Linux: pin upstream v7.3-rc4, build it with amdxdna in-tree, keep it current

.github/workflows/bump-linux.yml

@@ -0,0 +1,95 @@
+# Copyright 2026 bong-water-water-bong
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Keep third_party/linux on the newest upstream torvalds/linux tag (release
+# or -rc; docs/kernel.md): when a new tag appears, open a PR here moving the
+# submodule to it. GitHub-hosted CI cannot boot it; build with
+# scripts/build-kernel.sh, install on Strix Halo and rerun the hardware tests
+# before merging.
+#
+# Uses the secret HRX_BUMP_TOKEN (Contents and Pull requests read/write on
+# 1bit-MONSTER/engine): a PR opened with the default GITHUB_TOKEN would not
+# start CI.
+name: bump-linux
+
+on:
+  schedule:
+    - cron: "17 7 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: bump-linux
+  cancel-in-progress: false
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require the token
+        env:
+          HRX_BUMP_TOKEN: ${{ secrets.HRX_BUMP_TOKEN }}
+        run: |
+          if [ -z "$HRX_BUMP_TOKEN" ]; then
+            echo "::error::secret HRX_BUMP_TOKEN is not set (see the header of this workflow)"
+            exit 1
+          fi
+
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.HRX_BUMP_TOKEN }}
+
+      - name: Compare with the newest upstream tag
+        id: pins
+        run: |
+          set -euo pipefail
+          # Newest v* tag by version order (v7.3 sorts after v7.3-rc4).
+          tag=$(git ls-remote --tags --refs https://github.com/torvalds/linux.git 'v*' \
+                  | awk '{sub("refs/tags/","",$2); print $2}' \
+                  | sed -E 's/^(v[0-9]+\.[0-9]+)$/\1-rc99/' | sort -V | tail -1 | sed 's/-rc99$//')
+          upstream=$(git ls-remote https://github.com/torvalds/linux.git "refs/tags/${tag}^{}" | awk '{print $1}')
+          ours=$(git ls-tree HEAD third_party/linux | awk '{print $3}')
+          echo "upstream $tag = $upstream, ours $ours"
+          {
+            echo "tag=$tag"; echo "upstream=$upstream"; echo "ours=$ours"
+            if [ "$upstream" = "$ours" ]; then echo "changed=false"; else echo "changed=true"; fi
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Open the bump PR
+        if: steps.pins.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.HRX_BUMP_TOKEN }}
+          TAG: ${{ steps.pins.outputs.tag }}
+          UPSTREAM: ${{ steps.pins.outputs.upstream }}
+          OURS: ${{ steps.pins.outputs.ours }}
+        run: |
+          set -euo pipefail
+          branch="bump-linux/${TAG}"
+          if git ls-remote --exit-code origin "refs/heads/$branch" > /dev/null; then
+            echo "$branch already exists"; exit 0
+          fi
+          git config user.name "linux-bump"
+          git config user.email "linux-bump@users.noreply.github.com"
+          git switch -c "$branch"
+          git update-index --cacheinfo "160000,$UPSTREAM,third_party/linux"
+          git commit -q -m "Bump Linux: torvalds/linux ${TAG} (${UPSTREAM:0:12})"
+          git push -q origin "$branch"
+          gh pr create --base main --head "$branch" \
+            --title "Bump Linux: ${TAG}" \
+            --body "Moves third_party/linux from \`${OURS:0:12}\` to upstream tag \`${TAG}\` (\`${UPSTREAM:0:12}\`).
+
+          CI here cannot boot a kernel. Before merging: \`scripts/build-kernel.sh <out>\`, install the linux-image/linux-headers packages on Strix Halo (docs/kernel.md), reboot, and rerun tests/npu_lane_e2e.sh and the Lemonade e2e tests."

.gitmodules

@@ -35,4 +35,9 @@
 	path = third_party/zinc
 	url = https://github.com/zolotukhin/zinc.git
 	branch = main
+# Linux kernel (docs/kernel.md): upstream torvalds/linux at a release tag, built
+# by scripts/build-kernel.sh; .github/workflows/bump-linux.yml keeps it current.
+[submodule "third_party/linux"]
+	path = third_party/linux
+	url = https://github.com/torvalds/linux.git
 	shallow = true