Building an Android GKI kernel in CI
Kernel builds used to take over my laptop for an evening. Moving them to a hosted CI runner made them reproducible, and made me much more careful about what I flash.
Pin everything
The manifest, toolchain and every patch are pinned to exact commits. A build number in CI maps to one set of inputs, so when something misbehaves I can say exactly what changed.
Cache the toolchain, not the output
Clang and the prebuilt tools are large and change rarely, so they are cached. Build output is never cached: a clean build is the only one I trust.
Verify before flashing
- Compare the kernel config against the stock one and review every difference.
- Record the hash of the image that CI produced.
- After flashing, read the hash back from the device and compare.
- Keep the stock boot image next to the new one, labelled, before touching anything.
The fastest way to recover from a bad flash is to have planned for it before you started.