ci(image): patch upstream OpenWRT 25.12 Image Builder rootfs.mk bug

Run 25749740914 failed in Image Builder's prepare_rootfs step with a
bash syntax error in code we didn't write. Root-caused upstream: in
include/rootfs.mk on openwrt-25.12 and main both, the recipe wraps
opkg-only fixups in `if [ -z "$(CONFIG_USE_APK)" ]; then ... fi`,
where the body is two `$(if ...)` substitutions. Under apk builds
(CONFIG_USE_APK=y) the `then` branch is never executed at runtime,
but bash still has to *parse* it. In Image Builder context (IB=y)
the awk substitution collapses to empty, and bash sees the rendered
recipe as:

    if [ -z "y" ]; then  ; sed -i "..." ; fi

— an empty `then` body before `;` is a syntax error. Same broken
recipe in openwrt-25.12 and main; no upstream issue or PR reported.
Affects any 25.12.x Image Builder consumer with SOURCE_DATE_EPOCH
set (Image Builder appears to set it automatically).

Verified our side is clean: the apk install reported "OK: 67.4 MiB
in 171 packages", which means our DEPENDS:= against the 25.12.3
feed resolves correctly. The crash is downstream of every line of
our code.

Workaround: new `Patch Image Builder rootfs.mk` step inserts a `: ;`
no-op so the `then` block has at least one parseable statement
regardless of which Make substitutions collapse. Patch is local to
this CI run's Image Builder copy; nothing leaves the runner; no
fork of openwrt/openwrt. A grep-after-sed fails the build if
upstream ever changes the recipe shape so we notice instead of
silently doing nothing. Also drops `yubikey-personalization` from
the dep-list comment in the prior staging step, in line with the
WebAuthn-only auth model that landed in 6cc71b7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: framefilter

.github/workflows/package.yml

@@ -246,13 +246,45 @@ jobs:
           # picked up as a local repo; `make image` indexes them before
           # resolving PACKAGES. Transitive deps of bubbleui (nginx-ssl,
           # nftables, wireguard-tools, dnsmasq-full, https-dns-proxy,
-          # yubikey-personalization, ca-bundle, px5g-mbedtls — see
-          # package/bubbleui/Makefile) come from the upstream 25.12.3
-          # feed, also indexed automatically by Image Builder.
+          # ca-bundle, px5g-mbedtls — see package/bubbleui/Makefile)
+          # come from the upstream 25.12.3 feed, also indexed
+          # automatically by Image Builder.
           mkdir -p "$IB/packages"
           cp bubbleui-pkg/bubbleui-*.apk "$IB/packages/"
           ls -la "$IB/packages/"
 
+      - name: Patch Image Builder rootfs.mk (upstream OpenWRT 25.12 bug)
+        env:
+          IB: ${{ steps.ib.outputs.ib_dir }}
+        run: |
+          set -e
+          # OpenWRT 25.12.x Image Builder's prepare_rootfs recipe in
+          # include/rootfs.mk wraps opkg-only fixups inside:
+          #
+          #   if [ -z "$(CONFIG_USE_APK)" ]; then \
+          #       $(if $(IB),,awk -i inplace ...) ; \
+          #       $(if $(SOURCE_DATE_EPOCH),sed -i ... ;) \
+          #   fi;
+          #
+          # Under apk builds (CONFIG_USE_APK=y) the `then` branch is
+          # never executed at runtime, but bash still has to *parse* it.
+          # In Image Builder context (IB=y) the awk substitution
+          # collapses to empty, leaving `then  ; sed ... ; fi` — bash
+          # refuses an empty body before the `;` and the whole rootfs
+          # prepare step dies with a syntax error. Same recipe on
+          # `openwrt-25.12` and `main` of openwrt/openwrt as of
+          # 2026-05-12; no upstream fix.
+          #
+          # Workaround: insert a `: ;` no-op so the `then` block parses
+          # regardless of which Make substitutions are empty. Patch is
+          # local to this CI run's Image Builder copy. The grep below
+          # fails the build if upstream ever changes the recipe shape,
+          # so we notice instead of silently doing nothing.
+          target="$IB/include/rootfs.mk"
+          test -f "$target"
+          sed -i 's#if \[ -z "$(CONFIG_USE_APK)" \]; then \\#if [ -z "$(CONFIG_USE_APK)" ]; then : ; \\#' "$target"
+          grep -F 'if [ -z "$(CONFIG_USE_APK)" ]; then : ;' "$target" >/dev/null
+
       - name: Build firmware image
         env:
           IB: ${{ steps.ib.outputs.ib_dir }}