From 845b6ac45900d33f55e8a53f51c5323dcac8a41d Mon Sep 17 00:00:00 2001
From: Josef Schlehofer <pepe.schlehofer@gmail.com>
Date: Sun, 16 Aug 2026 12:23:02 +0200
Subject: [PATCH] ci: fix DOWNLOAD_FILE expansion for rootfs builds

f6d7df9 ("ci: select only correct targz for rootfs build") builds the
rootfs archive name with ${TARGET//\//-}, but the heredoc generating
the build args is single-quoted, so the substitution never happens.
The literal openwrt-${TARGET_TAG}-rootfs.tar.gz then reaches setup.sh.

grep finds no match, leaving file_name empty and causing the
verification to check the entire sha256sums file. Every rootfs job
has since failed with "12414 listed files could not be read".

Expand the target tag in the shell before generating the args, while
keeping DOWNLOAD_FILE as a pattern: release branches embed the
version and revision in the filename, and malta/be has a -default-
profile infix. The pattern must also exclude targz- image variants.

Verified to match exactly one file for all eight rootfs targets on
both snapshots and releases/24.10-SNAPSHOT.

Make setup.sh fail loudly when the pattern matches nothing instead of
producing the misleading checksum error.
---
 .github/workflows/containers.yml | 10 +++++-----
 setup.sh                         |  5 +++++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml
index e0bc962..f1b37d6 100644
--- a/.github/workflows/containers.yml
+++ b/.github/workflows/containers.yml
@@ -470,10 +470,10 @@ jobs:
       - name: Generate build args
         id: build_args
         run: |
-          echo 'args<<EOF
-            TARGET=${{ matrix.target }}
-            TARGET_TAG="${TARGET//\//-}"
-            DOWNLOAD_FILE=openwrt-${TARGET_TAG}-rootfs.tar.gz
+          TARGET='${{ matrix.target }}'
+          echo "args<<EOF
+            TARGET=$TARGET
+            DOWNLOAD_FILE=openwrt-.*${TARGET//\//-}-\(default-\)\?rootfs.tar.gz
             WORKDIR=/
             USER=root
             VERSION_PATH=${{ needs.generate_matrix.outputs.version_path }}
@@ -481,7 +481,7 @@ jobs:
             CMD=ash
             FILE_HOST=${{ needs.generate_matrix.outputs.file_host }}
             RUN_SETUP=${{ needs.generate_matrix.outputs.run_setup }}
-          EOF' >> $GITHUB_OUTPUT
+          EOF" >> $GITHUB_OUTPUT
 
       - name: Build
         id: build
diff --git a/setup.sh b/setup.sh
index f30022e..4945bb9 100644
--- a/setup.sh
+++ b/setup.sh
@@ -16,6 +16,11 @@ gpg --with-fingerprint --verify sha256sums.asc sha256sums
 # determine archive name
 file_name="$(grep "$DOWNLOAD_FILE" sha256sums | cut -d "*" -f 2)"
 
+if [ -z "$file_name" ]; then
+	echo "No file matching '$DOWNLOAD_FILE' found in sha256sums" >&2
+	exit 1
+fi
+
 # download imagebuilder/sdk archive
 wget -nv "$FILE_HOST/$DOWNLOAD_PATH/$file_name"