Merge branch 'armbian:main' into feat/bootscript-templating

Author: djurny

.coderabbit.yaml

@@ -0,0 +1,7 @@
+language: "en-US"
+reviews:
+  auto_review:
+    enabled: true
+    labels: ["Needs review"]
+    ignore_usernames: ["dependabot[bot]", "renovate[bot]"]
+    ignore_title_keywords: ["wip", "draft"]

.github/CODEOWNERS

@@ -19,5 +19,5 @@ contact_links:
     url: https://github.com/armbian/configng/issues/new
     about: Utility for configuring your board, adjusting services and installing applications.
   - name: Issue with infrastructure
-    url: https://github.com/armbian/mirror/issues/new
+    url: https://github.com/armbian/armbian-router/issues/new
     about: Broken download links or just slow download

.github/ISSUE_TEMPLATE/config.yml

@@ -4,8 +4,14 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-
+    labels:
+      - "GitHub Actions"
+      - "Dependencies"
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
+    labels:
+      - "GitHub Actions"
+      - "Dependencies"
+      - "Python"

.github/dependabot.yml

@@ -21,7 +21,7 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: igorjs/gh-actions-clean-workflow@v6
+      - uses: igorjs/gh-actions-clean-workflow@v7
         with:
           runs_older_than: ${{ github.event.inputs.runs_older_than || env.SCHEDULED_RUNS_OLDER_THAN }}
           runs_to_keep: ${{ github.event.inputs.runs_to_keep || env.SCHEDULED_RUNS_TO_KEEP }}

.github/workflows/clean-workflow-logs.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Dispatch event on forked repository
         if: ${{ env.DISPATCH_SECRET != '' }}  # Check that the secret has been set, if not, exit
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ env.DISPATCH_SECRET }}
           repository: ${{ github.repository }}

.github/workflows/forked-helper.yml

@@ -11,7 +11,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: plbstl/first-contribution@v3
+      - uses: plbstl/first-contribution@v4
         with:
           labels: "Good first issue"
           issue-opened-msg: |

.github/workflows/issue-welcome-first-time.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@v5
 
       # Applies labels based on the .github/labeler.yml config
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/pr-auto-labeler.yml

@@ -34,7 +34,7 @@ jobs:
 
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@3b04099b21072562f07469c10deb182b24236ca9 # v46.0.3
+        uses: tj-actions/changed-files@0ff001de0805038ff3f118de4875002200057732 # v46.0.3
 
       - name: Checkout repository
         uses: actions/checkout@v5

.github/workflows/pr-kernel-security-analysis.yml

@@ -1,21 +1,54 @@
-on: pull_request_review
-name: Label approved pull requests
-
-permissions:
-  contents: read          # Required for checking changed files
-  pull-requests: write    # Required for labeling PRs
-  issues: write           # Required for adding/removing labels
+name: PR review labeler
+on:
+  workflow_run:
+    workflows: ["PR review listener"]
+    types: [completed]
 
 jobs:
-  labelWhenApproved:
-    if: ${{ github.repository_owner == 'armbian' }}
-    name: Label when approved
+  label:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+
     steps:
-    - name: Label when approved
-      uses: pullreminders/label-when-approved-action@master
-      env:
-        APPROVALS: "1"
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        ADD_LABEL: "Ready to merge"
-        REMOVE_LABEL: "Needs%20review"
+      - name: Download PR number artifact from upstream run
+        uses: actions/download-artifact@v6
+        with:
+          name: pr-number-${{ github.event.workflow_run.id }}   # same unique name
+          path: .
+          run-id: ${{ github.event.workflow_run.id }}           # ← CRITICAL: fetch from the upstream run
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: pr
+        run: echo "number=$(cat pr.txt)" >> $GITHUB_OUTPUT
+
+      - name: Label when approved
+        uses: j-fulbright/[email protected]
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          label: 'Ready to merge'
+          require_committers_approval: 'true'
+          remove_label_when_approval_missing: 'true'
+          comment: '✅ This PR has been reviewed and approved — all set for merge!'
+          pullRequestNumber: ${{ steps.pr.outputs.number }}
+
+      - name: Remove review-related labels
+        if: ${{ success() }}
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const issue_number = ${{ steps.pr.outputs.number }};
+            const labelsToRemove = ["Needs review", "Work in progress", "Backlog", "Can be closed?", "Help needed", "Needs Documentation"];
+
+            for (const name of labelsToRemove) {
+              try {
+                await github.rest.issues.removeLabel({ owner, repo, issue_number, name });
+                core.info(`Removed label "${name}"`);
+              } catch (e) {
+                core.warning(`Could not remove label "${name}": ${e.message}`);
+              }
+            }