From 1fe6bd772799f5f6a6d15e5dffafc7980d71e22d Mon Sep 17 00:00:00 2001
From: Christopher Obbard <chris.obbard@oss.qualcomm.com>
Date: Thu, 27 Aug 2026 21:26:34 +0100
Subject: [PATCH] ci: let callers outside main supply the CI scripts ref

The "Checkout CI scripts" step resolved the CI branch as github.sha. In a
reusable workflow that is the *caller's* commit, not the ref in the caller's
'uses:' line, so it only names a CI commit while the caller itself runs on
main. daily.yml and release.yml both do, which is why this held.

A caller on a packaging branch gets a packaging commit, which carries no ci/
tree at all. sparse-checkout treats absent paths as empty rather than as an
error, so the checkout succeeds and the next step fails on a bare
'cp: cannot stat .ci-branch/ci/scripts/*.sh'.

Add a ci-ref input for those callers. It defaults to empty and falls back to
github.sha, so daily.yml and release.yml keep pinning the scripts to the exact
commit that started the run. Guard the copy as well, so a ref without a CI
tree reports what is actually wrong instead of a missing-file error.

Signed-off-by: Christopher Obbard <chris.obbard@oss.qualcomm.com>
---
 .github/workflows/build-kernel-deb.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-kernel-deb.yml b/.github/workflows/build-kernel-deb.yml
index 422596a..873d60a 100644
--- a/.github/workflows/build-kernel-deb.yml
+++ b/.github/workflows/build-kernel-deb.yml
@@ -145,6 +145,10 @@ on:
         description: 'pkg-linux-qcom packaging ref'
         type: string
         default: 'qcom/debian/latest'
+      ci-ref:
+        description: 'CI branch ref holding ci/scripts and ci/build-matrix.json (empty = the calling workflow''s own commit)'
+        type: string
+        default: ''
     secrets:
       DEBUSINE_USER:
         description: 'Debusine account used to submit CI and release builds'
@@ -224,10 +228,15 @@ jobs:
         # branch into a separate path so resolve-kernel-ref.sh,
         # derive-localversion.sh, derive-debian-revision.sh, and the
         # suite_suffix_mapping are available.
+        #
+        # github.sha is the *caller's* commit, so it only names a CI commit
+        # when the caller itself runs on main, as daily.yml and release.yml do.
+        # A caller on a packaging branch must pass ci-ref, or the sparse
+        # checkout silently yields nothing and the copy below fails.
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-          ref: ${{ github.sha }}
+          ref: ${{ inputs.ci-ref || github.sha }}
           path: .ci-branch
           sparse-checkout: |
             ci/scripts
@@ -235,7 +244,17 @@ jobs:
           fetch-depth: 1
 
       - name: Install CI scripts into workspace
+        env:
+          CI_REF: ${{ inputs.ci-ref || github.sha }}
         run: |
+          set -euo pipefail
+          # Fail with the cause rather than a bare 'cp: cannot stat'.
+          if [[ ! -d .ci-branch/ci/scripts ]]; then
+            echo "ERROR: no ci/scripts in the CI checkout of '$CI_REF'." >&2
+            echo "       That ref carries no CI tree. Pass ci-ref pointing at" >&2
+            echo "       the CI branch (main) when calling from elsewhere." >&2
+            exit 1
+          fi
           mkdir -p ci/scripts
           cp .ci-branch/ci/scripts/*.sh ci/scripts/
           chmod +x ci/scripts/*.sh