feat(scanout): package kernel-bound module profiles

[wizzomafizzo]

Produce a distributable profile for the exact kernel/module pair built by Menu CI. This supplies Main's build-ID selection and the frontend's optional multi-profile release packaging without treating a Linux release string as a compatibility guarantee.

• Package kernel/module GNU build IDs, module SHA-256, kernel revision, configuration and symbol-table hashes, and matching module sources.
• Upload zaparoo-scanout.zip as the CI artifact instead of an unaccompanied .ko.
• Document pinned/Edge distribution behavior, profile installation, and the explicit device-qualification/release handoff.

Validation: generated a bundle from the existing pinned local kernel/module build and validated it with the frontend bundle checker. Actionlint, ShellCheck, and diff whitespace checks passed. Kernel/module source and existing build pins are unchanged; a fresh full kernel/Quartus build was not run.

Build provenance is not hardware qualification. Publication remains explicit after testing the exact running image and matched Main/Menu/frontend stack; this PR does not qualify new stock kernels or publish a release.

Companion PRs: frontend, main.

Summary by CodeRabbit

• New Features

  • Scanout kernel modules are now distributed in a ZIP bundle with matching kernel profiles and verification metadata.
  • The bundle is included in release builds when explicitly enabled.

• Reliability

  • Scanout is enabled only when the running kernel and module match a verified profile. If a match or verification is unavailable, the system retains the standard framebuffer.
  • Flat, legacy module installations no longer enable scanout.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 6a0fbed3-9283-4818-afab-708324645b3a

📥 Commits

Reviewing files that changed from the base of the PR and between debfb63 and 5814784.

📒 Files selected for processing (4)

• .github/workflows/ci_build.yml
• kernel/build-scanout.sh
• kernel/package-scanout.py
• kernel/scanout-slots/README.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The scanout build now creates a validated ZIP bundle containing the module and build metadata. CI uploads the bundle. Documentation describes exact-build profiles, profile matching, verification, and distribution requirements.

Changes

Scanout Bundle

Layer / File(s)	Summary
Validate and package the scanout build kernel/package-scanout.py, kernel/build-scanout.sh	The packager checks kernel release, module identity, vermagic, and GNU build IDs. It writes a ZIP containing the module, profile, provenance data, matching source files, and README. The build script invokes the packager.
Upload and document the bundle .github/workflows/ci_build.yml, kernel/scanout-slots/README.md	CI uploads the ZIP as zaparoo-scanout. The documentation describes exact-build profiles, module and kernel verification, bundle distribution, and retention of older tested profiles.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Build as build-scanout.sh
  participant Packager as package-scanout.py
  participant CI as CI artifact upload
  Build->>Packager: Kernel build directory, module, and output path
  Packager-->>Build: Validated ZIP bundle
  CI->>CI: Upload zaparoo-scanout.zip

Loading

Merge Risk: ⚪ Minimal · up to 58147

The bundle and CI artifact paths are consistent with the documented profile layout. No issue identified here prevents merging after normal checks.

Architecture Summary

Architecture risk: 🟡 Medium · up to 58147

The change affects 1 system.

Changed systems: kernel

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — kernel (service) was modified; 3 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in kernel/build-scanout.sh: After verifying the module’s vermagic and printing its checksum, the script now calls package-scanout.py with the kernel build directory and module, writing the package to $build_root/zaparoo-scanout.zip.
• observed — Modified behavior in kernel/package-scanout.py: Adds the script declaration, imports, and digest, which returns a file’s SHA-256 hex digest.
• observed — Modified behavior in kernel/package-scanout.py: Adds build_id, which reads readelf -n output and requires exactly one GNU build ID containing 16–64 bytes represented as lowercase hexadecimal pairs; otherwise it raises ValueError.
• observed — Modified behavior in kernel/package-scanout.py: Adds package, which checks the kernel release against the platform header, verifies the module’s revision and name, and requires exact vermagic release + ' SMP mod_unload ARMv7 p2v8'. It obtains kernel and module build IDs, then writes a ZIP with a profile, module, provenance JSON containing build and source hashes, matching source files, and README. It creates the output directory as needed and prints both build IDs.

Reliability and maintainability

• inferred — Risk-relevant change factors for kernel: blast_radius_1; direct_dependents_1

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: packaging kernel-bound scanout module profiles.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}