The release moves onto Depot — except the one leg Depot makes slower

Every remaining job in the release workflow moves to Depot runners,
sized to what it does: 16 cores for the two that actually compile
(buildroot SD images, ESP32 firmware), the default size for the ones
that check out, dispatch or upload. push-multiarch stays small on
purpose — its build happens on Depot's remote builders, so the runner
only orchestrates.

The exception is armhf, and it is measured rather than assumed. Depot's
ARM fleet is Graviton, which has no AArch32 at EL0, so a linux/arm/v7
build runs under QEMU: debian-trixie-armhf went 516s on GitHub's 4-core
Ampere runners to 825s on Depot's 16-core ones. Sixteen emulated cores
lose to four native ones. Those two targets go back to ubuntu-24.04-arm
with the numbers recorded next to them; every arm64 and amd64 leg
genuinely won (498->349s, 609->260s) and stays.

Alongside that: the buildroot job builds its platforms in parallel
instead of in sequence (failures still propagate), pip is cached where
it was rebuilding cffi from source, push-multiarch drops the QEMU and
buildx setup it never used now that nothing is built locally,
github-release stops cloning full history it does not read, and the
last two checkout@v2 pins move to v4 before Actions stops running them.
A new .github/actionlint.yaml declares the depot-* labels so actionlint
stops calling every runner unknown.

Projected: ~23 min to ~16 min, with the armhf leg alone worth 5.7 of it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mariusandra

.github/actionlint.yaml

@@ -0,0 +1,13 @@
+# Depot-managed GitHub Actions runners (https://depot.dev/docs/github-actions).
+# actionlint only knows GitHub's own labels, so the ones we use have to be
+# declared here or every `runs-on: depot-*` is reported as an unknown label.
+# Label shape: depot-ubuntu-<image>[-arm][-<cores>]; no suffix means the
+# project's default size.
+self-hosted-runner:
+  labels:
+    - depot-ubuntu-24.04
+    - depot-ubuntu-24.04-16
+    - depot-ubuntu-24.04-32
+    - depot-ubuntu-24.04-arm
+    - depot-ubuntu-24.04-arm-16
+    - depot-ubuntu-24.04-arm-32

.github/workflows/docker-publish-multi.yml

@@ -13,8 +13,14 @@ permissions:
   contents: write
 
 jobs:
+  # Runner sizing: every job runs on Depot. The bookkeeping jobs (version
+  # bump, npm dispatch, release notes, matrix, addon repo, GitHub release) are
+  # I/O bound and take the default Depot size; only the two jobs that actually
+  # compute (Buildroot images, ESP32 firmware) take 16 cores. The one
+  # exception is the armhf leg of build-prebuilt-cross, which stays on
+  # GitHub's ARM runners — see backend/bin/cross for the measurements.
   update-versions:
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     outputs:
       release_sha: ${{ steps.release-ref.outputs.release_sha }}
       docker_version: ${{ steps.release-ref.outputs.docker_version }}
@@ -71,7 +77,7 @@ jobs:
   publish-npm:
     name: Publish FrameOS npm packages
     needs: update-versions
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     steps:
       # npm auth uses trusted publishing (OIDC), which matches on the
       # top-level workflow file — so publishing lives in npm-publish.yml and
@@ -90,7 +96,7 @@ jobs:
   release-notes:
     name: Generate Release Notes
     needs: update-versions
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     steps:
       - name: Checkout release commit
         uses: actions/checkout@v4
@@ -120,7 +126,7 @@ jobs:
 
   determine-release-targets:
     needs: update-versions
-    runs-on: ubuntu-24.04
+    runs-on: depot-ubuntu-24.04
     outputs:
       targets: ${{ steps.set-matrix.outputs.targets }}
     steps:
@@ -229,7 +235,7 @@ jobs:
   build-buildroot-release-image:
     name: Build Buildroot Release Image
     needs: [update-versions, build-prebuilt-cross]
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04-16
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -243,6 +249,15 @@ jobs:
           path: release-assets
           merge-multiple: true
 
+      # Same warm pip cache as the cross matrix: this job's requirements
+      # install spent ~31s of its ~150s wall clock building cffi from sdist.
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: backend/requirements.txt
+
       - name: Install backend dependencies
         run: |
           pip install -r backend/requirements.txt
@@ -280,14 +295,42 @@ jobs:
             echo "No Buildroot platforms with cached base images found." >&2
             exit 1
           fi
+          # One platform per background job. Each build works in its own
+          # tempdir and writes its own frameos-<version>-<platform>-* files,
+          # so the only shared state is the read-mostly Buildroot base image
+          # cache (one distinct file per platform). Sequentially the two
+          # platforms cost 55s + 38s; in parallel the step is as long as the
+          # slowest one. Output is captured per platform and replayed in
+          # order afterwards so the log stays readable.
+          pids=()
+          names=()
           for platform in $platforms; do
+            echo "Building release image for ${platform}"
             python3 tools/buildroot-images/buildroot_images.py \
               --platform "$platform" \
               release-image \
               --prebuilt-cross-dir release-assets \
               --release-assets-dir release-assets \
-              --version "$DOCKER_VERSION"
+              --version "$DOCKER_VERSION" \
+              > "buildroot-release-${platform}.log" 2>&1 &
+            pids+=("$!")
+            names+=("$platform")
+          done
+          status=0
+          for index in "${!pids[@]}"; do
+            if ! wait "${pids[$index]}"; then
+              echo "Buildroot release image failed for ${names[$index]}" >&2
+              status=1
+            fi
+          done
+          for platform in "${names[@]}"; do
+            echo "::group::Buildroot release image ${platform}"
+            cat "buildroot-release-${platform}.log"
+            echo "::endgroup::"
           done
+          if [ "$status" -ne 0 ]; then
+            exit 1
+          fi
           ls -lh release-assets/*.img.gz release-assets/*.metadata.json
 
       - name: Upload Buildroot release images
@@ -313,7 +356,7 @@ jobs:
   build-esp32-generic-firmware:
     name: Build ESP32 firmware (generic, all panels)
     needs: [update-versions]
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04-16
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -382,24 +425,21 @@ jobs:
   # image build and pushes the multi-arch manifest directly.
   push-multiarch:
     needs: [update-versions, build-prebuilt-cross, build-buildroot-release-image]
-    runs-on: ubuntu-latest
+    # The image itself is built on Depot's remote builders, so this runner only
+    # orchestrates: the default size is plenty.
+    runs-on: depot-ubuntu-24.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           ref: ${{ needs.update-versions.outputs.release_sha }}
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-        with:
-          version: latest
-          install: true
-
+      # No QEMU or local buildx setup: depot/build-push-action runs the build
+      # on Depot's remote amd64 and arm64 builders, so nothing is emulated or
+      # built on this runner. Only the registry login is still needed, because
+      # Depot pushes with this runner's Docker credentials.
       - name: Login to Docker Hub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -441,7 +481,7 @@ jobs:
   update-addon-repo:
     name: Update Home Assistant Addon
     needs: [update-versions, push-multiarch, release-notes]
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     steps:
       - name: Checkout frameos
         uses: actions/checkout@v4
@@ -450,7 +490,7 @@ jobs:
           path: frameos
 
       - name: Checkout frameos-home-assistant-addon
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           repository: frameos/frameos-home-assistant-addon
           token: ${{ secrets.ACTIONS_WRITE_TOKEN }}
@@ -520,13 +560,16 @@ jobs:
   github-release:
     name: Create GitHub Release
     needs: [update-versions, push-multiarch, build-prebuilt-cross, build-buildroot-release-image, build-esp32-generic-firmware, update-addon-repo, release-notes]
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     steps:
+      # Shallow: this job only needs a working directory for `gh` and the
+      # downloaded artifacts. Release notes come from an artifact and the tag
+      # is created from RELEASE_SHA, so no history is read here.
       - name: Checkout release commit
         uses: actions/checkout@v4
         with:
           ref: ${{ needs.update-versions.outputs.release_sha }}
-          fetch-depth: 0
+          fetch-depth: 1
 
       - name: Download prebuilt cross artifacts
         uses: actions/download-artifact@v4

backend/bin/cross

@@ -49,16 +49,29 @@ class TargetDefinition:
         }
 
 
+# armhf (linux/arm/v7) is the one target that must NOT go to a Depot ARM
+# runner. Depot's ARM runners are AWS Graviton, which cannot execute AArch32
+# at EL0, so the arm/v7 build container falls back to QEMU: measured 773s and
+# 825s on depot-ubuntu-24.04-arm-16 versus 349-377s for arm64 on the same
+# runner. GitHub's ubuntu-24.04-arm runners are Ampere Altra, which does run
+# AArch32 natively — there armhf costs the same as arm64 (501s vs 507s and
+# 516s vs 507s across two releases), so 4 native cores beat 16 emulated ones.
+# The permanent fix is to give linux/arm/v7 the same treatment as arm/v6 (an
+# amd64 container plus the arm-linux-gnueabihf cross toolchain that
+# cross_toolchain_packages.py already defines and the Modal executor already
+# uses); until that is validated, keep armhf on GitHub's ARM runners.
+ARMHF_RUNNER = "ubuntu-24.04-arm"
+
 TARGETS: tuple[TargetDefinition, ...] = (
-    TargetDefinition("debian", "bookworm", "armhf", "linux/arm/v7", "debian:bookworm", runner="depot-ubuntu-24.04-arm-16"),
+    TargetDefinition("debian", "bookworm", "armhf", "linux/arm/v7", "debian:bookworm", runner=ARMHF_RUNNER),
     TargetDefinition("debian", "bookworm", "arm64", "linux/arm64", "debian:bookworm", runner="depot-ubuntu-24.04-arm-16"),
     TargetDefinition("debian", "bookworm", "amd64", "linux/amd64", "debian:bookworm"),
     # ARMv6 hard-float for the Raspberry Pi Zero W Buildroot image. Debian has
     # no ARMv6 port, so this builds in an amd64 container with the Bootlin
     # armv6-eabihf toolchain (see cross_toolchain_packages.py); armhf packages
     # only provide headers and link stubs.
     TargetDefinition("debian", "bookworm", "armv6", "linux/arm/v6", "debian:bookworm"),
-    TargetDefinition("debian", "trixie", "armhf", "linux/arm/v7", "debian:trixie", runner="depot-ubuntu-24.04-arm-16"),
+    TargetDefinition("debian", "trixie", "armhf", "linux/arm/v7", "debian:trixie", runner=ARMHF_RUNNER),
     TargetDefinition("debian", "trixie", "arm64", "linux/arm64", "debian:trixie", runner="depot-ubuntu-24.04-arm-16"),
     TargetDefinition("debian", "trixie", "amd64", "linux/amd64", "debian:trixie"),
     TargetDefinition("ubuntu", "24.04", "arm64", "linux/arm64", "ubuntu:24.04", runner="depot-ubuntu-24.04-arm-16"),