From 22349e652b8375ac7fbfd96be5e9213983ac93a5 Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Thu, 30 Apr 2026 07:48:09 +0200
Subject: [PATCH 01/10] ci: Remove eatmydata

It fails sometimes and the build time doesn't increase.
If it fails, the error is:
ERROR: ld.so: object 'libeatmydata.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
---
 .github/workflows/ci.yml | 124 +++++++++++++++++++--------------------
 1 file changed, 60 insertions(+), 64 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 001e9147e4e..927cab49e17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,16 +30,15 @@ jobs:
     - name: Build RIP & test
       run: |
         set -x
-        sudo apt-get --yes -o Acquire::Retries=5 install eatmydata
-        eatmydata ./scripts/travis-install-build-deps.sh
+        ./scripts/travis-install-build-deps.sh
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo eatmydata apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
         cd src
-        eatmydata ./autogen.sh
-        eatmydata ./configure --disable-check-runtime-deps --enable-werror
-        eatmydata make -O -j$((1+$(nproc))) default pycheck V=1
+        ./autogen.sh
+        ./configure --disable-check-runtime-deps --enable-werror
+        make -O -j$((1+$(nproc))) default pycheck V=1
         # Note that the package build covers html docs
-        eatmydata ../scripts/rip-environment runtests -p
+        ../scripts/rip-environment runtests -p
 
   rip-rtai:
     runs-on: ubuntu-24.04
@@ -56,7 +55,6 @@ jobs:
     - name: Build RIP RTAI
       run: |
         set -x
-        sudo apt-get --yes -o Acquire::Retries=5 install eatmydata
         #To install the RTAI deb's from linuxcnc base
         #echo "deb [arch=amd64,arm64 signed-by=/etc/apt/keyrings/linuxcnc.gpg] https://www.linuxcnc.org/ trixie base" | sudo tee /etc/apt/sources.list.d/linuxcnc.list > /dev/null
         #GPGTMP=$(mktemp -d /tmp/.gnupgXXXXXX)
@@ -71,14 +69,14 @@ jobs:
         curl -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb
         sudo dpkg -i linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb linux-image-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb
         #-----
-        eatmydata ./scripts/travis-install-build-deps.sh
+        ./scripts/travis-install-build-deps.sh
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo eatmydata apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
         cd src
-        eatmydata ./autogen.sh
-        #eatmydata ./configure --with-realtime=/usr/realtime-5.4.279-rtai-amd64 --disable-check-runtime-deps --enable-werror
-        eatmydata ./configure --with-realtime=/usr/realtime-5.4.302-rtai-amd64 --disable-check-runtime-deps --enable-werror
-        eatmydata make -O -j$((1+$(nproc))) default pycheck V=1
+        ./autogen.sh
+        #./configure --with-realtime=/usr/realtime-5.4.279-rtai-amd64 --disable-check-runtime-deps --enable-werror
+        ./configure --with-realtime=/usr/realtime-5.4.302-rtai-amd64 --disable-check-runtime-deps --enable-werror
+        make -O -j$((1+$(nproc))) default pycheck V=1
 
   rip-and-test-clang:
     runs-on: ubuntu-24.04
@@ -95,17 +93,16 @@ jobs:
     - name: Clang build RIP & test
       run: |
         set -x
-        sudo apt-get --yes -o Acquire::Retries=5 install eatmydata
-        eatmydata ./scripts/travis-install-build-deps.sh
-        sudo eatmydata apt-get -y -o Acquire::Retries=5 install clang
+        ./scripts/travis-install-build-deps.sh
+        sudo apt-get -y -o Acquire::Retries=5 install clang
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo eatmydata apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
         cd src
-        eatmydata ./autogen.sh
-        CC=clang CXX=clang++ eatmydata ./configure --disable-check-runtime-deps --enable-werror
-        eatmydata make -O -j$((1+$(nproc))) default pycheck V=1
+        ./autogen.sh
+        CC=clang CXX=clang++ ./configure --disable-check-runtime-deps --enable-werror
+        make -O -j$((1+$(nproc))) default pycheck V=1
         # Note that the package build covers html docs
-        eatmydata ../scripts/rip-environment runtests -p
+        ../scripts/rip-environment runtests -p
 
   htmldocs:
     runs-on: ubuntu-24.04
@@ -122,15 +119,14 @@ jobs:
     - name: Build HTML docmentation
       run: |
         ./scripts/travis-install-build-deps.sh
-        sudo apt-get -y -o Acquire::Retries=5 install eatmydata
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo eatmydata apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
         cd src
-        eatmydata ./autogen.sh
-        eatmydata ./configure --disable-check-runtime-deps --enable-build-documentation=html
-        eatmydata make -O -j$((1+$(nproc))) manpages
-        eatmydata make -O -j$((1+$(nproc))) translateddocs
-        eatmydata make -O -j$((1+$(nproc))) docs
+        ./autogen.sh
+        ./configure --disable-check-runtime-deps --enable-build-documentation=html
+        make -O -j$((1+$(nproc))) manpages
+        make -O -j$((1+$(nproc))) translateddocs
+        make -O -j$((1+$(nproc))) docs
         # Note that the package build covers html docs
 
   package-arch:
@@ -156,10 +152,10 @@ jobs:
         set -e
         set -x
         apt-get --quiet -o Acquire::Retries=5 update
-        apt-get --yes --quiet -o Acquire::Retries=5 install eatmydata curl
-        eatmydata apt --yes --quiet -o Acquire::Retries=5 upgrade
+        apt-get --yes --quiet -o Acquire::Retries=5 install curl
+        apt --yes --quiet -o Acquire::Retries=5 upgrade
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-suggests git lsb-release python3 devscripts
+        apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-suggests git lsb-release python3 devscripts
 
     - uses: actions/checkout@v3
       with:
@@ -180,11 +176,11 @@ jobs:
         esac
         set -e
         set -x
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-recommends gpg software-properties-common
-        eatmydata gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
+        apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-recommends gpg software-properties-common
+        gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
         DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
-        eatmydata add-apt-repository "deb http://linuxcnc.org $DIST base"
-        eatmydata apt-get --quiet -o Acquire::Retries=5 update
+        add-apt-repository "deb http://linuxcnc.org $DIST base"
+        apt-get --quiet -o Acquire::Retries=5 update
 
     - name: Build architecture-specific Debian packages
       env:
@@ -194,26 +190,26 @@ jobs:
       run: |
         set -e
         set -x
-        eatmydata git config --global --add safe.directory "${PWD}"
-        eatmydata debian/configure
-        eatmydata debian/update-dch-from-git
-        eatmydata scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
-        eatmydata git diff
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 build-dep --arch-only .
-        eatmydata debuild -us -uc --build=any
+        git config --global --add safe.directory "${PWD}"
+        debian/configure
+        debian/update-dch-from-git
+        scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
+        git diff
+        apt-get --yes --quiet -o Acquire::Retries=5 build-dep --arch-only .
+        debuild -us -uc --build=any
     - name: Test debian packages
       env:
         DEBIAN_FRONTEND: noninteractive
       run: |
         set -e
         set -x
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 install ../*.deb
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 install sudo # some tests run sudo...
-        eatmydata adduser --disabled-password --gecos "" testrunner
-        eatmydata passwd -d testrunner
-        eatmydata adduser testrunner sudo
+        apt-get --yes --quiet -o Acquire::Retries=5 install ../*.deb
+        apt-get --yes --quiet -o Acquire::Retries=5 install sudo # some tests run sudo...
+        adduser --disabled-password --gecos "" testrunner
+        passwd -d testrunner
+        adduser testrunner sudo
         chmod 0777 $(find tests/ -type d) # make test dirs world-writable for the testrunner
-        su -c "eatmydata ./scripts/runtests -p ./tests" testrunner
+        su -c "./scripts/runtests -p ./tests" testrunner
     - name: Gather build artifacts
       run: |
         set -e
@@ -263,10 +259,10 @@ jobs:
         set -e
         set -x
         apt-get --quiet -o Acquire::Retries=5 update
-        apt-get --yes --quiet -o Acquire::Retries=5 install eatmydata curl
-        eatmydata apt --yes --quiet -o Acquire::Retries=5 upgrade
+        apt-get --yes --quiet -o Acquire::Retries=5 install curl
+        apt --yes --quiet -o Acquire::Retries=5 upgrade
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-suggests git lsb-release python3 devscripts
+        apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-suggests git lsb-release python3 devscripts
 
     - uses: actions/checkout@v3
       with:
@@ -287,11 +283,11 @@ jobs:
         esac
         set -e
         set -x
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 install gpg software-properties-common
-        eatmydata gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
+        apt-get --yes --quiet -o Acquire::Retries=5 install gpg software-properties-common
+        gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
         DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
-        eatmydata add-apt-repository "deb http://linuxcnc.org $DIST base"
-        eatmydata apt-get --quiet -o Acquire::Retries=5 update
+        add-apt-repository "deb http://linuxcnc.org $DIST base"
+        apt-get --quiet -o Acquire::Retries=5 update
 
     - name: Build architecture-independent Debian packages
       env:
@@ -301,20 +297,20 @@ jobs:
       run: |
         set -e
         set -x
-        eatmydata git config --global --add safe.directory "${PWD}"
-        eatmydata debian/configure
-        eatmydata debian/update-dch-from-git
-        eatmydata scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
-        eatmydata git diff
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 build-dep --indep-only .
-        eatmydata debuild -us -uc --build=source,all
+        git config --global --add safe.directory "${PWD}"
+        debian/configure
+        debian/update-dch-from-git
+        scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
+        git diff
+        apt-get --yes --quiet -o Acquire::Retries=5 build-dep --indep-only .
+        debuild -us -uc --build=source,all
     - name: Test install debian packages
       env:
         DEBIAN_FRONTEND: noninteractive
       run: |
         set -e
         set -x
-        eatmydata apt-get --yes --quiet -o Acquire::Retries=5 install ../*.deb
+        apt-get --yes --quiet -o Acquire::Retries=5 install ../*.deb
     - name: Gather build artifacts
       run: |
         set -e

From 9b38c198fd749fc160da89fd35813eb8308cb5a9 Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 17:01:58 +0200
Subject: [PATCH 02/10] ci: No quiet / no retry

Retry should not have an effect: Either you are rate limited and it
fails anyway or it succeeds.
No --quiet so you see what is going on.
---
 .github/workflows/ci.yml | 50 ++++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 927cab49e17..54dede1dccc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
         set -x
         ./scripts/travis-install-build-deps.sh
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         ./configure --disable-check-runtime-deps --enable-werror
@@ -60,8 +60,8 @@ jobs:
         #GPGTMP=$(mktemp -d /tmp/.gnupgXXXXXX)
         #gpg --homedir $GPGTMP --keyserver hkp://keyserver.ubuntu.com --recv-key e43b5a8e78cc2927
         #gpg --homedir $GPGTMP --export 'LinuxCNC Archive Signing Key' | sudo tee /etc/apt/keyrings/linuxcnc.gpg > /dev/null
-        #sudo apt-get --quiet -o Acquire::Retries=5 update
-        #sudo apt-get --yes -o Acquire::Retries=5 install linux-headers-5.4.279-rtai-amd64 linux-image-5.4.279-rtai-amd64 rtai-modules-5.4.279
+        #sudo apt-get update
+        #sudo apt-get --yes install linux-headers-5.4.279-rtai-amd64 linux-image-5.4.279-rtai-amd64 rtai-modules-5.4.279
         #-----
         #To install the RTAI deb's from NTULINUX git
         curl -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb
@@ -71,7 +71,7 @@ jobs:
         #-----
         ./scripts/travis-install-build-deps.sh
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         #./configure --with-realtime=/usr/realtime-5.4.279-rtai-amd64 --disable-check-runtime-deps --enable-werror
@@ -94,9 +94,9 @@ jobs:
       run: |
         set -x
         ./scripts/travis-install-build-deps.sh
-        sudo apt-get -y -o Acquire::Retries=5 install clang
+        sudo apt-get -y install clang
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         CC=clang CXX=clang++ ./configure --disable-check-runtime-deps --enable-werror
@@ -120,7 +120,7 @@ jobs:
       run: |
         ./scripts/travis-install-build-deps.sh
         sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes --quiet -o Acquire::Retries=5 upgrade
+        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         ./configure --disable-check-runtime-deps --enable-build-documentation=html
@@ -151,11 +151,11 @@ jobs:
       run: |
         set -e
         set -x
-        apt-get --quiet -o Acquire::Retries=5 update
-        apt-get --yes --quiet -o Acquire::Retries=5 install curl
-        apt --yes --quiet -o Acquire::Retries=5 upgrade
+        apt-get update
+        apt-get --yes install curl
+        apt --yes upgrade
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
-        apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-suggests git lsb-release python3 devscripts
+        apt-get --yes install --no-install-suggests git lsb-release python3 devscripts
 
     - uses: actions/checkout@v3
       with:
@@ -176,11 +176,11 @@ jobs:
         esac
         set -e
         set -x
-        apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-recommends gpg software-properties-common
+        apt-get --yes install --no-install-recommends gpg software-properties-common
         gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
         DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
         add-apt-repository "deb http://linuxcnc.org $DIST base"
-        apt-get --quiet -o Acquire::Retries=5 update
+        apt-get update
 
     - name: Build architecture-specific Debian packages
       env:
@@ -195,7 +195,7 @@ jobs:
         debian/update-dch-from-git
         scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
         git diff
-        apt-get --yes --quiet -o Acquire::Retries=5 build-dep --arch-only .
+        apt-get --yes build-dep --arch-only .
         debuild -us -uc --build=any
     - name: Test debian packages
       env:
@@ -203,8 +203,8 @@ jobs:
       run: |
         set -e
         set -x
-        apt-get --yes --quiet -o Acquire::Retries=5 install ../*.deb
-        apt-get --yes --quiet -o Acquire::Retries=5 install sudo # some tests run sudo...
+        apt-get --yes install ../*.deb
+        apt-get --yes install sudo # some tests run sudo...
         adduser --disabled-password --gecos "" testrunner
         passwd -d testrunner
         adduser testrunner sudo
@@ -258,11 +258,11 @@ jobs:
       run: |
         set -e
         set -x
-        apt-get --quiet -o Acquire::Retries=5 update
-        apt-get --yes --quiet -o Acquire::Retries=5 install curl
-        apt --yes --quiet -o Acquire::Retries=5 upgrade
+        apt-get update
+        apt-get --yes install curl
+        apt --yes upgrade
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
-        apt-get --yes --quiet -o Acquire::Retries=5 install --no-install-suggests git lsb-release python3 devscripts
+        apt-get --yes install --no-install-suggests git lsb-release python3 devscripts
 
     - uses: actions/checkout@v3
       with:
@@ -283,11 +283,11 @@ jobs:
         esac
         set -e
         set -x
-        apt-get --yes --quiet -o Acquire::Retries=5 install gpg software-properties-common
+        apt-get --yes install gpg software-properties-common
         gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
         DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
         add-apt-repository "deb http://linuxcnc.org $DIST base"
-        apt-get --quiet -o Acquire::Retries=5 update
+        apt-get update
 
     - name: Build architecture-independent Debian packages
       env:
@@ -302,7 +302,7 @@ jobs:
         debian/update-dch-from-git
         scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
         git diff
-        apt-get --yes --quiet -o Acquire::Retries=5 build-dep --indep-only .
+        apt-get --yes build-dep --indep-only .
         debuild -us -uc --build=source,all
     - name: Test install debian packages
       env:
@@ -310,7 +310,7 @@ jobs:
       run: |
         set -e
         set -x
-        apt-get --yes --quiet -o Acquire::Retries=5 install ../*.deb
+        apt-get --yes install ../*.deb
     - name: Gather build artifacts
       run: |
         set -e
@@ -349,7 +349,7 @@ jobs:
       run: |
         set -x
         git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc refs/tags/*:refs/tags/*
-        sudo apt-get --yes -o Acquire::Retries=5 install cppcheck shellcheck
+        sudo apt-get --yes install cppcheck shellcheck
         scripts/cppcheck.sh
     - name: Shellcheck
       continue-on-error: true

From f9f0ad7bce42d5c2a4881993af9a703dcf3890c5 Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 17:06:21 +0200
Subject: [PATCH 03/10] ci: No upgrade except for debian container

Ubuntu image from gitlab should be reasonable up to date.
No need to remove firefox any more.
In debian containers, there is only a minimal package set, so we can
upgrade. Especially for sid, the container is not always up to date.
---
 .github/workflows/ci.yml | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54dede1dccc..689f67b1fd0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,8 +31,6 @@ jobs:
       run: |
         set -x
         ./scripts/travis-install-build-deps.sh
-        sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         ./configure --disable-check-runtime-deps --enable-werror
@@ -70,8 +68,6 @@ jobs:
         sudo dpkg -i linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb linux-image-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb
         #-----
         ./scripts/travis-install-build-deps.sh
-        sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         #./configure --with-realtime=/usr/realtime-5.4.279-rtai-amd64 --disable-check-runtime-deps --enable-werror
@@ -95,8 +91,6 @@ jobs:
         set -x
         ./scripts/travis-install-build-deps.sh
         sudo apt-get -y install clang
-        sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         CC=clang CXX=clang++ ./configure --disable-check-runtime-deps --enable-werror
@@ -119,8 +113,6 @@ jobs:
     - name: Build HTML docmentation
       run: |
         ./scripts/travis-install-build-deps.sh
-        sudo apt-get remove -y firefox firefox-locale-* 2>/dev/null || true
-        sudo apt --yes upgrade
         cd src
         ./autogen.sh
         ./configure --disable-check-runtime-deps --enable-build-documentation=html
@@ -152,8 +144,8 @@ jobs:
         set -e
         set -x
         apt-get update
-        apt-get --yes install curl
         apt --yes upgrade
+        apt-get --yes install curl
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
         apt-get --yes install --no-install-suggests git lsb-release python3 devscripts
 
@@ -259,8 +251,8 @@ jobs:
         set -e
         set -x
         apt-get update
-        apt-get --yes install curl
         apt --yes upgrade
+        apt-get --yes install curl
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
         apt-get --yes install --no-install-suggests git lsb-release python3 devscripts
 

From 84bcc3222a978f6253a20fdbf32d94d06b5dd5eb Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 17:15:31 +0200
Subject: [PATCH 04/10] ci: Move cppcheck up / Remove unneeded newlines

cppcheck is now in test section.
---
 .github/workflows/ci.yml | 45 +++++++++++++++++-----------------------
 1 file changed, 19 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 689f67b1fd0..84180ec50e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,6 +98,25 @@ jobs:
         # Note that the package build covers html docs
         ../scripts/rip-environment runtests -p
 
+  cppcheck:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        submodules: true
+        fetch-depth: 0
+    - name: Perform Source Code checks that were successful in the past
+      continue-on-error: true
+      run: |
+        set -x
+        git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc refs/tags/*:refs/tags/*
+        sudo apt-get --yes install cppcheck shellcheck
+        scripts/cppcheck.sh
+    - name: Shellcheck
+      continue-on-error: true
+      run: |
+        scripts/shellcheck.sh
+
   htmldocs:
     runs-on: ubuntu-24.04
     steps:
@@ -173,7 +192,6 @@ jobs:
         DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
         add-apt-repository "deb http://linuxcnc.org $DIST base"
         apt-get update
-
     - name: Build architecture-specific Debian packages
       env:
         DEBEMAIL: emc-developers@lists.sourceforge.net
@@ -219,7 +237,6 @@ jobs:
       run: |
         echo "dist=$(echo ${{ matrix.image }} | cut -d : -f 2)" >> $GITHUB_OUTPUT
         echo "arch=$(dpkg --print-architecture)" >> $GITHUB_OUTPUT
-
     - name: Upload build artifacts
       uses: actions/upload-artifact@v4
       with:
@@ -243,7 +260,6 @@ jobs:
       env:
         GITHUB_CONTEXT: ${{ toJson(github) }}
       run: echo "$GITHUB_CONTEXT"
-
     - name: Install pre-dependencies
       env:
         DEBIAN_FRONTEND: noninteractive
@@ -280,7 +296,6 @@ jobs:
         DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
         add-apt-repository "deb http://linuxcnc.org $DIST base"
         apt-get update
-
     - name: Build architecture-independent Debian packages
       env:
         DEBEMAIL: emc-developers@lists.sourceforge.net
@@ -320,7 +335,6 @@ jobs:
       run: |
         echo "dist=$(echo ${{ matrix.image }} | cut -d : -f 2)" >> $GITHUB_OUTPUT
         echo "arch=all" >> $GITHUB_OUTPUT
-
     - name: Upload build artifacts
       uses: actions/upload-artifact@v4
       with:
@@ -328,27 +342,6 @@ jobs:
         path: artifacts/${{ steps.meta.outputs.dist }}/${{ steps.meta.outputs.arch }}
         if-no-files-found: error
 
-
-  cppcheck:
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        submodules: true
-        fetch-depth: 0
-    - name: Perform Source Code checks that were successful in the past
-      continue-on-error: true
-      run: |
-        set -x
-        git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc refs/tags/*:refs/tags/*
-        sudo apt-get --yes install cppcheck shellcheck
-        scripts/cppcheck.sh
-    - name: Shellcheck
-      continue-on-error: true
-      run: |
-        scripts/shellcheck.sh
-
-
   release:
     name: Release packages
     needs:

From 6cfc76a237c392d2e681fc479ef066dd58dc053f Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 17:34:40 +0200
Subject: [PATCH 05/10] ci: DEBIAN_FRONTEND globally / No set -e / No linuxcnc
 repo

DEBIAN_FRONTEND: noninteractive can be defined once on top.
set -e is not needed in CI, it stops anyway on any error.
Linuxcnc repo is added for everything except sid / bookworm / trixie
which is all what we build, so it can be removed.
---
 .github/workflows/ci.yml | 62 +++-------------------------------------
 1 file changed, 4 insertions(+), 58 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 84180ec50e7..5bb650cd518 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,9 @@ on:
 permissions:
   contents: read #  to fetch code (actions/checkout)
 
+env:
+  DEBIAN_FRONTEND: noninteractive
+
 jobs:
 
   rip-and-test:
@@ -157,10 +160,7 @@ jobs:
         GITHUB_CONTEXT: ${{ toJson(github) }}
       run: echo "$GITHUB_CONTEXT"
     - name: Install pre-dependencies
-      env:
-        DEBIAN_FRONTEND: noninteractive
       run: |
-        set -e
         set -x
         apt-get update
         apt --yes upgrade
@@ -173,32 +173,11 @@ jobs:
         # "fetch-depth: 0" fetches all of history, this is needed by
         # our build system to determine the version from tags
         fetch-depth: 0
-
-    - name: Add linuxcnc.org deb archive
-      env:
-        DEBIAN_FRONTEND: noninteractive
-      run: |
-        case "${{matrix.image}}" in
-            debian:sid|debian:bookworm|debian:trixie)
-                exit 0
-                ;;
-            *)
-                ;;
-        esac
-        set -e
-        set -x
-        apt-get --yes install --no-install-recommends gpg software-properties-common
-        gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
-        DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
-        add-apt-repository "deb http://linuxcnc.org $DIST base"
-        apt-get update
     - name: Build architecture-specific Debian packages
       env:
         DEBEMAIL: emc-developers@lists.sourceforge.net
         DEBFULLNAME: LinuxCNC Github CI Robot
-        DEBIAN_FRONTEND: noninteractive
       run: |
-        set -e
         set -x
         git config --global --add safe.directory "${PWD}"
         debian/configure
@@ -208,10 +187,7 @@ jobs:
         apt-get --yes build-dep --arch-only .
         debuild -us -uc --build=any
     - name: Test debian packages
-      env:
-        DEBIAN_FRONTEND: noninteractive
       run: |
-        set -e
         set -x
         apt-get --yes install ../*.deb
         apt-get --yes install sudo # some tests run sudo...
@@ -222,7 +198,6 @@ jobs:
         su -c "./scripts/runtests -p ./tests" testrunner
     - name: Gather build artifacts
       run: |
-        set -e
         set -x
         ARCH=$(dpkg --print-architecture)
         DIST=$(echo ${{ matrix.image }} | cut -d : -f 2)
@@ -244,7 +219,6 @@ jobs:
         path: artifacts/${{ steps.meta.outputs.dist }}/${{ steps.meta.outputs.arch }}
         if-no-files-found: error
 
-
   package-indep:
     runs-on: ubuntu-24.04
     strategy:
@@ -261,10 +235,7 @@ jobs:
         GITHUB_CONTEXT: ${{ toJson(github) }}
       run: echo "$GITHUB_CONTEXT"
     - name: Install pre-dependencies
-      env:
-        DEBIAN_FRONTEND: noninteractive
       run: |
-        set -e
         set -x
         apt-get update
         apt --yes upgrade
@@ -277,32 +248,11 @@ jobs:
         # "fetch-depth: 0" fetches all of history, this is needed by
         # our build system to determine the version from tags
         fetch-depth: 0
-
-    - name: Add linuxcnc.org deb archive
-      env:
-        DEBIAN_FRONTEND: noninteractive
-      run: |
-        case "${{matrix.image}}" in
-            debian:sid|debian:bookworm|debian:trixie)
-                exit 0
-                ;;
-            *)
-                ;;
-        esac
-        set -e
-        set -x
-        apt-get --yes install gpg software-properties-common
-        gpg --homedir="${PWD}/gnupg" --output /etc/apt/trusted.gpg.d/linuxcnc-deb-archive.gpg --export 3CB9FD148F374FEF
-        DIST=$(echo ${{matrix.image}} | cut -d : -f 2)
-        add-apt-repository "deb http://linuxcnc.org $DIST base"
-        apt-get update
     - name: Build architecture-independent Debian packages
       env:
         DEBEMAIL: emc-developers@lists.sourceforge.net
         DEBFULLNAME: LinuxCNC Github CI Robot
-        DEBIAN_FRONTEND: noninteractive
       run: |
-        set -e
         set -x
         git config --global --add safe.directory "${PWD}"
         debian/configure
@@ -312,15 +262,11 @@ jobs:
         apt-get --yes build-dep --indep-only .
         debuild -us -uc --build=source,all
     - name: Test install debian packages
-      env:
-        DEBIAN_FRONTEND: noninteractive
       run: |
-        set -e
         set -x
         apt-get --yes install ../*.deb
     - name: Gather build artifacts
       run: |
-        set -e
         set -x
         DIST=$(echo ${{ matrix.image }} | cut -d : -f 2)
         ARCH=all
@@ -358,7 +304,7 @@ jobs:
         path: release_artifacts
     - name: Prepare upload assets
       run: |
-        set -e
+        set -x
         mkdir -p upload
         echo "Downloaded artifacts layout:" && find release_artifacts -maxdepth 3 -print | sed 's/^/  /'
         for d in release_artifacts/*; do

From e2b119a8ab27414f8bb457bdc4cfce421c797967 Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 17:48:45 +0200
Subject: [PATCH 06/10] ci: Update all actions / Split steps / No fetch

All actions updated to latest release.
Checkout: Submodules not needed / fetch-depth 1 is fine for all targets
not needing history.
More steps help debugging and tuning ci.
Fetch not needed, checkout fetches already.
---
 .github/workflows/ci.yml | 142 +++++++++++++++++++++++++--------------
 1 file changed, 93 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5bb650cd518..e448a29d5ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,22 +24,30 @@ jobs:
     - name: Dump GitHub context
       env:
         GITHUB_CONTEXT: ${{ toJson(github) }}
-      run: echo "$GITHUB_CONTEXT"
-    - uses: actions/checkout@v2
+      run: |
+        echo Number of CPUs: $(nproc)
+        echo "$GITHUB_CONTEXT"
+    - name: Checkout repository
+      uses: actions/checkout@v6
       with:
-        submodules: true
-        fetch-depth: 0
-    - run: git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc +refs/tags/*:refs/tags/*
-    - name: Build RIP & test
+        submodules: false
+        fetch-depth: 1
+    - name: Install dependencies
       run: |
         set -x
         ./scripts/travis-install-build-deps.sh
+    - name: Build RIP GCC
+      run: |
+        set -x
         cd src
         ./autogen.sh
         ./configure --disable-check-runtime-deps --enable-werror
         make -O -j$((1+$(nproc))) default pycheck V=1
         # Note that the package build covers html docs
-        ../scripts/rip-environment runtests -p
+    - name: Test
+      run: |
+        set -x
+        ./scripts/rip-environment runtests -p
 
   rip-rtai:
     runs-on: ubuntu-24.04
@@ -47,13 +55,15 @@ jobs:
     - name: Dump GitHub context
       env:
         GITHUB_CONTEXT: ${{ toJson(github) }}
-      run: echo "$GITHUB_CONTEXT"
-    - uses: actions/checkout@v2
+      run: |
+        echo Number of CPUs: $(nproc)
+        echo "$GITHUB_CONTEXT"
+    - name: Checkout repository
+      uses: actions/checkout@v6
       with:
-        submodules: true
-        fetch-depth: 0
-    - run: git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc +refs/tags/*:refs/tags/*
-    - name: Build RIP RTAI
+        submodules: false
+        fetch-depth: 1
+    - name: Install dependencies
       run: |
         set -x
         #To install the RTAI deb's from linuxcnc base
@@ -71,6 +81,9 @@ jobs:
         sudo dpkg -i linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb linux-image-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb
         #-----
         ./scripts/travis-install-build-deps.sh
+    - name: Build RIP RTAI
+      run: |
+        set -x
         cd src
         ./autogen.sh
         #./configure --with-realtime=/usr/realtime-5.4.279-rtai-amd64 --disable-check-runtime-deps --enable-werror
@@ -83,37 +96,49 @@ jobs:
     - name: Dump GitHub context
       env:
         GITHUB_CONTEXT: ${{ toJson(github) }}
-      run: echo "$GITHUB_CONTEXT"
-    - uses: actions/checkout@v2
+      run: |
+        echo Number of CPUs: $(nproc)
+        echo "$GITHUB_CONTEXT"
+    - name: Checkout repository
+      uses: actions/checkout@v6
       with:
-        submodules: true
-        fetch-depth: 0
-    - run: git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc +refs/tags/*:refs/tags/*
-    - name: Clang build RIP & test
+        submodules: false
+        fetch-depth: 1
+    - name: Install dependencies
       run: |
         set -x
         ./scripts/travis-install-build-deps.sh
         sudo apt-get -y install clang
+    - name: Build RIP Clang
+      run: |
+        set -x
         cd src
         ./autogen.sh
         CC=clang CXX=clang++ ./configure --disable-check-runtime-deps --enable-werror
         make -O -j$((1+$(nproc))) default pycheck V=1
         # Note that the package build covers html docs
-        ../scripts/rip-environment runtests -p
+    - name: Test
+      run: |
+        set -x
+        ./scripts/rip-environment runtests -p
 
   cppcheck:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v2
+    - name: Checkout repository
+      uses: actions/checkout@v6
       with:
-        submodules: true
-        fetch-depth: 0
-    - name: Perform Source Code checks that were successful in the past
-      continue-on-error: true
+        submodules: false
+        fetch-depth: 1
+    - name: Install dependencies
       run: |
         set -x
-        git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc refs/tags/*:refs/tags/*
+        sudo apt-get -q update
         sudo apt-get --yes install cppcheck shellcheck
+    - name: Cppcheck
+      continue-on-error: true
+      run: |
+        set -x
         scripts/cppcheck.sh
     - name: Shellcheck
       continue-on-error: true
@@ -126,15 +151,20 @@ jobs:
     - name: Dump GitHub context
       env:
         GITHUB_CONTEXT: ${{ toJson(github) }}
-      run: echo "$GITHUB_CONTEXT"
-    - uses: actions/checkout@v2
+      run: |
+        echo Number of CPUs: $(nproc)
+        echo "$GITHUB_CONTEXT"
+    - name: Checkout repository
+      uses: actions/checkout@v6
       with:
-        submodules: true
-        fetch-depth: 0
-    - run: git fetch --recurse-submodules=no https://github.com/linuxcnc/linuxcnc +refs/tags/*:refs/tags/*
-    - name: Build HTML docmentation
+        submodules: false
+        fetch-depth: 1
+    - name: Install dependencies
       run: |
+        set -x
         ./scripts/travis-install-build-deps.sh
+    - name: Build HTML docmentation
+      run: |
         cd src
         ./autogen.sh
         ./configure --disable-check-runtime-deps --enable-build-documentation=html
@@ -158,7 +188,9 @@ jobs:
     - name: Dump GitHub context
       env:
         GITHUB_CONTEXT: ${{ toJson(github) }}
-      run: echo "$GITHUB_CONTEXT"
+      run: |
+        echo Number of CPUs: $(nproc)
+        echo "$GITHUB_CONTEXT"
     - name: Install pre-dependencies
       run: |
         set -x
@@ -166,31 +198,37 @@ jobs:
         apt --yes upgrade
         apt-get --yes install curl
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
-        apt-get --yes install --no-install-suggests git lsb-release python3 devscripts
-
-    - uses: actions/checkout@v3
+        apt-get --yes install --no-install-suggests git lsb-release python3 devscripts sudo
+    - name: Checkout repository
+      uses: actions/checkout@v6
       with:
+        submodules: false
         # "fetch-depth: 0" fetches all of history, this is needed by
         # our build system to determine the version from tags
         fetch-depth: 0
+    - name: Git config
+      run: |
+        set -x
+        git config --global --add safe.directory ${PWD}
     - name: Build architecture-specific Debian packages
       env:
         DEBEMAIL: emc-developers@lists.sourceforge.net
         DEBFULLNAME: LinuxCNC Github CI Robot
       run: |
         set -x
-        git config --global --add safe.directory "${PWD}"
         debian/configure
         debian/update-dch-from-git
         scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
         git diff
         apt-get --yes build-dep --arch-only .
         debuild -us -uc --build=any
-    - name: Test debian packages
+    - name: Install debian packages
       run: |
         set -x
         apt-get --yes install ../*.deb
-        apt-get --yes install sudo # some tests run sudo...
+    - name: Test debian packages
+      run: |
+        set -x
         adduser --disabled-password --gecos "" testrunner
         passwd -d testrunner
         adduser testrunner sudo
@@ -213,7 +251,7 @@ jobs:
         echo "dist=$(echo ${{ matrix.image }} | cut -d : -f 2)" >> $GITHUB_OUTPUT
         echo "arch=$(dpkg --print-architecture)" >> $GITHUB_OUTPUT
     - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: linuxcnc-${{ steps.meta.outputs.dist }}-${{ steps.meta.outputs.arch }}
         path: artifacts/${{ steps.meta.outputs.dist }}/${{ steps.meta.outputs.arch }}
@@ -233,7 +271,9 @@ jobs:
     - name: Dump GitHub context
       env:
         GITHUB_CONTEXT: ${{ toJson(github) }}
-      run: echo "$GITHUB_CONTEXT"
+      run: |
+        echo Number of CPUs: $(nproc)
+        echo "$GITHUB_CONTEXT"
     - name: Install pre-dependencies
       run: |
         set -x
@@ -242,34 +282,38 @@ jobs:
         apt-get --yes install curl
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
         apt-get --yes install --no-install-suggests git lsb-release python3 devscripts
-
-    - uses: actions/checkout@v3
+    - name: Checkout repository
+      uses: actions/checkout@v6
       with:
+        submodules: false
         # "fetch-depth: 0" fetches all of history, this is needed by
         # our build system to determine the version from tags
         fetch-depth: 0
+    - name: Git config
+      run: |
+        set -x
+        git config --global --add safe.directory ${PWD}
     - name: Build architecture-independent Debian packages
       env:
         DEBEMAIL: emc-developers@lists.sourceforge.net
         DEBFULLNAME: LinuxCNC Github CI Robot
       run: |
         set -x
-        git config --global --add safe.directory "${PWD}"
         debian/configure
         debian/update-dch-from-git
         scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
         git diff
         apt-get --yes build-dep --indep-only .
         debuild -us -uc --build=source,all
-    - name: Test install debian packages
+    - name: Install debian packages
       run: |
         set -x
         apt-get --yes install ../*.deb
     - name: Gather build artifacts
       run: |
         set -x
-        DIST=$(echo ${{ matrix.image }} | cut -d : -f 2)
         ARCH=all
+        DIST=$(echo ${{ matrix.image }} | cut -d : -f 2)
         OUTDIR="artifacts/${DIST}/${ARCH}"
         mkdir -p "$OUTDIR"
         cp -v $(find .. -maxdepth 1 -type f | LC_ALL=C sort) "$OUTDIR" || true
@@ -282,7 +326,7 @@ jobs:
         echo "dist=$(echo ${{ matrix.image }} | cut -d : -f 2)" >> $GITHUB_OUTPUT
         echo "arch=all" >> $GITHUB_OUTPUT
     - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: linuxcnc-${{ steps.meta.outputs.dist }}-${{ steps.meta.outputs.arch }}
         path: artifacts/${{ steps.meta.outputs.dist }}/${{ steps.meta.outputs.arch }}
@@ -299,7 +343,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         path: release_artifacts
     - name: Prepare upload assets
@@ -326,7 +370,7 @@ jobs:
           echo "Upload dir contents:" && ls -l "upload/${dist}-${arch}" | sed 's/^/  /'
         done
     - name: Create GitHub Release and upload assets
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@v3
       with:
         files: |
           upload/*

From 6c3b1d01c0904670f5e09962848ebf65c18f44a6 Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 18:09:04 +0200
Subject: [PATCH 07/10] ci: Remove --cpu 2

This argument limited the amount of CPU's to 2. Without, we have all 4
CPU's reducing build time.
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e448a29d5ab..d4cf4cafeae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -183,7 +183,7 @@ jobs:
       image: ${{ matrix.image }}
       # IPC_OWNER is needed for shmget IPC_CREAT
       # SYS_ADMIN is needed for shmctl IPC_SET
-      options: --cpus=2 --cap-add=IPC_OWNER --cap-add=SYS_ADMIN
+      options: --cap-add=IPC_OWNER --cap-add=SYS_ADMIN
     steps:
     - name: Dump GitHub context
       env:
@@ -266,7 +266,7 @@ jobs:
       image: ${{ matrix.image }}
       # IPC_OWNER is needed for shmget IPC_CREAT
       # SYS_ADMIN is needed for shmctl IPC_SET
-      options: --cpus=2 --cap-add=IPC_OWNER --cap-add=SYS_ADMIN
+      options: --cap-add=IPC_OWNER --cap-add=SYS_ADMIN
     steps:
     - name: Dump GitHub context
       env:

From 359f9d0abb980190da2a122308877d7152ee9953 Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 18:25:02 +0200
Subject: [PATCH 08/10] ci: Do not install recommends

Less packages -> faster build. Recommends should not be needed.
---
 .github/workflows/ci.yml | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d4cf4cafeae..652e89b5ea2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -194,11 +194,10 @@ jobs:
     - name: Install pre-dependencies
       run: |
         set -x
-        apt-get update
+        apt-get -q update
         apt --yes upgrade
-        apt-get --yes install curl
-        # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
-        apt-get --yes install --no-install-suggests git lsb-release python3 devscripts sudo
+        # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package and run tests.
+        apt-get --yes --no-install-recommends install curl git lsb-release python3 devscripts sudo adduser xauth
     - name: Checkout repository
       uses: actions/checkout@v6
       with:
@@ -225,7 +224,7 @@ jobs:
     - name: Install debian packages
       run: |
         set -x
-        apt-get --yes install ../*.deb
+        apt-get --yes --no-install-recommends install ../*.deb
     - name: Test debian packages
       run: |
         set -x
@@ -277,11 +276,10 @@ jobs:
     - name: Install pre-dependencies
       run: |
         set -x
-        apt-get update
+        apt-get -q update
         apt --yes upgrade
-        apt-get --yes install curl
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
-        apt-get --yes install --no-install-suggests git lsb-release python3 devscripts
+        apt-get --yes --no-install-recommends install curl git lsb-release python3 devscripts
     - name: Checkout repository
       uses: actions/checkout@v6
       with:
@@ -308,7 +306,7 @@ jobs:
     - name: Install debian packages
       run: |
         set -x
-        apt-get --yes install ../*.deb
+        apt-get --yes --no-install-recommends install ../*.deb
     - name: Gather build artifacts
       run: |
         set -x

From ac39f5fd78fb440da85af8525b1db304dea1df9f Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 18:43:53 +0200
Subject: [PATCH 09/10] ci: Verify clean / Script to add linuxcnc repo

---
 .github/scripts/add-linuxcnc-repository.sh | 19 ++++++++++
 .github/scripts/install-rtai.sh            | 26 +++++++++++++
 .github/scripts/verify-clean-repo.sh       | 37 ++++++++++++++++++
 .github/workflows/ci.yml                   | 44 +++++++++++++++-------
 4 files changed, 112 insertions(+), 14 deletions(-)
 create mode 100755 .github/scripts/add-linuxcnc-repository.sh
 create mode 100755 .github/scripts/install-rtai.sh
 create mode 100755 .github/scripts/verify-clean-repo.sh

diff --git a/.github/scripts/add-linuxcnc-repository.sh b/.github/scripts/add-linuxcnc-repository.sh
new file mode 100755
index 00000000000..2130927e1c1
--- /dev/null
+++ b/.github/scripts/add-linuxcnc-repository.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+set -x
+
+DIST=$1
+
+echo "deb [arch=amd64,arm64 signed-by=/etc/apt/keyrings/linuxcnc.gpg] https://www.linuxcnc.org/ $DIST base" | sudo tee /etc/apt/sources.list.d/linuxcnc.list > /dev/null
+case $DIST in
+	'buster' | 'bullseye' | 'bookworm')
+                gpg --homedir "${PWD}/gnupg" --export 3CB9FD148F374FEF | sudo tee /etc/apt/keyrings/linuxcnc.gpg > /dev/null
+                ;;
+        *)
+                GPGTMP=$(mktemp -d /tmp/.gnupgXXXXXX)
+                gpg --homedir "$GPGTMP" --keyserver hkp://keyserver.ubuntu.com --recv-key e43b5a8e78cc2927
+                gpg --homedir "$GPGTMP" --export 'LinuxCNC Archive Signing Key' | sudo tee /etc/apt/keyrings/linuxcnc.gpg > /dev/null
+                ;;
+esac
+sudo apt-get --quiet update
diff --git a/.github/scripts/install-rtai.sh b/.github/scripts/install-rtai.sh
new file mode 100755
index 00000000000..7a9f37329a6
--- /dev/null
+++ b/.github/scripts/install-rtai.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+set -x
+
+DIST=$1
+
+if false; then
+    #To install the RTAI deb's from linuxcnc base
+    .github/scripts/add-linuxcnc-repository.sh "$DIST"
+    sudo apt-get --yes install linux-headers-5.4.279-rtai-amd64 linux-image-5.4.279-rtai-amd64 rtai-modules-5.4.279
+else
+    #To install the RTAI deb's from NTULINUX git
+    TMPDIR=$(mktemp -d)
+    (
+        cd "$TMPDIR"
+        curl --no-progress-meter -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb
+        curl --no-progress-meter -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/linux-image-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb
+        curl --no-progress-meter -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb
+    )
+    sudo dpkg -i \
+    "$TMPDIR/linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb" \
+    "$TMPDIR/linux-image-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb" \
+    "$TMPDIR/rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb"
+    rm -rf "$TMPDIR"
+fi
\ No newline at end of file
diff --git a/.github/scripts/verify-clean-repo.sh b/.github/scripts/verify-clean-repo.sh
new file mode 100755
index 00000000000..54b23aa9c06
--- /dev/null
+++ b/.github/scripts/verify-clean-repo.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+
+#To let the script fail if git status has any issues
+#If a command in $() fails, the script just continues
+git status -u --porcelain -- "$@" > /dev/null
+
+if [ $# -gt 0 ]; then
+    #Arguments are pathspecs for git status, used to exclude files for this test
+    if [ -n "$(git status -u --porcelain -- "$@")" ]; then
+        echo "Build produced untracked or modified files:----------------------------------------"
+        git status -u --porcelain -- "$@"
+        echo "-----------------------------------------------------------------------------------"
+        echo "Pathspec is: \"$*\", withouth pathspec:--------------------------------------------"
+        git status -u --porcelain
+        echo "-----------------------------------------------------------------------------------"
+        exit 1
+    else
+        echo Repo is clean
+        echo "Pathspec is: \"$*\", withouth pathspec:--------------------------------------------"
+        git status -u --porcelain
+        echo "-----------------------------------------------------------------------------------"
+        exit 0
+    fi
+else
+    #No arguments: Test all files
+    if [ -n "$(git status -u --porcelain)" ]; then
+        echo "Build produced untracked or modified files:----------------------------------------"
+        git status -u --porcelain
+        echo "-----------------------------------------------------------------------------------"
+        exit 1
+    else
+        echo Repo is clean
+        exit 0
+    fi
+fi
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 652e89b5ea2..b63b08e7543 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,10 +44,16 @@ jobs:
         ./configure --disable-check-runtime-deps --enable-werror
         make -O -j$((1+$(nproc))) default pycheck V=1
         # Note that the package build covers html docs
+    - name: Verify no untracked or modified files after build
+      run: |
+        .github/scripts/verify-clean-repo.sh
     - name: Test
       run: |
         set -x
         ./scripts/rip-environment runtests -p
+    - name: Verify no untracked or modified files after test
+      run: |
+        .github/scripts/verify-clean-repo.sh
 
   rip-rtai:
     runs-on: ubuntu-24.04
@@ -66,20 +72,7 @@ jobs:
     - name: Install dependencies
       run: |
         set -x
-        #To install the RTAI deb's from linuxcnc base
-        #echo "deb [arch=amd64,arm64 signed-by=/etc/apt/keyrings/linuxcnc.gpg] https://www.linuxcnc.org/ trixie base" | sudo tee /etc/apt/sources.list.d/linuxcnc.list > /dev/null
-        #GPGTMP=$(mktemp -d /tmp/.gnupgXXXXXX)
-        #gpg --homedir $GPGTMP --keyserver hkp://keyserver.ubuntu.com --recv-key e43b5a8e78cc2927
-        #gpg --homedir $GPGTMP --export 'LinuxCNC Archive Signing Key' | sudo tee /etc/apt/keyrings/linuxcnc.gpg > /dev/null
-        #sudo apt-get update
-        #sudo apt-get --yes install linux-headers-5.4.279-rtai-amd64 linux-image-5.4.279-rtai-amd64 rtai-modules-5.4.279
-        #-----
-        #To install the RTAI deb's from NTULINUX git
-        curl -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb
-        curl -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/linux-image-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb
-        curl -fLO https://github.com/NTULINUX/RTAI/releases/download/v5.3.4/rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb
-        sudo dpkg -i linux-headers-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb linux-image-5.4.302-rtai-amd64_5.4.302-rtai-amd64-1_amd64.deb rtai-modules-5.4.302_5.3.4-linuxcnc_amd64.deb
-        #-----
+        .github/scripts/install-rtai.sh trixie
         ./scripts/travis-install-build-deps.sh
     - name: Build RIP RTAI
       run: |
@@ -89,6 +82,9 @@ jobs:
         #./configure --with-realtime=/usr/realtime-5.4.279-rtai-amd64 --disable-check-runtime-deps --enable-werror
         ./configure --with-realtime=/usr/realtime-5.4.302-rtai-amd64 --disable-check-runtime-deps --enable-werror
         make -O -j$((1+$(nproc))) default pycheck V=1
+    - name: Verify no untracked or modified files after build
+      run: |
+        .github/scripts/verify-clean-repo.sh
 
   rip-and-test-clang:
     runs-on: ubuntu-24.04
@@ -117,10 +113,16 @@ jobs:
         CC=clang CXX=clang++ ./configure --disable-check-runtime-deps --enable-werror
         make -O -j$((1+$(nproc))) default pycheck V=1
         # Note that the package build covers html docs
+    - name: Verify no untracked or modified files after build
+      run: |
+        .github/scripts/verify-clean-repo.sh
     - name: Test
       run: |
         set -x
         ./scripts/rip-environment runtests -p
+    - name: Verify no untracked or modified files after test
+      run: |
+        .github/scripts/verify-clean-repo.sh
 
   cppcheck:
     runs-on: ubuntu-24.04
@@ -172,6 +174,10 @@ jobs:
         make -O -j$((1+$(nproc))) translateddocs
         make -O -j$((1+$(nproc))) docs
         # Note that the package build covers html docs
+    - name: Verify no untracked or modified files after build
+      run: |
+        #*.po and documentation.pot are modifyed by build. Ignore them for now.
+        .github/scripts/verify-clean-repo.sh ':(exclude)docs/po/*.po' ':(exclude)docs/po/documentation.pot'
 
   package-arch:
     runs-on: ${{ matrix.runner }}
@@ -221,6 +227,9 @@ jobs:
         git diff
         apt-get --yes build-dep --arch-only .
         debuild -us -uc --build=any
+    - name: Verify no untracked or modified files after build
+      run: |
+        .github/scripts/verify-clean-repo.sh ':(exclude)VERSION' ':(exclude)debian/changelog'
     - name: Install debian packages
       run: |
         set -x
@@ -233,6 +242,9 @@ jobs:
         adduser testrunner sudo
         chmod 0777 $(find tests/ -type d) # make test dirs world-writable for the testrunner
         su -c "./scripts/runtests -p ./tests" testrunner
+    - name: Verify no untracked or modified files after test
+      run: |
+        .github/scripts/verify-clean-repo.sh ':(exclude)VERSION' ':(exclude)debian/changelog'
     - name: Gather build artifacts
       run: |
         set -x
@@ -303,6 +315,10 @@ jobs:
         git diff
         apt-get --yes build-dep --indep-only .
         debuild -us -uc --build=source,all
+    - name: Verify no untracked or modified files after build
+      run: |
+        #*.po and documentation.pot are modifyed by build. Ignore them for now.
+        .github/scripts/verify-clean-repo.sh ':(exclude)VERSION' ':(exclude)debian/changelog' ':(exclude)docs/po/*.po' ':(exclude)docs/po/documentation.pot'
     - name: Install debian packages
       run: |
         set -x

From a2f8fa2be99503dd8a50313ae0f06f761f323112 Mon Sep 17 00:00:00 2001
From: Hannes Diethelm <hannes.diethelm@gmail.com>
Date: Sun, 10 May 2026 19:32:10 +0200
Subject: [PATCH 10/10] ci: Move build steps to scripts / new ci build dep

Scripts are easier to test locally than if the shell code is in the
ci.yml. They are also reusable.
travis-install-build-deps.sh replaced by one script, only used in CI.
---
 .github/scripts/build-doc.sh           | 12 ++++++
 .github/scripts/build-package-arch.sh  | 11 ++++++
 .github/scripts/build-package-indep.sh | 11 ++++++
 .github/scripts/build-rip.sh           | 11 ++++++
 .github/scripts/install-deps.sh        |  9 +++++
 .github/workflows/ci.yml               | 55 +++++++-------------------
 6 files changed, 68 insertions(+), 41 deletions(-)
 create mode 100755 .github/scripts/build-doc.sh
 create mode 100755 .github/scripts/build-package-arch.sh
 create mode 100755 .github/scripts/build-package-indep.sh
 create mode 100755 .github/scripts/build-rip.sh
 create mode 100755 .github/scripts/install-deps.sh

diff --git a/.github/scripts/build-doc.sh b/.github/scripts/build-doc.sh
new file mode 100755
index 00000000000..12dea6b7650
--- /dev/null
+++ b/.github/scripts/build-doc.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+set -x
+
+cd src
+./autogen.sh
+./configure --disable-check-runtime-deps --enable-build-documentation=html
+make -O -j$((1+$(nproc))) manpages
+make -O -j$((1+$(nproc))) translateddocs
+make -O -j$((1+$(nproc))) docs
+# Note that the package build covers html docs
diff --git a/.github/scripts/build-package-arch.sh b/.github/scripts/build-package-arch.sh
new file mode 100755
index 00000000000..1b6ba870fc4
--- /dev/null
+++ b/.github/scripts/build-package-arch.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+set -x
+
+debian/configure
+debian/update-dch-from-git
+scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
+git diff
+apt-get --yes build-dep --arch-only .
+debuild -us -uc --build=any
diff --git a/.github/scripts/build-package-indep.sh b/.github/scripts/build-package-indep.sh
new file mode 100755
index 00000000000..53093597c49
--- /dev/null
+++ b/.github/scripts/build-package-indep.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+set -x
+
+debian/configure
+debian/update-dch-from-git
+scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
+git diff
+apt-get --yes build-dep --indep-only .
+debuild -us -uc --build=source,all
diff --git a/.github/scripts/build-rip.sh b/.github/scripts/build-rip.sh
new file mode 100755
index 00000000000..17b5cae8485
--- /dev/null
+++ b/.github/scripts/build-rip.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+set -x
+
+#Any arguments are passed to configure
+
+cd src
+./autogen.sh
+./configure "$@" --disable-check-runtime-deps --enable-werror
+make -O -j$((1+$(nproc))) default pycheck V=1
diff --git a/.github/scripts/install-deps.sh b/.github/scripts/install-deps.sh
new file mode 100755
index 00000000000..dee1d5084b3
--- /dev/null
+++ b/.github/scripts/install-deps.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -eu #Needed so CI fails when anything is wrong
+set -x
+
+sudo apt-get --quiet update
+sudo apt-get install --yes --no-install-recommends devscripts equivs build-essential lintian clang
+debian/configure
+sudo apt-get --yes build-dep .
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b63b08e7543..4fa3e19d305 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,22 +35,18 @@ jobs:
     - name: Install dependencies
       run: |
         set -x
-        ./scripts/travis-install-build-deps.sh
+        .github/scripts/install-deps.sh
     - name: Build RIP GCC
       run: |
         set -x
-        cd src
-        ./autogen.sh
-        ./configure --disable-check-runtime-deps --enable-werror
-        make -O -j$((1+$(nproc))) default pycheck V=1
-        # Note that the package build covers html docs
+        .github/scripts/build-rip.sh --with-realtime=uspace
     - name: Verify no untracked or modified files after build
       run: |
         .github/scripts/verify-clean-repo.sh
     - name: Test
       run: |
         set -x
-        ./scripts/rip-environment runtests -p
+        scripts/rip-environment runtests -p
     - name: Verify no untracked or modified files after test
       run: |
         .github/scripts/verify-clean-repo.sh
@@ -73,15 +69,12 @@ jobs:
       run: |
         set -x
         .github/scripts/install-rtai.sh trixie
-        ./scripts/travis-install-build-deps.sh
+        .github/scripts/install-deps.sh
     - name: Build RIP RTAI
       run: |
         set -x
-        cd src
-        ./autogen.sh
-        #./configure --with-realtime=/usr/realtime-5.4.279-rtai-amd64 --disable-check-runtime-deps --enable-werror
-        ./configure --with-realtime=/usr/realtime-5.4.302-rtai-amd64 --disable-check-runtime-deps --enable-werror
-        make -O -j$((1+$(nproc))) default pycheck V=1
+        #It is save to assume there is only one /usr/realtime-* folder
+        .github/scripts/build-rip.sh --with-realtime=/usr/realtime-*
     - name: Verify no untracked or modified files after build
       run: |
         .github/scripts/verify-clean-repo.sh
@@ -103,23 +96,18 @@ jobs:
     - name: Install dependencies
       run: |
         set -x
-        ./scripts/travis-install-build-deps.sh
-        sudo apt-get -y install clang
+        .github/scripts/install-deps.sh
     - name: Build RIP Clang
       run: |
         set -x
-        cd src
-        ./autogen.sh
-        CC=clang CXX=clang++ ./configure --disable-check-runtime-deps --enable-werror
-        make -O -j$((1+$(nproc))) default pycheck V=1
-        # Note that the package build covers html docs
+        CC=clang CXX=clang++ .github/scripts/build-rip.sh --with-realtime=uspace
     - name: Verify no untracked or modified files after build
       run: |
         .github/scripts/verify-clean-repo.sh
     - name: Test
       run: |
         set -x
-        ./scripts/rip-environment runtests -p
+        scripts/rip-environment runtests -p
     - name: Verify no untracked or modified files after test
       run: |
         .github/scripts/verify-clean-repo.sh
@@ -164,16 +152,11 @@ jobs:
     - name: Install dependencies
       run: |
         set -x
-        ./scripts/travis-install-build-deps.sh
+        .github/scripts/install-deps.sh
     - name: Build HTML docmentation
       run: |
-        cd src
-        ./autogen.sh
-        ./configure --disable-check-runtime-deps --enable-build-documentation=html
-        make -O -j$((1+$(nproc))) manpages
-        make -O -j$((1+$(nproc))) translateddocs
-        make -O -j$((1+$(nproc))) docs
-        # Note that the package build covers html docs
+        set -x
+        .github/scripts/build-doc.sh
     - name: Verify no untracked or modified files after build
       run: |
         #*.po and documentation.pot are modifyed by build. Ignore them for now.
@@ -221,12 +204,7 @@ jobs:
         DEBFULLNAME: LinuxCNC Github CI Robot
       run: |
         set -x
-        debian/configure
-        debian/update-dch-from-git
-        scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
-        git diff
-        apt-get --yes build-dep --arch-only .
-        debuild -us -uc --build=any
+        .github/scripts/build-package-arch.sh
     - name: Verify no untracked or modified files after build
       run: |
         .github/scripts/verify-clean-repo.sh ':(exclude)VERSION' ':(exclude)debian/changelog'
@@ -309,12 +287,7 @@ jobs:
         DEBFULLNAME: LinuxCNC Github CI Robot
       run: |
         set -x
-        debian/configure
-        debian/update-dch-from-git
-        scripts/get-version-from-git | sed -re 's/^v(.*)$/\1/' >| VERSION; cat VERSION
-        git diff
-        apt-get --yes build-dep --indep-only .
-        debuild -us -uc --build=source,all
+        .github/scripts/build-package-indep.sh
     - name: Verify no untracked or modified files after build
       run: |
         #*.po and documentation.pot are modifyed by build. Ignore them for now.