fixup! wip: ci: Keep workspace between builds

When building Buildroot projects, especially ones with packages that
take a very long time to compile like WebkitGTK in this one, we usually
want to keep the workspace around between builds to avoid rebuilding
everything every time the job runs.  Historically, I've done this by
allocating a persistent volume for the workspace, however, this is
problematic for a few reasons.  First, the configuration is external to
the CI pipeline.  More importantly, jobs that run on cloud workers do
not have access to the iSCSI target.  As such, an alternative solution
is to use a local path, but store the contents in the artifact
repository at the end of the run.  The next run can then download the
archive from the artifact repository and extract it into the workspace
before beginning the build.  This mostly achieves the same effect, but
is completely self-contained within the CI pipeline definition, and does
not rely on persistent storage at all.

ci/Jenkinsfile

@@ -0,0 +1,74 @@
+def workspaceExists() {
+    def packageName = "${env.JOB_NAME.split('/')[-2]}-workspace"
+    def res = httpRequest(
+        url: "${GITEA_URL}/api/v1/packages/jenkins/generic/${packageName}/-/latest",
+        acceptType: 'APPLICATION_JSON',
+        authentication: 'jenkins-gitea',
+        validResponseCodes: '200,404',
+    )
+    if (res.status == 200) {
+        def data = readJSON(text: res.content)
+        env.SAVED_WORKSPACE_URL = "${GITEA_URL}/api/packages/jenkins/generic/${packageName}/${data.version}/workspace.tar.gz"
+        return true
+    } else {
+        return false
+    }
+}
+
+pipeline {
+    parameters {
+        booleanParam 'CLEAN_BUILD'
+        booleanParam name: 'KEEP_WORKSPACE', defaultValue: true
+    }
+
+    options {
+        disableConcurrentBuilds()
+    }
+
+    agent {
+        kubernetes {
+            yamlFile 'ci/podTemplate.yaml'
+            yamlMergeStrategy merge()
+            defaultContainer 'build'
+        }
+    }
+
+    stages {
+        stage('Download Workspace') {
+            when {
+                expression {
+                    return !params.CLEAN_BUILD && workspaceExists()
+                }
+            }
+            steps {
+                sh '. ci/download-workspace.sh'
+            }
+        }
+
+        stage('Prepare') {
+            steps {
+                sh '. ci/prepare.sh'
+            }
+        }
+
+        stage('Build') {
+            steps {
+                sh '. ci/build.sh'
+            }
+        }
+    }
+    post {
+        always {
+            script {
+                if (params.KEEP_WORKSPACE) {
+                    withCredentials([usernameColonPassword(
+                        credentialsId: 'jenkins-gitea',
+                        variable: 'GITEA_AUTH',
+                    )]) {
+                        sh '. ci/upload-workspace.sh'
+                    }
+                }
+            }
+        }
+    }
+}

ci/build.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+make -C _build toolchain
+make -C _build BR2_JLEVEL=$(($(nproc) / 2))

ci/download-workspace.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+rm -rf _build
+mkdir _build
+curl -fL "${SAVED_WORKSPACE_URL}" | tar -C _build -xz

ci/podTemplate.yaml

@@ -0,0 +1,17 @@
+spec:
+  containers:
+  - name: build
+    image: git.pyrocufflink.net/containerimages/buildroot
+    resources:
+      limits: &resources
+        cpu: 8
+        memory: 24Gi
+      requests: *resources
+    volumeMounts:
+    - mountPath: /etc/ssh/ssh_known_hosts
+      name: ssh-known-hosts
+      subPath: ssh_known_hosts
+  volumes:
+  - name: ssh-known-hosts
+    configMap:
+      name: ssh-known-hosts

ci/prepare.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+
+BUILDROOT_REPO=https://gitlab.com/buildroot.org/buildroot.git
+BUILDROOT_BRANCH=2025.05.x
+
+DEFCONFIG=kitchenos_defconfig
+
+if [ ! -d buildroot ]; then
+    git clone "${BUILDROOT_REPO}" --depth=1 -b "${BUILDROOT_BRANCH}"
+else
+    git -C buildroot fetch --depth=1 origin "${BUILDROOT_BRANCH}"
+    git -C buildroot checkout -f "${BUILDROOT_BRANCH}"
+    git -C buildroot merge FETCH_HEAD --ff-only
+fi
+
+sed -i \
+    -e /BR2_LINUX_KERNEL_CUSTOM_TARBALL/a"$(
+        grep BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION= buildroot/configs/raspberrypi3_defconfig
+    )" \
+    -e /BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION/d \
+    configs/"${DEFCONFIG}"
+
+if [ ! -f _build/.config ]; then
+    make -C buildroot O="${PWD}"/_build BR2_EXTERNAL="${PWD}" "${DEFCONFIG}"
+else
+    make -C _build "${DEFCONFIG}"
+fi

ci/upload-workspace.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+package_name=${JOB_NAME#*/}
+package_name=${package_name%%/*}-workspace
+
+(
+    cd _build
+    find . \
+        -mindepth 1 -maxdepth 1 \
+        -not -name images \
+        -print0
+) | xargs -0 tar -czf workspace.tar.gz -C _build
+
+curl -u "${GITEA_AUTH}" \
+    "https://git.pyrocufflink.net/api/packages/jenkins/generic/${package_name}/${BUILD_NUMBER}/workspace.tar.gz" \
+    --upload-file workspace.tar.gz

package/kioskbrowser/kioskbrowser.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-KIOSKBROWSER_VERSION = fbd9ecedc7e357be91de486be85eff546b1d3511
+KIOSKBROWSER_VERSION = d461fa182253347dec62ef64d5955edb39f3f838
 KIOSKBROWSER_SITE = https://git.pyrocufflink.net/dustin/kioskbrowser
 KIOSKBROWSER_SITE_METHOD = git
 KIOSKBROWSER_LICENSE = GPL-3.0+

rootfs/usr/libexec/sway-systemd

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+export XDG_CURRENT_DESKTOP=sway
+export XDG_SESSION_DESKTOP="${XDG_SESSION_DESKTOP:-sway}"
+export XDG_SESSION_TYPE=wayland
+
+systemctl --user import-environment \
+	SWAYSOCK \
+	XDG_CURRENT_DESKTOP \
+	XDG_SESSION_DESKTOP \
+	XDG_SESSION_TYPE \
+	WAYLAND_DISPLAY
+
+systemctl --user reset-failed
+systemctl --user start sway-session.target
+
+shutdown() {
+	systemctl --user stop sway-session.target
+}
+
+trap shutdown INT TERM
+swaymsg -t subscribe '["shutdown"]'
+shutdown