kernel-build: apply patches outside the checkout + fail-loud sentinel (#1)

The kernel-build job set WORK inside the repo checkout, so build-kernel.sh's
`git apply` ran from a subdirectory of the warden-sdk git repo — where git apply
silently ignores out-of-subdir paths and exits 0 without applying anything. The
build then failed at the (never-created) rv1106-warden.dtb target, and the
unconditional `echo "applied"` had masked it.

- ci.yml: WORK -> ${{ runner.temp }}/kbuild-out (outside the checkout); artifact
  paths follow.
- build-kernel.sh: the patch loop now fails loudly instead of echoing on silent
  failure, and a post-apply sentinel assert (rv1106-warden.dts must exist) makes a
  silent no-op impossible to ship — the regression guard for this class.

Refs #1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

.github/workflows/ci.yml

@@ -125,7 +125,10 @@ jobs:
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
       - name: build zImage + rv1106-warden.dtb
         env:
-          WORK: ${{ github.workspace }}/kbuild-out
+          # WORK must be OUTSIDE the repo checkout: build-kernel.sh applies the patch
+          # series with `git apply`, which silently ignores out-of-subdir paths when
+          # run inside another git repo (issue #1). $RUNNER_TEMP is outside the checkout.
+          WORK: ${{ runner.temp }}/kbuild-out
           JOBS: 4   # belt-and-braces bound in addition to the runner's cgroup cap
           # The kernel is freestanding; use the stable generic arm cross toolchain
           # (Debian gcc-arm-linux-gnueabihf on the runner) rather than depending on
@@ -136,8 +139,8 @@ jobs:
         with:
           name: kernel-rv1106
           path: |
-            ${{ github.workspace }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
+            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
-            ${{ github.workspace }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
+            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
           retention-days: 14
 
   badges:

build/build-kernel.sh

@@ -66,14 +66,34 @@ rm -rf "$SRC"
 log "extracting pristine"
 tar -C "$WORK" -xf "$TB"
 
-# 3. apply the patch series in order
+# 3. apply the patch series in order (fail loudly — never echo a lie)
 log "applying patch series"
 for p in "$PATCHES"/*.patch; do
-  git -C "$SRC" apply --whitespace=nowarn "$p" 2>/dev/null \
+  if git -C "$SRC" apply --whitespace=nowarn "$p" 2>/dev/null; then
-    || patch -d "$SRC" -p1 --no-backup-if-mismatch < "$p"
+    :
+  elif patch -d "$SRC" -p1 --forward --no-backup-if-mismatch < "$p" >/dev/null 2>&1; then
+    :
+  else
+    echo "FATAL: failed to apply $(basename "$p")" >&2
+    exit 1
+  fi
   echo "  applied $(basename "$p")"
 done
 
+# Guard against a SILENT no-op: `git apply` run from inside another git repo's
+# subdirectory ignores out-of-subdir paths and exits 0 without applying anything
+# (issue #1). $WORK must therefore live OUTSIDE any git checkout. Assert that a known
+# product of the series actually landed on disk, so this can never masquerade as
+# success again.
+SENTINEL="$SRC/arch/arm/boot/dts/rockchip/rv1106-warden.dts"
+[ -f "$SENTINEL" ] || {
+  echo "FATAL: patch series did not apply (missing $SENTINEL)." >&2
+  echo "       Is \$WORK inside a git repo? git apply silently ignores out-of-subdir" >&2
+  echo "       paths there — point WORK at a dir outside any checkout (e.g. \$RUNNER_TEMP)." >&2
+  exit 1
+}
+log "patch series applied ($(basename "$SENTINEL") present)"
+
 # 4. configure
 log "configuring (warden_defconfig)"
 cp "$HERE/warden_defconfig" "$SRC/.config"