Build, release and deployment

GitHub Actions path

1. release-all-customers.yml reads customers.json and fans out with fail-fast: false.
2. release-driver.yml resolves niseCore, WBF and include refs to exact SHAs and checks whether a new release is needed.
3. build-driver.yml calls a pinned build action on the SYNAP01 self-hosted runner with EWDK, customer project, method, target, package and build type.
4. The action builds, validates, signs and uploads the package.
5. The release job creates a tagged artifact with source SHA evidence.
6. A reconciliation job restores any release-history row lost to concurrency de-duplication.

Current operational direction

• HDRFP-12268 drives customer-specific target handling, reusable build/issue actions and visible failure notification.
• HDRFP-12216 and HDRFP-12258 drive IOTA rule checks and customer coverage.
• HDRFP-12267 drives clang-format as part of quick code-check.
• HDRFP-12166 tracks AutoHLK for 26H2/Rust development.

Observed Actions evidence

The 2026-07-12→2026-08-12 snapshot contains 359 runs: 246 success, 92 failure and 21 cancelled. The latest all-customer run on 2026-08-11 successfully checked all 13 rows, but each customer build/release job was skipped because no relevant source change was detected. That run proves orchestration/change detection, not a fresh all-customer package build.

See CI evidence for workflow/run details and representative successful/failed iterations.

Operational controls

• Build-action and issue-action refs are explicit inputs/defaults and should be recorded with results.
• Tokens, signing keys and tools paths are secret/variable inputs and must not enter logs or Wiki pages.
• Matrix filtering is the safest first validation after changing one customer.
• Full fan-out must preserve independent customer results even if one fails.
• Skipped jobs are reported as skipped; orchestrator success cannot be promoted to package-build success.
• Firmware/IOTA update results require exact host, device and firmware/configuration versions.

Legacy paths

The repository also contains Jenkins/batch pipelines, signing watchers, HLK automation, accuracy/tuning tools and SynARP deployment scripts. They are operationally significant but not all are invoked by the current GitHub Actions path; do not infer current production use from file presence alone.