AndlessFW Builds

This public repository contains the build workflow for the private Andless quicore source. It does not mirror or publish that source code. The workflow checks out an approved quicore ref, builds the Andless Pro partition images on Ubuntu 22.04, and packages them in the format consumed by Andless Dashboard.

Build firmware with GitHub Actions

1. Open Actions → Build AndlessFW → Run workflow.
2. Choose a quicore source ref:
   • master
   • a full 40-character commit SHA
   • a version tag such as v0.1.0
3. Set the firmware version written to the manifest.
4. Choose the development or beta channel and start the workflow.

The workflow resolves the source ref, initializes its submodules, runs the AndlessFW packager tests, performs a complete Andless Pro build, and uploads a 14-day Actions artifact containing:

andless-pro-<version>.andlessfw
BUILD-METADATA.json
SHA256SUMS

BUILD-METADATA.json records the immutable quicore commit used by the build. Only maintainers with permission to run workflows in this repository can start an upstream build.

Build locally

Use an x86_64 Ubuntu 22.04 host with the dependencies listed by quicore, then run:

git clone --recursive https://gitee.com/endless-tech/quicore.git source
export ANDLESS_FIRMWARE_VERSION=dev
export ANDLESS_FIRMWARE_CHANNEL=development
./scripts/build-andlessfw.sh source

The script selects BoardConfig-SPI_NAND-Buildroot-RV1106_andless_pro.mk, runs the complete SDK build, and then invokes ./build.sh andlessfw.

Security and release boundary

• Public builds are intentionally unsigned and limited to the development and beta channels.
• Private source access uses GITEE_USERNAME and GITEE_TOKEN from the private-source GitHub environment. The workflow passes them to Git only for source and submodule fetches; it does not persist credentials in Git config.
• The Andless Ed25519 firmware signing key is not stored in this repository or made available to its workflows.
• Official stable firmware must be produced by a separate protected release pipeline. Release Dashboard builds should accept only firmware signed by the pinned Andless release key.
• The firmware package protects the device identity partition during normal Dashboard flashing, but the package format itself is not DRM.

Anyone who can change a workflow on main could attempt to expose private source credentials. Keep workflow write access restricted to trusted maintainers and replace the current Gitee credential with a dedicated, read-only credential when one is available.

The protected private-source environment must contain:

• GITEE_USERNAME
• GITEE_TOKEN

Publication of this build workflow does not grant rights beyond the licenses of the source repositories and dependencies it builds.