_version
+        run: |
+          version=$(curl -s https://www.kernel.org \
+            | grep -A1 -m1 "stable:" \
+            | grep -oP '\d+\.\d+\.\d+')
+          echo "KERNEL_VERSION=$version" >> $GITHUB_ENV
+
+      - name: 检查是否已发布
+        id: check_release
+        run: |
+          tag="${{ matrix.arch }}-${KERNEL_VERSION}"
+          if gh release view "$tag" >/dev/null 2>&1; then
+            echo "BUILD_NEEDED=false" >> "$GITHUB_ENV"
+            echo "$tag already exists; skipping build."
+          else
+            echo "BUILD_NEEDED=true" >> "$GITHUB_ENV"
+            echo "$tag does not exist; building latest kernel with pinned BBRv3 patch."
+          fi
+
+      - name: 检出代码
+        if: env.BUILD_NEEDED == 'true'
+        uses: actions/checkout@v4
+
+      - name: 安装依赖项
+        if: env.BUILD_NEEDED == 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            git build-essential \
+            libncurses-dev libssl-dev libelf-dev \
+            bison bc flex rsync debhelper \
+            dpkg-dev fakeroot kmod cpio dwarves \
+            libdw-dev lz4 zstd xz-utils curl jq
+
+      - name: 创建源码目录
+        if: env.BUILD_NEEDED == 'true'
+        run: mkdir -p ./kernel/linux
+
+      - name: 下载内核源代码
+        if: env.BUILD_NEEDED == 'true'
+        working-directory: ./kernel
+        run: |
+          branch=$(echo "${{ env.KERNEL_VERSION }}" | grep -oP '^\d+\.\d+')
+          git clone --depth=1 --branch linux-$branch.y \
+            https://github.com/gregkh/linux.git linux
+
+      - name: 应用 BBRv3 补丁
+        if: env.BUILD_NEEDED == 'true'
+        working-directory: ./kernel/linux
+        run: |
+          bash "$GITHUB_WORKSPACE/scripts/apply-bbrv3-port.sh"
+          grep -n "BBR_VERSION" net/ipv4/tcp_bbr.c
+
+      - name: 编译声明
+        if: env.BUILD_NEEDED == 'true'
+        working-directory: ./kernel/linux
+        run: |
+          grep -v "MODULE_DESCRIPTION" net/ipv4/tcp_bbr.c > net/ipv4/tcp_bbr.c.tmp
+          mv net/ipv4/tcp_bbr.c.tmp net/ipv4/tcp_bbr.c
+          
+          echo 'MODULE_DESCRIPTION("TCP BBR v3 (Bottleneck Bandwidth and RTT) - Compiled & Optimized by Joey");' >> net/ipv4/tcp_bbr.c
+          
+          tail -n 5 net/ipv4/tcp_bbr.c
+
+      - name: 更新 Makefile 中的版本号
+        if: env.BUILD_NEEDED == 'true'
+        working-directory: ./kernel/linux
+        run: |
+          IFS='.' read -r v p s <<< "${{ env.KERNEL_VERSION }}"
+          sed -i "s/^VERSION *=.*/VERSION = $v/" Makefile
+          sed -i "s/^PATCHLEVEL *=.*/PATCHLEVEL = $p/" Makefile
+          sed -i "s/^SUBLEVEL *=.*/SUBLEVEL = $s/" Makefile
+
+      - name: 准备 .config 并禁用证书检查
+        if: env.BUILD_NEEDED == 'true'
+        working-directory: ./kernel/linux
+        run: |
+          if [ "${{ matrix.arch }}" = "arm64" ]; then
+            cp "$GITHUB_WORKSPACE/arm64.config" .config
+          else
+            cp "$GITHUB_WORKSPACE/x86-64.config" .config
+          fi
+
+          scripts/config --disable SYSTEM_TRUSTED_KEYS
+          scripts/config --disable SYSTEM_REVOCATION_KEYS
+          scripts/config --enable TCP_CONG_BBR
+          scripts/config --disable DEFAULT_CUBIC
+          scripts/config --enable DEFAULT_BBR
+          scripts/config --set-str DEFAULT_TCP_CONG bbr
+          # Avoid generating kernel debug info and linux-image-*-dbg packages.
+          scripts/config --disable DEBUG_INFO
+          scripts/config --enable DEBUG_INFO_NONE
+          scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
+          scripts/config --disable DEBUG_INFO_DWARF4
+          scripts/config --disable DEBUG_INFO_DWARF5
+          scripts/config --disable DEBUG_INFO_REDUCED
+          scripts/config --disable DEBUG_INFO_COMPRESSED
+          scripts/config --disable DEBUG_INFO_SPLIT
+          scripts/config --disable DEBUG_INFO_BTF
+          scripts/config --disable DEBUG_INFO_BTF_MODULES
+          scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
+          # Mitigation for Dirty Frag attack surface.
+          scripts/config --disable AFS_FS
+          scripts/config --disable XFRM_ESP
+          scripts/config --disable INET_ESP
+          scripts/config --disable INET6_ESP
+          scripts/config --disable AF_RXRPC
+          scripts/config --disable RXKAD
+          
+          if [ "${{ matrix.arch }}" = "arm64" ]; then
+            make ARCH=arm64 olddefconfig
+          else
+            make olddefconfig
+          fi
+
+          scripts/config --disable AFS_FS
+          scripts/config --disable XFRM_ESP
+          scripts/config --disable INET_ESP
+          scripts/config --disable INET6_ESP
+          scripts/config --disable AF_RXRPC
+          scripts/config --disable RXKAD
+          scripts/config --enable TCP_CONG_BBR
+          scripts/config --disable DEFAULT_CUBIC
+          scripts/config --enable DEFAULT_BBR
+          scripts/config --set-str DEFAULT_TCP_CONG bbr
+          scripts/config --disable DEBUG_INFO
+          scripts/config --enable DEBUG_INFO_NONE
+          scripts/config --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
+          scripts/config --disable DEBUG_INFO_DWARF4
+          scripts/config --disable DEBUG_INFO_DWARF5
+          scripts/config --disable DEBUG_INFO_REDUCED
+          scripts/config --disable DEBUG_INFO_COMPRESSED
+          scripts/config --disable DEBUG_INFO_SPLIT
+          scripts/config --disable DEBUG_INFO_BTF
+          scripts/config --disable DEBUG_INFO_BTF_MODULES
+          scripts/config --disable MODULE_ALLOW_BTF_MISMATCH
+
+          if [ "${{ matrix.arch }}" = "arm64" ]; then
+            make ARCH=arm64 olddefconfig
+          else
+            make olddefconfig
+          fi
+
+          if grep -q '^CONFIG_XFRM_ESP=' .config; then
+            echo "ERROR: CONFIG_XFRM_ESP is enabled; refusing to continue."
+            exit 1
+          fi
+          if grep -q '^CONFIG_INET_ESP=' .config; then
+            echo "ERROR: CONFIG_INET_ESP is enabled; refusing to continue."
+            exit 1
+          fi
+          if grep -q '^CONFIG_INET6_ESP=' .config; then
+            echo "ERROR: CONFIG_INET6_ESP is enabled; refusing to continue."
+            exit 1
+          fi
+          if grep -q '^CONFIG_AF_RXRPC=' .config; then
+            echo "ERROR: CONFIG_AF_RXRPC is enabled; refusing to continue."
+            exit 1
+          fi
+          if grep -q '^CONFIG_DEBUG_INFO=' .config; then
+            echo "ERROR: CONFIG_DEBUG_INFO is enabled; refusing to build debug kernel packages."
+            exit 1
+          fi
+          if ! grep -q '^CONFIG_TCP_CONG_BBR=y' .config; then
+            echo "ERROR: CONFIG_TCP_CONG_BBR is not built in."
+            exit 1
+          fi
+          if ! grep -q '^CONFIG_DEFAULT_BBR=y' .config; then
+            echo "ERROR: CONFIG_DEFAULT_BBR is not enabled."
+            exit 1
+          fi
+          if ! grep -q '^CONFIG_DEFAULT_TCP_CONG="bbr"' .config; then
+            echo "ERROR: CONFIG_DEFAULT_TCP_CONG is not bbr."
+            exit 1
+          fi
+          grep -E 'CONFIG_(DEBUG_INFO_NONE|TCP_CONG_BBR|DEFAULT_BBR|DEFAULT_TCP_CONG)=' .config
+
+      - name: 构建内核 Debian 包
+        if: env.BUILD_NEEDED == 'true'
+        working-directory: ./kernel/linux
+        run: |
+          if [ "${{ matrix.arch }}" = "arm64" ]; then
+            make ARCH=arm64 bindeb-pkg -j$(nproc) LOCALVERSION=-joeyblog-bbrv3 KDEB_COMPRESS=gzip skipdbg=true
+          else
+            make bindeb-pkg -j$(nproc) LOCALVERSION=-joeyblog-bbrv3 KDEB_COMPRESS=gzip skipdbg=true
+          fi
+
+      - name: 检查 deb 包
+        if: env.BUILD_NEEDED == 'true'
+        run: |
+          if find ./kernel -maxdepth 1 -name '*-dbg*.deb' | grep -q .; then
+            echo "ERROR: debug deb package was generated."
+            find ./kernel -maxdepth 1 -name '*-dbg*.deb' -print
+            exit 1
+          fi
+          find ./kernel -maxdepth 1 -name 'linux-*.deb' -print | sort
+
+      - name: 上传配置文件
+        if: env.BUILD_NEEDED == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: config-${{ matrix.arch }}
+          path: ./kernel/linux/.config
+
+      - name: 上传 deb 包
+        if: env.BUILD_NEEDED == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: deb-${{ matrix.arch }}
+          path: ./kernel/linux-*.deb
+
+      - name: 发布到 GitHub Release
+        if: env.BUILD_NEEDED == 'true'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ matrix.arch }}-${{ env.KERNEL_VERSION }}
+          files: ./kernel/linux-*.deb
+          body: "带有 BBRv3 的最新内核，适用于 ${{ matrix.arch }} 架构。Compiled & Optimized by Joey."