uefi-only-build workflow (AsahiLinux/asahi-installer)

The uefi-only-build workflow from AsahiLinux/asahi-installer, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get run de-duplication, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: AsahiLinux/asahi-installer.github/workflows/uefi-only-build.yamlLicense MITView source

What it does

This is the uefi-only-build workflow from the AsahiLinux/asahi-installer repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: uefi-only-build

# Controls when the action will run.
on:
  # Triggers the workflow only on pull-requests when this file is changed.
  # Intended use is to manually trigger runs after updating the repository
  # variables `UEFI_DATE`, `UEFI_LINUX_TAG` or `UEFI_UBOOT_TAG`.
  pull_request:
    branches: [ main ]
    paths: [ .github/workflows/uefi-only-build.yaml ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  # Allow being called from other workflows to deploy the artifact.
  workflow_call:

jobs:
  uefi-only-boot-bin:
    runs-on: ubuntu-latest

    env:
      UEFI_ONLY_VERSION: uefi-only-${{ vars.UEFI_DATE }}-${{ vars.UEFI_LINUX_TAG }}

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Checkout linux
        uses: actions/checkout@v5
        with:
          repository: AsahiLinux/linux
          ref: ${{ vars.UEFI_LINUX_TAG }}
          path: linux
          sparse-checkout: 'arch/arm64/boot/dts/apple/'

      - name: Checkout u-boot
        uses: actions/checkout@v5
        with:
          repository: AsahiLinux/u-boot
          ref: ${{ vars.UEFI_UBOOT_TAG }}
          path: u-boot

      - name: Install aarch64-linux-gnu- toolchain
        run: |
          sudo apt-get update
          sudo apt-get install --no-install-recommends -y \
                               gcc-aarch64-linux-gnu \
                               libgnutls28-dev \
                               device-tree-compiler

      - name: Install aarch64-unknown-none-softfloat rust target
        run: |
          rustup target install aarch64-unknown-none-softfloat

      - name: Build
        run: |
          cd m1n1
          make -k -j2 ARCH=aarch64-linux-gnu- RELEASE=1

      - name: Update u-boot apple device trees
        run: |
          cp -f linux/arch/arm64/boot/dts/apple/*.dts \
                linux/arch/arm64/boot/dts/apple/*.dtsi \
                linux/arch/arm64/boot/dts/apple/*.h \
                u-boot/arch/arm/dts/

      - name: Build u-boot
        run: |
          cd u-boot
          make CROSS_COMPILE=aarch64-linux-gnu- apple_m1_defconfig
          make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm -k -j2

      - name: Create m1n1 uefi only boot.bin
        run: |
          mkdir -p out/esp/m1n1/
          gzip -k u-boot/u-boot-nodtb.bin
          cat m1n1/build/m1n1.bin \
              u-boot/arch/arm/dts/t60*.dtb \
              u-boot/arch/arm/dts/t81*.dtb \
              u-boot/u-boot-nodtb.bin.gz \
              > out/esp/m1n1/boot.bin
          cd out
          zip -r ${{ env.UEFI_ONLY_VERSION }}.zip esp

      - uses: actions/upload-artifact@v4
        with:
          name: uefi-only-boot.bin
          path: |
            out/${{ env.UEFI_ONLY_VERSION }}.zip

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: uefi-only-build
 
# Controls when the action will run.
on:
  # Triggers the workflow only on pull-requests when this file is changed.
  # Intended use is to manually trigger runs after updating the repository
  # variables `UEFI_DATE`, `UEFI_LINUX_TAG` or `UEFI_UBOOT_TAG`.
  pull_request:
    branches: [ main ]
    paths: [ .github/workflows/uefi-only-build.yaml ]
 
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  # Allow being called from other workflows to deploy the artifact.
  workflow_call:
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  uefi-only-boot-bin:
    timeout-minutes: 30
    runs-on: latchkey-small
 
    env:
      UEFI_ONLY_VERSION: uefi-only-${{ vars.UEFI_DATE }}-${{ vars.UEFI_LINUX_TAG }}
 
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          submodules: recursive
 
      - name: Checkout linux
        uses: actions/checkout@v5
        with:
          repository: AsahiLinux/linux
          ref: ${{ vars.UEFI_LINUX_TAG }}
          path: linux
          sparse-checkout: 'arch/arm64/boot/dts/apple/'
 
      - name: Checkout u-boot
        uses: actions/checkout@v5
        with:
          repository: AsahiLinux/u-boot
          ref: ${{ vars.UEFI_UBOOT_TAG }}
          path: u-boot
 
      - name: Install aarch64-linux-gnu- toolchain
        run: |
          sudo apt-get update
          sudo apt-get install --no-install-recommends -y \
                               gcc-aarch64-linux-gnu \
                               libgnutls28-dev \
                               device-tree-compiler
 
      - name: Install aarch64-unknown-none-softfloat rust target
        run: |
          rustup target install aarch64-unknown-none-softfloat
 
      - name: Build
        run: |
          cd m1n1
          make -k -j2 ARCH=aarch64-linux-gnu- RELEASE=1
 
      - name: Update u-boot apple device trees
        run: |
          cp -f linux/arch/arm64/boot/dts/apple/*.dts \
                linux/arch/arm64/boot/dts/apple/*.dtsi \
                linux/arch/arm64/boot/dts/apple/*.h \
                u-boot/arch/arm/dts/
 
      - name: Build u-boot
        run: |
          cd u-boot
          make CROSS_COMPILE=aarch64-linux-gnu- apple_m1_defconfig
          make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm -k -j2
 
      - name: Create m1n1 uefi only boot.bin
        run: |
          mkdir -p out/esp/m1n1/
          gzip -k u-boot/u-boot-nodtb.bin
          cat m1n1/build/m1n1.bin \
              u-boot/arch/arm/dts/t60*.dtb \
              u-boot/arch/arm/dts/t81*.dtb \
              u-boot/u-boot-nodtb.bin.gz \
              > out/esp/m1n1/boot.bin
          cd out
          zip -r ${{ env.UEFI_ONLY_VERSION }}.zip esp
 
      - uses: actions/upload-artifact@v4
        with:
          name: uefi-only-boot.bin
          path: |
            out/${{ env.UEFI_ONLY_VERSION }}.zip

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cancel superseded runs when a branch or PR gets a newer push.
Add a job timeout so a hung step cannot burn hours of runner time.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

Dependency installs

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/upload-artifact