From ded01d45fa1daf13e271a53303e9a6ba6249d06a Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Tue, 21 Oct 2025 12:02:39 +0000
Subject: [PATCH 01/19] Add automated kernel CI workflow with kselftest and PR
 creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implements a 5-stage GitHub Actions pipeline for automated kernel testing and PR creation.
Uses kernel-container-build automated-testing-v1 branch for build/test tooling.

Stage 1: Build (15-30 min)
- Checkout kernel source + kernel-container-build repo (automated-testing-v1)
- Build kernel in CIQ builder container with kABI checking
- Convert built container to QCOW2 VM image
- Upload: kernel-build.log, QCOW2 image

Stage 2: Boot Verification (2-5 min)
- Download QCOW2 image
- Boot kernel in QEMU (KVM or TCG) and validate login prompt appears
- Upload: boot logs

Stage 3: Kernel Selftests (20-40 min)
- Download QCOW2 image
- Execute comprehensive kselftests in QEMU with dual serial consoles
- Upload: kselftest TAP logs, dmesg output

Stage 4: Compare Results (1-2 min)
Purpose: Detect test regressions by comparing against base branch

Steps:
1. Checkout with full history (fetch-depth: 0) for git merge-base ops
2. Download current kselftest logs
3. Smart base branch detection:
   - For PRs: Uses PR's target branch
   - For pushes: Sorts branches by commit date, checks 30 most recent, finds closest common ancestor via git merge-base
   - Outputs: base_branch (reused by PR stage)
4. Download baseline logs from base branch (searches last 5 successful runs)
5. Compare results:
   - Counts passing/failing tests (before/after)
   - Fails if >±3 tests changed
   - Outputs: comparison_status, comparison_message

Stage 5: Create Pull Request (1-2 min)
Purpose: Auto-create/update PR after all tests pass

Prerequisites: Only runs if build + boot + kselftest passed, no regressions detected

Steps:
1. Check all stages passed and comparison_status != failed
2. Checkout (shallow: fetch-depth: 50) for commit messages
3. Download all artifacts (build/boot/test logs)
4. Extract statistics (pass/fail counts, build times)
5. Get commit info:
   - Single commit: Use commit message
   - Multiple commits: Create summary
6. Create/Update PR:
   - Reuses base_branch from compare-results (no duplication!)
   - Generate PR body with test results via create-pr-body.sh
   - Creates new PR or updates existing one

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .../kernel-build-and-test-x86_64.yml          | 514 ++++++++++++++++++
 1 file changed, 514 insertions(+)
 create mode 100644 .github/workflows/kernel-build-and-test-x86_64.yml

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
new file mode 100644
index 000000000000..0b2ff3ab23a0
--- /dev/null
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -0,0 +1,514 @@
+name: Automated kernel build and test (x86_64)
+on: [push]
+
+permissions:
+  contents: read
+  actions: read
+  packages: read
+  pull-requests: write
+
+jobs:
+  build:
+    name: Build kernel
+    runs-on: kernel-build
+
+    steps:
+    - name: Checkout kernel source
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 1
+        path: kernel-src-tree
+
+    - name: Checkout kernel-container-build (test branch)
+      uses: actions/checkout@v4
+      with:
+        repository: ctrliq/kernel-container-build
+        ref: automated-testing-v1
+        path: kernel-container-build
+        token: ${{ secrets.PRIVATE_REPO_ACCESS_TOKEN }}
+
+    # Host deps + KVM / FUSE validation
+    - name: Install host dependencies & verify KVM/FUSE
+      run: |
+        set -euxo pipefail
+        sudo apt-get update
+        sudo apt-get install -y fuse3 cpu-checker podman
+        sudo modprobe fuse # guarantee /dev/fuse
+        if ! sudo kvm-ok ; then
+          echo "::warning::KVM acceleration not available on this runner."
+        fi
+        if [ -e /dev/kvm ]; then
+          sudo chmod 0666 /dev/kvm
+        fi
+
+    # Kernel build inside CIQ builder (build only, no test)
+    - name: Build kernel inside CIQ builder container
+      run: |
+        set -euxo pipefail
+        mkdir -p output
+        df -h
+        cat /proc/cpuinfo
+        chmod +x kernel-container-build/build-container/*.sh
+        podman run --rm --pull=always \
+          --privileged \
+          --device=/dev/fuse \
+          $([ -e /dev/kvm ] && echo "--device=/dev/kvm") \
+          -v "$PWD/kernel-src-tree":/src \
+          -v "$PWD/output":/output \
+          -v "$PWD/kernel-container-build/build-container":/usr/local/build-scripts:ro \
+          -v "$PWD/kernel-container-build/container/kernel_build.sh":/usr/libexec/kernel_build.sh:ro \
+          -v "$PWD/kernel-container-build/container/check_kabi.sh":/usr/libexec/check_kabi.sh:ro \
+          --security-opt label=disable \
+          pulp.prod.ciq.dev/ciq/cicd/lts-images/builder \
+          /usr/local/build-scripts/build_kernel.sh 2>&1 | tee output/kernel-build.log
+        sudo dmesg
+
+    # Upload kernel compilation logs
+    - name: Upload kernel compilation logs
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: kernel-compilation-logs-x86_64
+        path: output/kernel-build.log
+        retention-days: 7
+
+    # Upload qcow2 image for next stages
+    - name: Upload qcow2 image
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: kernel-qcow2-image-x86_64
+        path: |
+          output/*.qcow2
+          output/last_build_image.txt
+        retention-days: 7
+
+  boot:
+    name: Boot verification
+    runs-on: kernel-build
+    needs: build
+
+    steps:
+    - name: Checkout kernel-container-build (test branch)
+      uses: actions/checkout@v4
+      with:
+        repository: ctrliq/kernel-container-build
+        ref: automated-testing-v1
+        path: kernel-container-build
+        token: ${{ secrets.PRIVATE_REPO_ACCESS_TOKEN }}
+
+    - name: Install host dependencies
+      run: |
+        set -euxo pipefail
+        sudo apt-get update
+        sudo apt-get install -y fuse3 cpu-checker podman
+        sudo modprobe fuse
+        if [ -e /dev/kvm ]; then
+          sudo chmod 0666 /dev/kvm
+        fi
+
+    - name: Download qcow2 image
+      uses: actions/download-artifact@v4
+      with:
+        name: kernel-qcow2-image-x86_64
+        path: output
+
+    # Boot verification test
+    - name: Boot kernel and verify
+      run: |
+        set -euxo pipefail
+        chmod +x kernel-container-build/build-container/*.sh
+        podman run --rm --pull=always \
+          --privileged \
+          --device=/dev/fuse \
+          $([ -e /dev/kvm ] && echo "--device=/dev/kvm") \
+          -v "$PWD/output":/output \
+          -v "$PWD/kernel-container-build/build-container":/usr/local/build-scripts:ro \
+          --security-opt label=disable \
+          pulp.prod.ciq.dev/ciq/cicd/lts-images/builder \
+          /usr/local/build-scripts/boot_kernel.sh
+
+    # Upload boot logs
+    - name: Upload boot logs
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: boot-logs-x86_64
+        path: output/boot-*.log
+        retention-days: 7
+
+  test-kselftest:
+    name: Run kselftests
+    runs-on: kernel-build
+    needs: boot
+
+    steps:
+    - name: Checkout kernel-container-build (test branch)
+      uses: actions/checkout@v4
+      with:
+        repository: ctrliq/kernel-container-build
+        ref: automated-testing-v1
+        path: kernel-container-build
+        token: ${{ secrets.PRIVATE_REPO_ACCESS_TOKEN }}
+
+    - name: Install host dependencies
+      run: |
+        set -euxo pipefail
+        sudo apt-get update
+        sudo apt-get install -y fuse3 cpu-checker podman
+        sudo modprobe fuse
+        if [ -e /dev/kvm ]; then
+          sudo chmod 0666 /dev/kvm
+        fi
+
+    - name: Download qcow2 image
+      uses: actions/download-artifact@v4
+      with:
+        name: kernel-qcow2-image-x86_64
+        path: output
+
+    # Run kselftests
+    - name: Execute kselftests
+      run: |
+        set -euxo pipefail
+        chmod +x kernel-container-build/build-container/*.sh
+        podman run --rm --pull=always \
+          --privileged \
+          --device=/dev/fuse \
+          $([ -e /dev/kvm ] && echo "--device=/dev/kvm") \
+          -v "$PWD/output":/output \
+          -v "$PWD/kernel-container-build/build-container":/usr/local/build-scripts:ro \
+          --security-opt label=disable \
+          pulp.prod.ciq.dev/ciq/cicd/lts-images/builder \
+          /usr/local/build-scripts/test_kselftests.sh
+
+    # Upload kselftest logs
+    - name: Upload kselftest logs
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: kselftest-logs-x86_64
+        path: |
+          output/kselftests-*.log
+          output/dmesg-*.log
+        retention-days: 7
+
+  compare-results:
+    name: Compare with previous run
+    runs-on: kernel-build
+    needs: test-kselftest
+    if: success() || failure()
+    outputs:
+      base_branch: ${{ steps.base_branch.outputs.base_branch }}
+      comparison_status: ${{ steps.comparison.outputs.comparison_status }}
+
+    steps:
+    - name: Checkout kernel source
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0  # Full history needed for reliable merge-base detection
+
+    - name: Download current kselftest logs
+      uses: actions/download-artifact@v4
+      with:
+        name: kselftest-logs-x86_64
+        path: output-current
+
+    - name: Determine base branch for comparison
+      id: base_branch
+      run: |
+        BASE_BRANCH=""
+
+        # For PRs, use the base branch directly
+        if [ -n "${{ github.base_ref }}" ]; then
+          BASE_BRANCH="${{ github.base_ref }}"
+          echo "Using PR base branch: $BASE_BRANCH"
+        else
+          # For direct pushes, find the common ancestor branch
+          echo "Not a PR, finding base branch via merge-base"
+
+          # Get all remote branches sorted by commit date (most recent first)
+          # This ensures we check actively developed branches first
+          CURRENT_COMMIT=$(git rev-parse HEAD)
+          BEST_BRANCH=""
+          CLOSEST_DISTANCE=999999
+
+          # Only check the 30 most recently updated branches for performance
+          for remote_branch in $(git for-each-ref --sort=-committerdate --format='%(refname:short)' refs/remotes/origin/ | grep -v 'HEAD\|PR-CHECKER' | head -30); do
+            branch_name=$(echo "$remote_branch" | sed 's|^origin/||')
+
+            # Skip if it's the current branch
+            if [ "$branch_name" = "${{ github.ref_name }}" ]; then
+              continue
+            fi
+
+            MERGE_BASE=$(git merge-base HEAD "$remote_branch" 2>/dev/null || echo "")
+
+            # Check if this branch shares history and isn't the current commit
+            if [ -n "$MERGE_BASE" ] && [ "$MERGE_BASE" != "$CURRENT_COMMIT" ]; then
+              # Calculate distance (number of commits) from merge-base to current HEAD
+              DISTANCE=$(git rev-list --count ${MERGE_BASE}..HEAD 2>/dev/null || echo "999999")
+
+              # Find the branch with the shortest distance (most recent common ancestor)
+              if [ "$DISTANCE" -lt "$CLOSEST_DISTANCE" ]; then
+                CLOSEST_DISTANCE=$DISTANCE
+                BEST_BRANCH=$branch_name
+              fi
+            fi
+          done
+
+          if [ -n "$BEST_BRANCH" ]; then
+            BASE_BRANCH=$BEST_BRANCH
+            echo "Found common ancestor with $BASE_BRANCH (distance: $CLOSEST_DISTANCE commits)"
+          fi
+        fi
+
+        if [ -z "$BASE_BRANCH" ]; then
+          echo "::warning::Could not determine base branch for comparison - no common ancestor found"
+          echo "::warning::Kselftest comparison will be skipped"
+          echo "base_branch=" >> $GITHUB_OUTPUT
+          exit 0
+        fi
+
+        echo "base_branch=$BASE_BRANCH" >> $GITHUB_OUTPUT
+        echo "Base branch for comparison: $BASE_BRANCH"
+
+    - name: Download baseline kselftest logs from base branch
+      if: steps.base_branch.outputs.base_branch != ''
+      uses: dawidd6/action-download-artifact@v3
+      with:
+        workflow: kernel-build-and-test-x86_64.yml
+        name: kselftest-logs-x86_64
+        path: output-previous
+        branch: ${{ steps.base_branch.outputs.base_branch }}
+        workflow_conclusion: success
+        search_artifacts: true
+        skip_unpack: false
+        if_no_artifact_found: warn
+        # Only search the last 5 successful runs for better performance
+        run_number: ${{ github.run_number }}
+        search_depth: 5
+      continue-on-error: true
+      timeout-minutes: 3
+
+    - name: Compare test results
+      id: comparison
+      run: |
+        # Check if we have a base branch to compare against
+        if [ -z "${{ steps.base_branch.outputs.base_branch }}" ]; then
+          echo "::warning::No base branch found for comparison"
+          echo "::warning::Kselftest comparison will be skipped"
+          echo "comparison_status=skipped" >> $GITHUB_OUTPUT
+          echo "comparison_message=No base branch found - unable to determine merge target" >> $GITHUB_OUTPUT
+          exit 0
+        fi
+
+        # Check if baseline logs exist
+        if ls output-previous/kselftests-*.log 1> /dev/null 2>&1; then
+          # Compare passing tests (ok)
+          BEFORE_PASS=$(grep -a '^ok' output-previous/kselftests-*.log | wc -l || echo "0")
+          AFTER_PASS=$(grep -a '^ok' output-current/kselftests-*.log | wc -l || echo "0")
+
+          # Compare failing tests (not ok)
+          BEFORE_FAIL=$(grep -a '^not ok' output-previous/kselftests-*.log | wc -l || echo "0")
+          AFTER_FAIL=$(grep -a '^not ok' output-current/kselftests-*.log | wc -l || echo "0")
+
+          echo "### Kselftest Comparison"
+          echo "Baseline (from ${{ steps.base_branch.outputs.base_branch }}): $BEFORE_PASS passing, $BEFORE_FAIL failing"
+          echo "Current (${{ github.ref_name }}): $AFTER_PASS passing, $AFTER_FAIL failing"
+
+          # Calculate differences
+          PASS_DIFF=$((AFTER_PASS - BEFORE_PASS))
+          FAIL_DIFF=$((AFTER_FAIL - BEFORE_FAIL))
+
+          echo "Pass difference: $PASS_DIFF"
+          echo "Fail difference: $FAIL_DIFF"
+
+          # Check for regression (more than 3 tests difference)
+          REGRESSION=0
+
+          if [ $PASS_DIFF -lt -3 ]; then
+            echo "::error::Regression detected: $PASS_DIFF passing tests (threshold: -3)"
+            REGRESSION=1
+          fi
+
+          if [ $FAIL_DIFF -gt 3 ]; then
+            echo "::error::Regression detected: +$FAIL_DIFF failing tests (threshold: +3)"
+            REGRESSION=1
+          fi
+
+          if [ $REGRESSION -eq 1 ]; then
+            echo "::error::Test regression exceeds acceptable threshold of 3 tests"
+            echo "comparison_status=failed" >> $GITHUB_OUTPUT
+            echo "comparison_message=Regression detected: Pass diff: $PASS_DIFF, Fail diff: $FAIL_DIFF (threshold: ±3)" >> $GITHUB_OUTPUT
+            exit 1
+          else
+            echo "::notice::Test results within acceptable range (threshold: ±3 tests)"
+            echo "comparison_status=passed" >> $GITHUB_OUTPUT
+            echo "comparison_message=Baseline: $BEFORE_PASS passing, $BEFORE_FAIL failing | Current: $AFTER_PASS passing, $AFTER_FAIL failing" >> $GITHUB_OUTPUT
+          fi
+        else
+          echo "::warning::No baseline test results found for branch ${{ steps.base_branch.outputs.base_branch }}"
+          echo "::notice::Cannot compare against base branch - artifacts may not exist or have expired (7-day retention)"
+          echo "::notice::Skipping comparison - PR will still be created with warning"
+          echo "comparison_status=skipped" >> $GITHUB_OUTPUT
+          echo "comparison_message=No baseline results available from ${{ steps.base_branch.outputs.base_branch }}" >> $GITHUB_OUTPUT
+        fi
+  create-pr:
+    name: Create Pull Request
+    runs-on: kernel-build
+    needs: [build, boot, test-kselftest, compare-results]
+    if: success() || failure()
+
+    steps:
+    - name: Check if tests passed and no regressions
+      run: |
+        # Skip PR if any test stage failed
+        if [ "${{ needs.build.result }}" != "success" ] || \
+           [ "${{ needs.boot.result }}" != "success" ] || \
+           [ "${{ needs.test-kselftest.result }}" != "success" ]; then
+          echo "One or more test stages failed, skipping PR creation"
+          exit 1
+        fi
+
+        # Skip PR if regression was detected (but allow if comparison was skipped/unavailable)
+        if [ "${{ needs.compare-results.outputs.comparison_status }}" = "failed" ]; then
+          echo "Test regression detected, skipping PR creation"
+          exit 1
+        fi
+
+        echo "All test stages passed and no regressions detected, proceeding with PR creation"
+
+    - name: Checkout kernel source
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 50  # Shallow clone: enough for commit messages and logs
+        token: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Download kernel compilation logs
+      uses: actions/download-artifact@v4
+      with:
+        name: kernel-compilation-logs-x86_64
+        path: artifacts/build
+
+    - name: Download boot logs
+      uses: actions/download-artifact@v4
+      with:
+        name: boot-logs-x86_64
+        path: artifacts/boot
+
+    - name: Download kselftest logs
+      uses: actions/download-artifact@v4
+      with:
+        name: kselftest-logs-x86_64
+        path: artifacts/test
+
+    - name: Extract test statistics
+      id: stats
+      run: |
+        PASSED=$(grep -a '^ok' artifacts/test/kselftests-*.log | wc -l || echo "0")
+        FAILED=$(grep -a '^not ok' artifacts/test/kselftests-*.log | wc -l || echo "0")
+        echo "passed=$PASSED" >> $GITHUB_OUTPUT
+        echo "failed=$FAILED" >> $GITHUB_OUTPUT
+
+    - name: Extract build timers
+      id: build_info
+      run: |
+        BUILD_TIME=$(grep -oP '\[TIMER\]\{BUILD\}:\s*\K[0-9]+' artifacts/build/kernel-build.log | head -1 || echo "N/A")
+        TOTAL_TIME=$(grep -oP '\[TIMER\]\{TOTAL\}\s*\K[0-9]+' artifacts/build/kernel-build.log | head -1 || echo "N/A")
+        echo "build_time=${BUILD_TIME}s" >> $GITHUB_OUTPUT
+        echo "total_time=${TOTAL_TIME}s" >> $GITHUB_OUTPUT
+
+    - name: Get commit information
+      id: commit_msg
+      run: |
+        # Count commits since origin/main (or appropriate base branch)
+        BASE_BRANCH="main"
+        if ! git rev-parse origin/$BASE_BRANCH >/dev/null 2>&1; then
+          # Try other common base branch names
+          for branch in master lts-9.2 lts-9; do
+            if git rev-parse origin/$branch >/dev/null 2>&1; then
+              BASE_BRANCH=$branch
+              break
+            fi
+          done
+        fi
+
+        COMMIT_COUNT=$(git rev-list --count origin/$BASE_BRANCH..HEAD 2>/dev/null || echo "1")
+
+        if [ "$COMMIT_COUNT" -eq "1" ]; then
+          # Single commit: use commit subject
+          git log -1 --pretty=%s > /tmp/commit_subject.txt
+          COMMIT_SUBJECT=$(cat /tmp/commit_subject.txt)
+          echo "commit_subject=$COMMIT_SUBJECT" >> $GITHUB_OUTPUT
+
+          # Save full commit message to file
+          git log -1 --pretty=%B > /tmp/commit_message.txt
+        else
+          # Multiple commits: create summary
+          echo "commit_subject=Multiple patches tested ($COMMIT_COUNT commits)" >> $GITHUB_OUTPUT
+
+          # Get all commit messages and save to file
+          git log origin/$BASE_BRANCH..HEAD --pretty=format:"### %s%n%n%b%n---" > /tmp/commit_message.txt
+        fi
+
+    - name: Create Pull Request
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        # Reuse base branch from compare-results stage (already computed)
+        BASE_BRANCH="${{ needs.compare-results.outputs.base_branch }}"
+
+        if [ -z "$BASE_BRANCH" ]; then
+          echo "ERROR: Could not determine base branch for PR (compare-results did not find one)"
+          exit 1
+        fi
+
+        echo "Creating PR from ${{ github.ref_name }} to $BASE_BRANCH"
+
+        # Determine comparison status message
+        COMPARISON_STATUS="${{ needs.compare-results.outputs.comparison_status }}"
+        if [ "$COMPARISON_STATUS" = "passed" ]; then
+          COMPARISON_SECTION="### ✅ Test Comparison
+        - Status: Passed - Within acceptable threshold (±3 tests)
+        - Compared against: $BASE_BRANCH"
+        elif [ "$COMPARISON_STATUS" = "skipped" ]; then
+          COMPARISON_SECTION="### ⚠️ Test Comparison
+        - Status: Skipped
+        - Reason: No baseline test results available from $BASE_BRANCH
+        - **Note:** Manual review recommended to ensure no regressions"
+        else
+          COMPARISON_SECTION="### ❌ Test Comparison
+        - Status: Failed - Regression detected
+        - Compared against: $BASE_BRANCH
+        - **Action Required:** Review test differences before merging"
+        fi
+
+        # Create PR body using script
+        chmod +x .github/scripts/create-pr-body.sh
+        .github/scripts/create-pr-body.sh \
+          "${{ steps.build_info.outputs.build_time }}" \
+          "${{ steps.build_info.outputs.total_time }}" \
+          "${{ steps.stats.outputs.passed }}" \
+          "${{ steps.stats.outputs.failed }}" \
+          "${{ github.run_id }}" \
+          "$COMPARISON_SECTION" \
+          "${{ github.repository }}" \
+          > pr_body.md
+
+        # Check if PR already exists
+        EXISTING_PR=$(gh pr list --head "${{ github.ref_name }}" --base "$BASE_BRANCH" --json number --jq '.[0].number' || echo "")
+
+        if [ -n "$EXISTING_PR" ]; then
+          echo "PR #$EXISTING_PR already exists, updating it"
+          gh pr edit "$EXISTING_PR" \
+            --title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \
+            --body-file pr_body.md
+        else
+          echo "Creating new PR from ${{ github.ref_name }} to $BASE_BRANCH"
+          gh pr create \
+            --base "$BASE_BRANCH" \
+            --head "${{ github.ref_name }}" \
+            --title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \
+            --body-file pr_body.md
+        fi

From 293dbe9a83c0ae2839603ceb20366ab100f67b5e Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Thu, 6 Nov 2025 20:35:13 +0000
Subject: [PATCH 02/19] Add a condition for github action to run

Currently, this github action has been tested only
on 9.2 CIQ LTS kernel so just add that branch as a
condition to run the test.

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 0b2ff3ab23a0..e9849c405d52 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -1,5 +1,8 @@
 name: Automated kernel build and test (x86_64)
-on: [push]
+on:
+  push:
+    branches:
+      - 'ciqlts9_2'
 
 permissions:
   contents: read

From 97d0976e7a4f21ff8b2673ab6d3faa9502f32441 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Tue, 21 Oct 2025 12:02:49 +0000
Subject: [PATCH 03/19] Add PR body generation script

Script to generate detailed PR descriptions with kselftest results.

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/scripts/create-pr-body.sh | 60 +++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100755 .github/scripts/create-pr-body.sh

diff --git a/.github/scripts/create-pr-body.sh b/.github/scripts/create-pr-body.sh
new file mode 100755
index 000000000000..e5a5450362eb
--- /dev/null
+++ b/.github/scripts/create-pr-body.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+
+# Script to create PR body
+# Arguments: build_time total_time passed failed run_id comparison_section
+
+BUILD_TIME="$1"
+TOTAL_TIME="$2"
+PASSED="$3"
+FAILED="$4"
+RUN_ID="$5"
+COMPARISON_SECTION="$6"
+REPO="$7"
+
+# Convert seconds to minutes for better readability
+convert_time() {
+  local seconds="${1%s}"  # Remove 's' suffix if present
+  local minutes=$((seconds / 60))
+  local remaining_seconds=$((seconds % 60))
+  echo "${minutes}m ${remaining_seconds}s"
+}
+
+BUILD_TIME_READABLE=$(convert_time "$BUILD_TIME")
+TOTAL_TIME_READABLE=$(convert_time "$TOTAL_TIME")
+
+cat << EOF
+## Summary
+This PR has been automatically created after successful completion of all CI stages.
+
+## Commit Message(s)
+\`\`\`
+EOF
+
+cat /tmp/commit_message.txt
+
+cat << EOF
+\`\`\`
+
+## Test Results
+
+### ✅ Build Stage
+- Status: Passed
+- Build Time: ${BUILD_TIME_READABLE}
+- Total Time: ${TOTAL_TIME_READABLE}
+- [View build logs](https://github.com/${REPO}/actions/runs/${RUN_ID})
+
+### ✅ Boot Verification
+- Status: Passed
+- [View boot logs](https://github.com/${REPO}/actions/runs/${RUN_ID})
+
+### ✅ Kernel Selftests
+- **Passed:** ${PASSED}
+- **Failed:** ${FAILED}
+- [View kselftest logs](https://github.com/${REPO}/actions/runs/${RUN_ID})
+
+${COMPARISON_SECTION}
+
+---
+🤖 This PR was automatically generated by GitHub Actions
+Run ID: ${RUN_ID}
+EOF

From d67b81a2cbdd8a8ee617d4ac427664dffb1054dc Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Tue, 21 Oct 2025 12:28:50 +0000
Subject: [PATCH 04/19] Add [skip ci] and [ci skip] support to workflow

- Workflow now checks commit message for [skip ci] or [ci skip]
- If either flag is present, the entire workflow is skipped
- Allows developers to push changes without triggering CI when not needed

Usage:
  git commit -m "docs: update README [skip ci]"
  git commit -m "wip: work in progress [ci skip]"

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index e9849c405d52..2c25498be478 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -14,6 +14,7 @@ jobs:
   build:
     name: Build kernel
     runs-on: kernel-build
+    if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[ci skip]')"
 
     steps:
     - name: Checkout kernel source

From 81f64b31d188348cd228258a164e47e8f2512c5d Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Tue, 4 Nov 2025 12:19:45 +0000
Subject: [PATCH 05/19] Create a PR only if curly braces are present in the
 Branch name

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 2c25498be478..0caaa3f0ff18 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -365,6 +365,15 @@ jobs:
     if: success() || failure()
 
     steps:
+    - name: Check if branch name contains curly brackets
+      run: |
+        BRANCH_NAME="${{ github.ref_name }}"
+        if [[ ! "$BRANCH_NAME" =~ \{ ]] || [[ ! "$BRANCH_NAME" =~ \} ]]; then
+          echo "Branch name '$BRANCH_NAME' does not contain curly brackets, skipping PR creation"
+          exit 1
+        fi
+        echo "Branch name contains curly brackets, proceeding with PR creation checks"
+
     - name: Check if tests passed and no regressions
       run: |
         # Skip PR if any test stage failed

From a6bddb3d9231c64d0208bb4b9d960ea997713a55 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Wed, 5 Nov 2025 15:37:18 +0000
Subject: [PATCH 06/19] Use target branch name into the PR subject line

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 0caaa3f0ff18..4cfdcc413336 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -515,13 +515,13 @@ jobs:
         if [ -n "$EXISTING_PR" ]; then
           echo "PR #$EXISTING_PR already exists, updating it"
           gh pr edit "$EXISTING_PR" \
-            --title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \
+            --title "[$BASE_BRANCH] ${{ steps.commit_msg.outputs.commit_subject }}" \
             --body-file pr_body.md
         else
           echo "Creating new PR from ${{ github.ref_name }} to $BASE_BRANCH"
           gh pr create \
             --base "$BASE_BRANCH" \
             --head "${{ github.ref_name }}" \
-            --title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \
+            --title "[$BASE_BRANCH] ${{ steps.commit_msg.outputs.commit_subject }}" \
             --body-file pr_body.md
         fi

From 497339b7dea2a645d8290dead1619f152422992d Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Thu, 6 Nov 2025 11:15:33 +0000
Subject: [PATCH 07/19] Fix force pushes logic

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .../kernel-build-and-test-x86_64.yml          | 54 +++++++++++++++----
 1 file changed, 44 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 4cfdcc413336..5fd97a636db7 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -218,18 +218,39 @@ jobs:
         name: kselftest-logs-x86_64
         path: output-current
 
+    - name: Install GitHub CLI
+      run: |
+        set -euxo pipefail
+        # Install gh CLI if not already available
+        if ! command -v gh &> /dev/null; then
+          sudo apt-get update
+          sudo apt-get install -y gh
+        fi
+
     - name: Determine base branch for comparison
       id: base_branch
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
         BASE_BRANCH=""
 
-        # For PRs, use the base branch directly
-        if [ -n "${{ github.base_ref }}" ]; then
+        # First, check if an open PR already exists from this head branch
+        echo "Checking for existing open PR from branch: ${{ github.ref_name }}"
+        EXISTING_PR=$(gh pr list --head "${{ github.ref_name }}" --state open --json number,baseRefName --jq '.[0]' || echo "")
+
+        if [ -n "$EXISTING_PR" ] && [ "$EXISTING_PR" != "null" ]; then
+          # PR exists - use its existing base branch (no merge-base detection on force push)
+          BASE_BRANCH=$(echo "$EXISTING_PR" | jq -r '.baseRefName')
+          PR_NUMBER=$(echo "$EXISTING_PR" | jq -r '.number')
+          echo "Found existing PR #$PR_NUMBER, using existing base: $BASE_BRANCH"
+          echo "Skipping merge-base detection to avoid duplicate PRs on force push"
+        elif [ -n "${{ github.base_ref }}" ]; then
+          # For PRs, use the base branch directly
           BASE_BRANCH="${{ github.base_ref }}"
           echo "Using PR base branch: $BASE_BRANCH"
         else
-          # For direct pushes, find the common ancestor branch
-          echo "Not a PR, finding base branch via merge-base"
+          # No existing PR - for direct pushes, find the common ancestor branch
+          echo "No existing PR found, finding base branch via merge-base"
 
           # Get all remote branches sorted by commit date (most recent first)
           # This ensures we check actively developed branches first
@@ -477,7 +498,7 @@ jobs:
           exit 1
         fi
 
-        echo "Creating PR from ${{ github.ref_name }} to $BASE_BRANCH"
+        echo "Creating/updating PR from ${{ github.ref_name }} to $BASE_BRANCH"
 
         # Determine comparison status message
         COMPARISON_STATUS="${{ needs.compare-results.outputs.comparison_status }}"
@@ -509,14 +530,27 @@ jobs:
           "${{ github.repository }}" \
           > pr_body.md
 
-        # Check if PR already exists
-        EXISTING_PR=$(gh pr list --head "${{ github.ref_name }}" --base "$BASE_BRANCH" --json number --jq '.[0].number' || echo "")
+        # Check if any open PR already exists from this head branch (regardless of base)
+        EXISTING_PR=$(gh pr list --head "${{ github.ref_name }}" --state open --json number,baseRefName --jq '.[0]' || echo "")
 
-        if [ -n "$EXISTING_PR" ]; then
-          echo "PR #$EXISTING_PR already exists, updating it"
-          gh pr edit "$EXISTING_PR" \
+        if [ -n "$EXISTING_PR" ] && [ "$EXISTING_PR" != "null" ]; then
+          PR_NUMBER=$(echo "$EXISTING_PR" | jq -r '.number')
+          CURRENT_BASE=$(echo "$EXISTING_PR" | jq -r '.baseRefName')
+
+          echo "Found existing PR #$PR_NUMBER (current base: $CURRENT_BASE)"
+
+          # Update PR title and body
+          gh pr edit "$PR_NUMBER" \
             --title "[$BASE_BRANCH] ${{ steps.commit_msg.outputs.commit_subject }}" \
             --body-file pr_body.md
+
+          echo "Updated PR #$PR_NUMBER"
+
+          # Note: We don't change the base branch even if it differs from $BASE_BRANCH
+          # because compare-results already used the existing PR's base for comparison
+          if [ "$CURRENT_BASE" != "$BASE_BRANCH" ]; then
+            echo "::notice::PR base remains $CURRENT_BASE (comparison was done against this base)"
+          fi
         else
           echo "Creating new PR from ${{ github.ref_name }} to $BASE_BRANCH"
           gh pr create \

From d3283dcbedf5b378a2faef69828f5d7b4f67c462 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Tue, 21 Oct 2025 12:02:58 +0000
Subject: [PATCH 08/19] Add .container_build_image and remove -c flag from
 workflow

- Created .container_build_image with lts-9.2-kernel-builder
- Updated workflow to remove -c option from build_kernel.sh call
- Build script will now automatically use the image specified in .container_build_image

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .container_build_image | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .container_build_image

diff --git a/.container_build_image b/.container_build_image
new file mode 100644
index 000000000000..7b679673deea
--- /dev/null
+++ b/.container_build_image
@@ -0,0 +1 @@
+lts-9.2-kernel-builder
\ No newline at end of file

From 59fc758cf6163df0f588fd66e4bfba86282edfcf Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Mon, 17 Nov 2025 13:13:44 +0000
Subject: [PATCH 09/19] Remove complex merge base logic

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .../kernel-build-and-test-x86_64.yml          | 91 ++++++++-----------
 1 file changed, 39 insertions(+), 52 deletions(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 5fd97a636db7..d65939c0506c 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -233,66 +233,52 @@ jobs:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
         BASE_BRANCH=""
+        BRANCH_NAME="${{ github.ref_name }}"
+
+        # Define whitelist of valid base branches
+        VALID_BASES="ciqlts9_2 ciqlts9_4 ciqlts8_6"
+
+        echo "Current branch: $BRANCH_NAME"
 
         # First, check if an open PR already exists from this head branch
-        echo "Checking for existing open PR from branch: ${{ github.ref_name }}"
-        EXISTING_PR=$(gh pr list --head "${{ github.ref_name }}" --state open --json number,baseRefName --jq '.[0]' || echo "")
+        echo "Checking for existing open PR from branch: $BRANCH_NAME"
+        EXISTING_PR=$(gh pr list --head "$BRANCH_NAME" --state open --json number,baseRefName --jq '.[0]' || echo "")
 
         if [ -n "$EXISTING_PR" ] && [ "$EXISTING_PR" != "null" ]; then
-          # PR exists - use its existing base branch (no merge-base detection on force push)
+          # PR exists - use its existing base branch
           BASE_BRANCH=$(echo "$EXISTING_PR" | jq -r '.baseRefName')
           PR_NUMBER=$(echo "$EXISTING_PR" | jq -r '.number')
           echo "Found existing PR #$PR_NUMBER, using existing base: $BASE_BRANCH"
-          echo "Skipping merge-base detection to avoid duplicate PRs on force push"
         elif [ -n "${{ github.base_ref }}" ]; then
           # For PRs, use the base branch directly
           BASE_BRANCH="${{ github.base_ref }}"
           echo "Using PR base branch: $BASE_BRANCH"
         else
-          # No existing PR - for direct pushes, find the common ancestor branch
-          echo "No existing PR found, finding base branch via merge-base"
-
-          # Get all remote branches sorted by commit date (most recent first)
-          # This ensures we check actively developed branches first
-          CURRENT_COMMIT=$(git rev-parse HEAD)
-          BEST_BRANCH=""
-          CLOSEST_DISTANCE=999999
-
-          # Only check the 30 most recently updated branches for performance
-          for remote_branch in $(git for-each-ref --sort=-committerdate --format='%(refname:short)' refs/remotes/origin/ | grep -v 'HEAD\|PR-CHECKER' | head -30); do
-            branch_name=$(echo "$remote_branch" | sed 's|^origin/||')
-
-            # Skip if it's the current branch
-            if [ "$branch_name" = "${{ github.ref_name }}" ]; then
-              continue
+          # Extract base branch from branch name pattern: {name}_base or {name}-base
+          # Match patterns like {shreeya}_ciqlts9_2 or {shreeya}-ciqlts9_2
+          if [[ "$BRANCH_NAME" =~ \{[^}]+\}[_-](.+) ]]; then
+            EXTRACTED_BASE="${BASH_REMATCH[1]}"
+            echo "Extracted base branch from branch name: $EXTRACTED_BASE"
+
+            # Validate against whitelist
+            if echo "$VALID_BASES" | grep -wq "$EXTRACTED_BASE"; then
+              BASE_BRANCH="$EXTRACTED_BASE"
+              echo "Base branch validated: $BASE_BRANCH"
+            else
+              echo "::error::Extracted base '$EXTRACTED_BASE' is not in whitelist: $VALID_BASES"
+              echo "::error::Valid base branches are: $VALID_BASES"
+              exit 1
             fi
-
-            MERGE_BASE=$(git merge-base HEAD "$remote_branch" 2>/dev/null || echo "")
-
-            # Check if this branch shares history and isn't the current commit
-            if [ -n "$MERGE_BASE" ] && [ "$MERGE_BASE" != "$CURRENT_COMMIT" ]; then
-              # Calculate distance (number of commits) from merge-base to current HEAD
-              DISTANCE=$(git rev-list --count ${MERGE_BASE}..HEAD 2>/dev/null || echo "999999")
-
-              # Find the branch with the shortest distance (most recent common ancestor)
-              if [ "$DISTANCE" -lt "$CLOSEST_DISTANCE" ]; then
-                CLOSEST_DISTANCE=$DISTANCE
-                BEST_BRANCH=$branch_name
-              fi
-            fi
-          done
-
-          if [ -n "$BEST_BRANCH" ]; then
-            BASE_BRANCH=$BEST_BRANCH
-            echo "Found common ancestor with $BASE_BRANCH (distance: $CLOSEST_DISTANCE commits)"
+          else
+            echo "::error::Branch name does not match expected pattern {name}_base or {name}-base"
+            echo "::error::Branch name must be in format {name}_base or {name}-base where base is one of: $VALID_BASES"
+            exit 1
           fi
         fi
 
         if [ -z "$BASE_BRANCH" ]; then
-          echo "::warning::Could not determine base branch for comparison - no common ancestor found"
-          echo "::warning::Kselftest comparison will be skipped"
-          echo "base_branch=" >> $GITHUB_OUTPUT
-          exit 0
+          echo "::error::Could not determine base branch"
+          exit 1
         fi
 
         echo "base_branch=$BASE_BRANCH" >> $GITHUB_OUTPUT
@@ -456,16 +442,17 @@ jobs:
     - name: Get commit information
       id: commit_msg
       run: |
-        # Count commits since origin/main (or appropriate base branch)
-        BASE_BRANCH="main"
+        # Use the base branch determined by compare-results stage
+        BASE_BRANCH="${{ needs.compare-results.outputs.base_branch }}"
+
+        if [ -z "$BASE_BRANCH" ]; then
+          echo "::error::Base branch not determined by compare-results stage"
+          exit 1
+        fi
+
         if ! git rev-parse origin/$BASE_BRANCH >/dev/null 2>&1; then
-          # Try other common base branch names
-          for branch in master lts-9.2 lts-9; do
-            if git rev-parse origin/$branch >/dev/null 2>&1; then
-              BASE_BRANCH=$branch
-              break
-            fi
-          done
+          echo "::error::Base branch origin/$BASE_BRANCH does not exist"
+          exit 1
         fi
 
         COMMIT_COUNT=$(git rev-list --count origin/$BASE_BRANCH..HEAD 2>/dev/null || echo "1")

From 479e5610d987251289d2c502756a9dfdbd661afd Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Mon, 17 Nov 2025 17:15:51 +0000
Subject: [PATCH 10/19] Fix PR creation commit message extraction

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index d65939c0506c..be8f077d13be 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -402,9 +402,18 @@ jobs:
     - name: Checkout kernel source
       uses: actions/checkout@v4
       with:
-        fetch-depth: 50  # Shallow clone: enough for commit messages and logs
+        fetch-depth: 100  # Fetch more history for commit counting
         token: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Fetch base branch for commit comparison
+      run: |
+        BASE_BRANCH="${{ needs.compare-results.outputs.base_branch }}"
+        if [ -n "$BASE_BRANCH" ]; then
+          # Fetch just the base branch tip (shallow)
+          git fetch --depth=1 origin "$BASE_BRANCH:refs/remotes/origin/$BASE_BRANCH" || true
+          echo "Fetched base branch: $BASE_BRANCH"
+        fi
+
     - name: Download kernel compilation logs
       uses: actions/download-artifact@v4
       with:

From d8275f9f4d675e187ddc4f6c6802e52721ad3aa8 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Mon, 17 Nov 2025 17:22:42 +0000
Subject: [PATCH 11/19] Minor fixes 1

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index be8f077d13be..87db74e19db4 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -524,6 +524,7 @@ jobs:
           "${{ github.run_id }}" \
           "$COMPARISON_SECTION" \
           "${{ github.repository }}" \
+          "/tmp/commit_message.txt" \
           > pr_body.md
 
         # Check if any open PR already exists from this head branch (regardless of base)

From 8476bc3edf3e4fa3ad34e430e88bf14664723260 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Mon, 17 Nov 2025 17:26:32 +0000
Subject: [PATCH 12/19] Minor fixes 2

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/scripts/create-pr-body.sh | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/create-pr-body.sh b/.github/scripts/create-pr-body.sh
index e5a5450362eb..4fad1c58f4b9 100755
--- a/.github/scripts/create-pr-body.sh
+++ b/.github/scripts/create-pr-body.sh
@@ -1,7 +1,16 @@
 #!/bin/bash
 
 # Script to create PR body
-# Arguments: build_time total_time passed failed run_id comparison_section
+# Arguments: build_time total_time passed failed run_id comparison_section repo commit_message_file
+
+set -euo pipefail
+
+# Check number of arguments
+if [ $# -lt 7 ] || [ $# -gt 8 ]; then
+  echo "Error: Expected 7 or 8 arguments, got $#" >&2
+  echo "Usage: $0 <build_time> <total_time> <passed> <failed> <run_id> <comparison_section> <repo> [commit_message_file]" >&2
+  exit 1
+fi
 
 BUILD_TIME="$1"
 TOTAL_TIME="$2"
@@ -10,6 +19,20 @@ FAILED="$4"
 RUN_ID="$5"
 COMPARISON_SECTION="$6"
 REPO="$7"
+COMMIT_MESSAGE_FILE="${8:-/tmp/commit_message.txt}"
+
+# Validate required arguments are not empty
+if [ -z "$BUILD_TIME" ] || [ -z "$TOTAL_TIME" ] || [ -z "$PASSED" ] || [ -z "$FAILED" ] || [ -z "$RUN_ID" ] || [ -z "$COMPARISON_SECTION" ] || [ -z "$REPO" ]; then
+  echo "Error: One or more required arguments are empty" >&2
+  echo "Usage: $0 <build_time> <total_time> <passed> <failed> <run_id> <comparison_section> <repo> [commit_message_file]" >&2
+  exit 1
+fi
+
+# Check if commit message file exists
+if [ ! -f "$COMMIT_MESSAGE_FILE" ]; then
+  echo "Error: Commit message file not found: $COMMIT_MESSAGE_FILE" >&2
+  exit 1
+fi
 
 # Convert seconds to minutes for better readability
 convert_time() {
@@ -30,7 +53,7 @@ This PR has been automatically created after successful completion of all CI sta
 \`\`\`
 EOF
 
-cat /tmp/commit_message.txt
+cat "$COMMIT_MESSAGE_FILE"
 
 cat << EOF
 \`\`\`

From 055b433b100d72fe1cdfc70019c0cf71830d758a Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Mon, 17 Nov 2025 19:38:02 +0000
Subject: [PATCH 13/19] Fix branch name

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 87db74e19db4..9b20ec4b8d20 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -2,7 +2,7 @@ name: Automated kernel build and test (x86_64)
 on:
   push:
     branches:
-      - 'ciqlts9_2'
+      - '*_ciqlts9_2'
 
 permissions:
   contents: read

From b8a2e967243e6f122f3913baa22153439417b06c Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Tue, 4 Nov 2025 15:28:48 +0000
Subject: [PATCH 14/19] NFS: Fix filehandle bounds checking in
 nfs_fh_to_dentry()

jira VULN-136577
cve CVE-2025-39730
commit-author Trond Myklebust <trond.myklebust@hammerspace.com>
commit ef93a685e01a281b5e2a25ce4e3428cf9371a205

The function needs to check the minimal filehandle length before it can
access the embedded filehandle.

	Reported-by: zhangjian <zhangjian496@huawei.com>
Fixes: 20fa19027286 ("nfs: add export operations")
	Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
(cherry picked from commit ef93a685e01a281b5e2a25ce4e3428cf9371a205)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 fs/nfs/export.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/export.c b/fs/nfs/export.c
index 01596f2d0a1e..0ad412ab10f6 100644
--- a/fs/nfs/export.c
+++ b/fs/nfs/export.c
@@ -66,14 +66,21 @@ nfs_fh_to_dentry(struct super_block *sb, struct fid *fid,
 {
 	struct nfs_fattr *fattr = NULL;
 	struct nfs_fh *server_fh = nfs_exp_embedfh(fid->raw);
-	size_t fh_size = offsetof(struct nfs_fh, data) + server_fh->size;
+	size_t fh_size = offsetof(struct nfs_fh, data);
 	const struct nfs_rpc_ops *rpc_ops;
 	struct dentry *dentry;
 	struct inode *inode;
-	int len = EMBED_FH_OFF + XDR_QUADLEN(fh_size);
+	int len = EMBED_FH_OFF;
 	u32 *p = fid->raw;
 	int ret;
 
+	/* Initial check of bounds */
+	if (fh_len < len + XDR_QUADLEN(fh_size) ||
+	    fh_len > XDR_QUADLEN(NFS_MAXFHSIZE))
+		return NULL;
+	/* Calculate embedded filehandle size */
+	fh_size += server_fh->size;
+	len += XDR_QUADLEN(fh_size);
 	/* NULL translates to ESTALE */
 	if (fh_len < len || fh_type != len)
 		return NULL;

From 3600f0226a32005086f1bd2eaf488b99ce3eec28 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Mon, 17 Nov 2025 21:31:00 +0000
Subject: [PATCH 15/19] Fix markdown formatting

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/scripts/create-pr-body.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/scripts/create-pr-body.sh b/.github/scripts/create-pr-body.sh
index 4fad1c58f4b9..e3b2622ebddc 100755
--- a/.github/scripts/create-pr-body.sh
+++ b/.github/scripts/create-pr-body.sh
@@ -54,6 +54,7 @@ This PR has been automatically created after successful completion of all CI sta
 EOF
 
 cat "$COMMIT_MESSAGE_FILE"
+echo ""
 
 cat << EOF
 \`\`\`

From 638763e79ef5c1e9c0664e38ca231938ebc3b831 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Mon, 17 Nov 2025 21:31:26 +0000
Subject: [PATCH 16/19] Fix counting of total commits

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 9b20ec4b8d20..79a943aea739 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -409,8 +409,8 @@ jobs:
       run: |
         BASE_BRANCH="${{ needs.compare-results.outputs.base_branch }}"
         if [ -n "$BASE_BRANCH" ]; then
-          # Fetch just the base branch tip (shallow)
-          git fetch --depth=1 origin "$BASE_BRANCH:refs/remotes/origin/$BASE_BRANCH" || true
+          # Fetch base branch with enough history to find common ancestor
+          git fetch --depth=200 origin "$BASE_BRANCH:refs/remotes/origin/$BASE_BRANCH" || true
           echo "Fetched base branch: $BASE_BRANCH"
         fi
 

From 56c8b6a762a182ec06c3323dbb20246f18f66ac8 Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Fri, 21 Nov 2025 17:38:11 +0000
Subject: [PATCH 17/19] Review fixes 1

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index 79a943aea739..bade945339a6 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -236,6 +236,7 @@ jobs:
         BRANCH_NAME="${{ github.ref_name }}"
 
         # Define whitelist of valid base branches
+        # TODO: Use a centralized place to get the base branches
         VALID_BASES="ciqlts9_2 ciqlts9_4 ciqlts8_6"
 
         echo "Current branch: $BRANCH_NAME"
@@ -286,7 +287,7 @@ jobs:
 
     - name: Download baseline kselftest logs from base branch
       if: steps.base_branch.outputs.base_branch != ''
-      uses: dawidd6/action-download-artifact@v3
+      uses: dawidd6/action-download-artifact@v11
       with:
         workflow: kernel-build-and-test-x86_64.yml
         name: kselftest-logs-x86_64
@@ -471,17 +472,16 @@ jobs:
           git log -1 --pretty=%s > /tmp/commit_subject.txt
           COMMIT_SUBJECT=$(cat /tmp/commit_subject.txt)
           echo "commit_subject=$COMMIT_SUBJECT" >> $GITHUB_OUTPUT
-
-          # Save full commit message to file
-          git log -1 --pretty=%B > /tmp/commit_message.txt
         else
           # Multiple commits: create summary
           echo "commit_subject=Multiple patches tested ($COMMIT_COUNT commits)" >> $GITHUB_OUTPUT
-
-          # Get all commit messages and save to file
-          git log origin/$BASE_BRANCH..HEAD --pretty=format:"### %s%n%n%b%n---" > /tmp/commit_message.txt
         fi
 
+        # Get all commit messages and save to file (in reverse order)
+        for commit in $(git log origin/$BASE_BRANCH..HEAD --format=%h | tac); do
+          git log -1 $commit --format=%B | awk 'BEGIN{print "```"} /^$/{empty++} empty==2{exit} {print} END{print "```"}' >> /tmp/commit_message.txt
+        done
+
     - name: Create Pull Request
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 773475273b15ce05be10170cc6b107bee13ed6af Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Fri, 21 Nov 2025 17:38:41 +0000
Subject: [PATCH 18/19] Review fixes 2

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/scripts/create-pr-body.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/scripts/create-pr-body.sh b/.github/scripts/create-pr-body.sh
index e3b2622ebddc..04fe61ac6fa5 100755
--- a/.github/scripts/create-pr-body.sh
+++ b/.github/scripts/create-pr-body.sh
@@ -50,14 +50,13 @@ cat << EOF
 This PR has been automatically created after successful completion of all CI stages.
 
 ## Commit Message(s)
-\`\`\`
+
 EOF
 
 cat "$COMMIT_MESSAGE_FILE"
 echo ""
 
 cat << EOF
-\`\`\`
 
 ## Test Results
 

From 5993511a616a51402982ae69806162f40cb47f4c Mon Sep 17 00:00:00 2001
From: Shreeya Patel <spatel@ciq.com>
Date: Fri, 21 Nov 2025 20:16:39 +0000
Subject: [PATCH 19/19] Fix from Roxana

Signed-off-by: Shreeya Patel <spatel@ciq.com>
---
 .github/workflows/kernel-build-and-test-x86_64.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml
index bade945339a6..84599aa60ec0 100644
--- a/.github/workflows/kernel-build-and-test-x86_64.yml
+++ b/.github/workflows/kernel-build-and-test-x86_64.yml
@@ -484,7 +484,7 @@ jobs:
 
     - name: Create Pull Request
       env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GH_TOKEN: ${{ secrets.PRIVATE_REPO_ACCESS_TOKEN }}
       run: |
         # Reuse base branch from compare-results stage (already computed)
         BASE_BRANCH="${{ needs.compare-results.outputs.base_branch }}"