Bjordis Collaku (bjordiscollaku) · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 9, 2026
diff --git a/.github/workflows/bootstrap-history.yml b/.github/workflows/bootstrap-history.yml
@@ -64,7 +64,7 @@ jobs:
       # 2. Check out this repo just for the scripts/ helpers.
       # -----------------------------------------------------------------------
       - name: Checkout CI scripts
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       # -----------------------------------------------------------------------
       # 3. Resolve the seed configuration (URL, tag prefix, seed branch).
@@ -106,7 +106,7 @@ jobs:
       #    skips re-downloading the multi-GB history).
       # -----------------------------------------------------------------------
       - name: Restore cached clone
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.cfg.outputs.cache_path }}
           key: history-seed-${{ steps.cfg.outputs.suite }}-${{ github.run_id }}
@@ -147,7 +147,7 @@ jobs:
       # -----------------------------------------------------------------------
       - name: Cache clone for retry
         if: steps.seed.outputs.status == 'failed'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.cfg.outputs.cache_path }}
           key: history-seed-${{ steps.cfg.outputs.suite }}-${{ github.run_id }}

diff --git a/.github/workflows/build-kernel.yml b/.github/workflows/build-kernel.yml
@@ -203,7 +203,7 @@ jobs:
       #    fetch-source-pkg.yml; they are not the main branch.
       # -----------------------------------------------------------------------
       - name: Checkout kernel source
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ inputs.ref != '' && inputs.ref || (inputs.kernel_version != '' && format('{0}-{1}', env.UPSTREAM_PREFIX, inputs.kernel_version) || inputs.suite || 'resolute-qcom-devel') }}
           path: kernel-src
@@ -296,7 +296,7 @@ jobs:
       #     caller's resolute-qcom-devel merge commit, not main.
       # -----------------------------------------------------------------------
       - name: Checkout CI scripts
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: main
           # Own path, matching kernel-src and docker-pkg-build: checking out
@@ -323,7 +323,7 @@ jobs:
       # 5. Checkout docker-pkg-build
       # -----------------------------------------------------------------------
       - name: Checkout docker-pkg-build
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: qualcomm-linux/docker-pkg-build
           ref: main
@@ -501,7 +501,7 @@ jobs:
       # -----------------------------------------------------------------------
       - name: Upload kernel .deb packages to S3
         if: inputs.skip_s3 != true
-        uses: qualcomm-linux/upload-private-artifact-action@aws-v4
+        uses: qualcomm-linux/upload-private-artifact-action@4940e9327cd7386acdb908b61c714c079b7d754b # aws-v4
         with:
           s3_bucket: qli-prd-lecore-gh-artifacts
           path: ${{ github.workspace }}/output

diff --git a/.github/workflows/fetch-source-pkg.yml b/.github/workflows/fetch-source-pkg.yml
@@ -111,7 +111,7 @@ jobs:
           sudo apt-get clean
 
       - name: Checkout CI scripts
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       # BRANCH, UPSTREAM_URL and UPSTREAM_PREFIX come from the workflow-level env
       # above; sync-mirror.sh reads them directly.

diff --git a/.github/workflows/premerge-distro-validation.yml b/.github/workflows/premerge-distro-validation.yml
@@ -47,7 +47,7 @@ jobs:
       request-id: ${{ steps.context.outputs.request-id }}
     steps:
       - name: Checkout orchestration helpers
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
@@ -76,7 +76,7 @@ jobs:
       statuses: write
     steps:
       - name: Checkout orchestration helpers
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
@@ -142,7 +142,7 @@ jobs:
       statuses: write
     steps:
       - name: Checkout status helper
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
@@ -182,7 +182,7 @@ jobs:
       distro-run-url: ${{ steps.callback.outputs.distro-run-url }}
     steps:
       - name: Checkout callback validator
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
@@ -212,7 +212,7 @@ jobs:
       statuses: write
     steps:
       - name: Checkout status helper
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 

diff --git a/.github/workflows/stale-issues.yaml b/.github/workflows/stale-issues.yaml
@@ -11,7 +11,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
       with:
         stale-issue-message: 'Remove the stale label or add a comment to reset the inactivity timer.'
         stale-pr-message: 'Remove the stale label or add a comment to reset the inactivity timer'

diff --git a/README.md b/README.md
@@ -4,9 +4,6 @@ Mirrors the Canonical kernel optimized for Qualcomm on `resolute-qcom`, from
 [Launchpad](https://git.launchpad.net/~carmel-team/ubuntu/+source/linux/+git/resolute/log/?h=master-next),
 with Qualcomm contributions.
 
-This is not a product or actively supported by Qualcomm. We are not accepting
-contributions in this repository.
-
 > [!TIP]
 > Latest upload: see the **[tags page](https://github.com/qualcomm-linux/ubuntu-qcom-kernel/tags)**.
 
@@ -27,6 +24,7 @@ contributions in this repository.
 | Doc | For |
 |-----|-----|
 | **[docs/INTEGRATION.md](docs/INTEGRATION.md)** | Qualcomm developers - working on `resolute-qcom-devel` |
+| **[docs/LOCAL-BUILD.md](docs/LOCAL-BUILD.md)** | Developers - building the kernel locally |
 | **[docs/PIPELINE.md](docs/PIPELINE.md)** | Maintainers - sync, build, and mirror operations |
 | **[CONTRIBUTING.md](CONTRIBUTING.md)** | This project is not accepting contributions |
 | **[SECURITY.md](SECURITY.md)** | This project is not actively maintained. It is a mirror. |

diff --git a/docs/INTEGRATION.md b/docs/INTEGRATION.md
@@ -35,5 +35,8 @@ Commits must carry a DCO `Signed-off-by` line (`git commit -s`) as required for
 
 ## Building
 
-To build `resolute-qcom-devel` (or any mirrored upload) into `.deb` packages, see
-[PIPELINE.md](PIPELINE.md#manual-build-triggers).
+To build `resolute-qcom-devel` (or any mirrored upload) locally, see
+[LOCAL-BUILD.md](LOCAL-BUILD.md).
+
+To run the build in CI instead, see
+[PIPELINE.md](PIPELINE.md#running-it).
diff --git a/docs/LOCAL-BUILD.md b/docs/LOCAL-BUILD.md
@@ -0,0 +1,91 @@
+# Building the kernel locally
+
+Builds `resolute-qcom-devel`, or any mirrored upload, into `.deb` packages
+with the same container and steps as
+[build-kernel.yml](../.github/workflows/build-kernel.yml).
+
+For triggering a build in CI, see [PIPELINE.md](PIPELINE.md#running-it). For
+working on contributions, see [INTEGRATION.md](INTEGRATION.md).
+
+## Prerequisites
+
+Native `arm64` with Docker. The builder image is `arm64`, and this path builds
+the kernel natively; there is no cross build.
+
+The source clone is ~2 GB and the builder image ~2 GB, before the build tree.
+
+## Build
+
+Work in an empty directory. Every command below runs from it.
+
+```bash
+mkdir kbuild && cd kbuild
+```
+
+Clone the branch to build:
+
+```bash
+git clone --depth 1 -b resolute-qcom-devel \
+  https://github.com/qualcomm-linux/ubuntu-qcom-kernel.git kernel-src
+```
+
+Build the builder image. It is tagged by base suite, so both `resolute-qcom`
+and `resolute-qcom-devel` use `resolute`:
+
+```bash
+git clone https://github.com/qualcomm-linux/docker-pkg-build.git
+./docker-pkg-build/docker_deb_build.py --rebuild -d resolute
+```
+
+Build the packages:
+
+```bash
+docker run -i --rm \
+  -v "$PWD:$PWD" --workdir="$PWD" -e JOBS="$(nproc)" \
+  ghcr.io/qualcomm-linux/pkg-builder:resolute \
+  bash -c '
+    set -euo pipefail
+    install -D -m644 /tmp/keyrings/qsc-deb-releases.asc \
+      /etc/apt/keyrings/qsc-deb-releases.asc
+    cp /tmp/qsc-deb-releases.sources /etc/apt/sources.list.d/
+    apt-get update -qq
+    cd kernel-src
+    fakeroot make -f debian/rules clean
+    apt-get build-dep -y ./
+    export DEB_BUILD_OPTIONS="parallel=${JOBS} nocheck"
+    fakeroot debian/rules binary-indep binary-qcom do_skip_checks=true
+  '
+```
+
+Collect the output. It lands beside `kernel-src`, not inside it:
+
+```bash
+ls -lh *.deb
+```
+
+These packages carry the plain `debian.qcom/changelog` version. CI appends
+`+qcom<N>.<sha>` when the branch has commits past a Canonical tag; a local
+build does not, so its version matches the Canonical upload it is based on.
+
+## Targets
+
+Flavours are `qcom` and `qcom-rt`. There is no `generic`.
+
+| Goal | Target |
+|---|---|
+| One flavour | `binary-indep binary-qcom` |
+| Both | `binary-indep binary-qcom binary-qcom-rt` |
+| Everything | `binary` |
+
+Add `do_dbgsym_package=true` for the unstripped `-dbgsym.ddeb` packages.
+
+## If it fails
+
+| Symptom | Cause |
+|---|---|
+| `unauthorized` pulling the image | Expected, it is private. Build it locally instead. |
+| `repo is NOT UP TO DATE` | `docker-pkg-build` checkout is behind its remote. |
+| `Unable to locate package *-dkms` | The Qualcomm sources file was not installed, or qartifactory is unreachable. |
+| `Unmet build dependencies` | `debian/rules clean` did not run first, so `debian/control` was absent. |
+| `No rule to make target 'binary-generic'` | Wrong flavour. Use `qcom` or `qcom-rt`. |
+| No `.deb` found | They are beside `kernel-src`, not inside it. |
diff --git a/scripts/build-kernel-deb.sh b/scripts/build-kernel-deb.sh