ci/nightly: SHA-gate cron, publish dated nightly-* releases, BUILD_ID env

[widgetii]

Summary

PR-Bld-A of three in the mirror of OpenIPC/firmware's nightly redesign (firmware-side PRs OpenIPC/firmware#2111-#2129). Touches only master.yml; no on-device firmware changes.

• Preflight SHA gate — new preflight job reads sha= from the rolling nightly release body. Schedule events skip the matrix when HEAD matches; PRs and workflow_dispatch always build. Mirrors ci/nightly: SHA-gate cron, publish dated nightly-* releases, BUILD_ID in os-release firmware#2111.
• Three release tags per build:
  • nightly-YYYYMMDD-<short> (prerelease, content-addressable, unit of history — 90-day retention via PR-Bld-B).
  • nightly (rolling channel pointer, body carries sha/short/built_at).
  • latest (legacy alias, kept one cycle so existing sysupgrade clients hitting the old hardcoded URL don't break).
• BUILD_ID / BUILD_SHA / BUILD_PLATFORM env at the job level. firmware's rootfs_script.sh (reused by builder.sh via its clone of firmware) picks BUILD_ID/BUILD_SHA into /etc/os-release automatically. BUILD_PLATFORM is set to the matrix entry (e.g. gk7205v200_fpv_caddx-fly) and is forward-compatible with Phase 3 of the mirror (model-aware platform key).
• Retry budget around bash builder.sh — 30 60 120 300 600 1200 ladder, matches the firmware-side hardening that addressed transient toolchain/CDN flakes.
• Telegram caption leads with Build: <build_id>. Workflow-level env: TAG_NAME: latest removed.

Subsequent PRs

• PR-Bld-B — manifest aggregator + 90-build retention sweep; new manifest.yml, cleanup.yml, .github/scripts/enrich_manifest.py. Publishes manifest.{json,flat} to a gh-pages branch (one-time setup; mirrors firmware's at https://openipc.github.io/builder/manifest.{json,flat}).
• PR-Bld-C — build-one.yml learns a commit input + bisect tag namespace, mirroring ci/build-one: accept arbitrary commit input; publish to nightly-bisect-* tag firmware#2116.

Test plan

• CI on this PR passes the YAML parse.
• After merge, manual workflow_dispatch produces a dated nightly-YYYYMMDD-<short> release with both sha= and built_at= in the body, and updates the rolling nightly and legacy latest.
• Next scheduled cron with no new commits takes the skip branch — only Preflight job appears, ~10s.
• Telegram caption on the next published build leads with Build: nightly-….

See also

• Companion plan at ~/.claude/plans/mirror-nightly-redesign-to-builder.md (in the maintainer's local plan dir).
• All firmware-side PRs the design has been battle-tested against: ci/nightly: SHA-gate cron, publish dated nightly-* releases, BUILD_ID in os-release firmware#2111-#2129.

🤖 Generated with Claude Code