.github/ — GitHub Automation & Templates

GitHub Actions workflows, issue/PR templates and community health files for the agent-linux (AirymaxOS) management repository.

Copyright (c) 2025-2026 SPHARX Ltd. All Rights Reserved.

---

Positioning

This directory holds all repository-level GitHub automation for the agent-linux (AirymaxOS) management repository. It defines the CI/CD pipelines that validate governance files, build the kernel, run nightly verification, publish releases, guard the [SC] shared-contract layer, and enforce SSoT (Single Source of Truth) consistency.

Each workflow stays deliberately small: the kernel and management-orchestration pipelines use 2 jobs (ci-kernel.yml: kernel-build → kernel-verify; mgmt-orchestrator.yml: file-integrity → orchestrate-leaf-ci), while ci-airy.yml fans out into 4 focused jobs and codegen-verify.yml is a single SSoT drift gate. Language-level CI for C / Rust / Go / Python is delegated to each leaf repository's own .github/workflows/; this repository only performs management-level orchestration.

Directory Contents

.github/
├── README.md                    # This file
├── workflows/                   # 8 GitHub Actions workflows
│   ├── ci-kernel.yml            # Kernel build matrix + static analysis + tests
│   ├── ci-airy.yml              # Airymax build (4 arches) + checkpatch + SPDX + symbol integrity
│   ├── codegen-verify.yml       # Codegen SSoT drift gate (contract sources → generated outputs)
│   ├── mgmt-orchestrator.yml    # Governance file integrity + leaf CI orchestration
│   ├── nightly.yml              # Nightly test suite + auto-revert/budget check
│   ├── release.yml              # Build + SBOM + sign + publish release
│   ├── sc-dual-ci.yml           # [SC] header validation + agentrt mirror CI
│   └── ssot-validate.yml        # SSoT YAML syntax + cross-reference validation
├── ISSUE_TEMPLATE/              # GitHub issue templates
└── PULL_REQUEST_TEMPLATE.md     # Pull request template

CI Workflows (8 workflows)

Workflow	Jobs	Trigger
ci-kernel.yml	kernel-build — Kbuild matrix (4 configs × 4 arches × 2 compilers − 1 exclude = 31) with W=2 zero-warning gate; kernel-verify — checkpatch --strict, sparse C=2, Coccinelle, KUnit on UML, kselftest on QEMU	PR / push on kernel/**
ci-airy.yml	airy-defconfig-verify — airy_defconfig build on 4 arches (x86_64/arm64/riscv/loongarch) + Airymax CONFIG gate + .o artifact check; airy-checkpatch — checkpatch --strict on Airymax dirs; airy-spdx-audit — SPDX identifier audit ([SC] = BSD-3-Clause OR GPL-2.0, else GPL-2.0-only); airy-symbol-integrity — security/airy/ vs kernel/superv/ symbol-clash check	PR / push on Airymax paths
codegen-verify.yml	codegen-diff-check — run tools/codegen/run_codegen.py --check (content compare, works across submodules) as the zero-drift SSoT gate (IRON-9)	PR / push on tools/codegen/**, sdk/**, kernel, security
mgmt-orchestrator.yml	file-integrity — verify submodule dirs derived from .gitmodules (9 entries), [SC] 12 shared headers, 12 governance files, no airymaxos- prefix; orchestrate-leaf-ci — aggregate leaf CI statuses, markdownlint repository-owned markdown, copyright header check	PR on **.md, .gitmodules, ssot-registry.yaml, MAINTAINERS, CODEOWNERS, tools/**, .github/** / push on main
nightly.yml	nightly-test-suite — seL4-style formal verification, 72h soak test, chaos injection (CPU hotplug / mem hotremove / I/O error / net partition); nightly-revert-or-budget — auto-revert on regression via auto-bisect, or CI budget check (60 min gate, OS-STD-TEST-011)	cron 0 2 * * * / workflow_dispatch
release.yml	build-and-sign — SPDX SBOM (syft per submodule + merge), kernel RPM build, GPG + cosign signing, SDK tarball; publish-release — publish dnf repo, push OCI image, create GitHub Release with artifacts	tag v* / v*-rc* / workflow_dispatch
sc-dual-ci.yml	sc-validate — verify [SC] 12 shared headers exist under kernel/include/uapi/linux/airymax/, no physical duplicates (OS-IRON-014); sc-trigger-and-await — export header patches, create mirror PR in agentrt repo, poll mirror CI status (30 min timeout)	PR touching any [SC] header
ssot-validate.yml	ssot-syntax-and-rules — PyYAML syntax check, rule-ID count + uniqueness (OS-IRON-015), validate-ssot.py cross-ref; doc-links — repository-owned relative-path markdown link integrity	PR on **.md, ssot-registry.yaml, tools/validate-ssot.py / push on main

[SC] Shared-Contract Headers

The sc-dual-ci.yml and mgmt-orchestrator.yml workflows guard the [SC] layer — the single physical source of truth for the kernel↔agentrt ABI, located at kernel/include/uapi/linux/airymax/:

12 [SC] headers (per OS-IRON-014) — 10 core plus 2 supplementary: error.h, log_types.h, ipc.h, sched.h, memory_types.h, security_types.h, cognition_types.h, syscalls.h, syscall_gen.h, uapi_compat.h, lsm_types.h, bpf_struct_ops.h

Any change to a [SC] header requires dual CI (agent-linux + agentrt mirror) per OS-IRON-014.

Issue & PR Templates

• ISSUE_TEMPLATE/ — structured issue templates for bugs, features and design proposals.
• PULL_REQUEST_TEMPLATE.md — enforces the DCO sign-off reminder, subsystem prefix, test/SSoT checklist, and [SC] change declaration on every pull request.

Development Guide

• Trigger a workflow manually — workflows exposing workflow_dispatch can be run from the GitHub Actions UI (nightly.yml, release.yml).

• Add a new workflow — keep the 2-job cap; reference the authority document docs/docs-linux/70-build-system/03-ci-cd-pipeline.md in the header comment.

• Local SSoT validation before pushing:

  python3 tools/validate-ssot.py . ssot-registry.yaml

• Branch protection — L1/L3 review is enforced via GitHub branch protection rules (require_code_owner_reviews + 2 required reviewers), not via a CI job.

• Secrets — release signing uses GPG_PRIVATE_KEY, GPG_PASSPHRASE, COSIGN_KEY, COSIGN_PASSWORD; agentrt mirror uses AGENTRT_CI_TOKEN. Never log or echo these values.

License

Dual-licensed under AGPL v3 + Apache 2.0 (SPDX: AGPL-3.0-or-later OR Apache-2.0). See the repository root LICENSE and NOTICE.

Copyright (c) 2025-2026 SPHARX Ltd. All Rights Reserved.