CI: migrate each workflow to use reusable workflow from dedicated repo

Migrate each workflow to use reusable workflow from dedicated repo to
skip pushing CI related commits to openwrt and better track versioning
of CI workflow.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 38cc09165fd11caa9599d960280bd91dbaba7a62)

8 files changed, 22 insertions, 670 deletions

diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 72f39a729b..f54695986d 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -16,53 +16,4 @@ jobs:
       contents: read
       packages: read
       actions: write
-    uses: ./.github/workflows/build.yml
-    with:
-      container_name: toolchain
-      target: x86
-      subtarget: 64
-      build_full: true
-      include_feeds: true
-      use_ccache_cache: false
-      coverity_compiler_template_list: >-
-        x86_64-openwrt-linux-gcc
-        x86_64-openwrt-linux-musl-gcc
-      #  qosify fails to build with cov-build
-      coverity_check_packages: >-
-        cgi-io
-        dnsmasq
-        dropbear
-        firewall
-        fstools
-        fwtool
-        iwinfo
-        jsonfilter
-        libnl-tiny
-        libubox
-        mtd
-        netifd
-        odhcp6c
-        odhcpd
-        opkg
-        procd
-        relayd
-        rpcd
-        swconfig
-        ubox
-        ubus
-        ucert
-        uci
-        uclient
-        ucode
-        ugps
-        uhttpd
-        umbim
-        umdns
-        unetd
-        uqmi
-        urngd
-        usbmode
-        usign
-        usteer
-        ustp
-        ustream-ssl
+    uses: openwrt/actions-shared-workflows/.github/workflows/coverity.yml@main
diff --git a/.github/workflows/kernel.yml b/.github/workflows/kernel.yml
index 3aa46f5cd7..87b8a14293 100644
--- a/.github/workflows/kernel.yml
+++ b/.github/workflows/kernel.yml
@@ -28,128 +28,13 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  determine_targets:
-    name: Set targets
-    runs-on: ubuntu-latest
-    outputs:
-      targets_subtargets: ${{ steps.find_targets.outputs.targets_subtargets }}
-      targets: ${{ steps.find_targets.outputs.targets }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 2
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@v35
-
-      - name: Set targets
-        id: find_targets
-        run: |
-          ALL_TARGETS="$(perl ./scripts/dump-target-info.pl targets 2>/dev/null)"
-          CHANGED_FILES="$(echo ${{ steps.changed-files.outputs.all_changed_files }} | tr ' ' '\n')"
-
-          TARGETS_SUBTARGETS="$(echo "$ALL_TARGETS" | sort -u -t '/' -k1 | awk '{ print $1 }')"
-          TARGETS="$(echo "$ALL_TARGETS" | sort -u -t '/' -k1,1 | awk '{ print $1 }')"
-
-          # On testing non-specific target, skip testing each subtarget if we are testing pr
-          if [ ${{ github.event_name }} != 'push' ]; then
-            if echo "$CHANGED_FILES" | grep -v -q target/linux ||
-              echo "$CHANGED_FILES" | grep -q target/linux/generic; then
-              TARGETS_SUBTARGETS=$TARGETS
-            fi
-          fi
-
-          JSON_TARGETS_SUBTARGETS='['
-          FIRST=1
-          for TARGET in $TARGETS_SUBTARGETS; do
-            if echo "$CHANGED_FILES" | grep -v -q target/linux ||
-              echo "$CHANGED_FILES" | grep -q target/linux/generic ||
-              echo "$CHANGED_FILES" | grep -q $(echo $TARGET | cut -d "/" -f 1); then
-              TUPLE='{"target":"'"$(echo $TARGET | cut -d "/" -f 1)"'","subtarget":"'"$(echo $TARGET | cut -d "/" -f 2)"'"}'
-              [[ $FIRST -ne 1 ]] && JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS"','
-              JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS""$TUPLE"
-              FIRST=0
-            fi
-          done
-          JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS"']'
-
-          JSON_TARGETS='['
-          FIRST=1
-          for TARGET in $TARGETS; do
-            if echo "$CHANGED_FILES" | grep -v -q target/linux ||
-              echo "$CHANGED_FILES" | grep -q target/linux/generic ||
-              echo "$CHANGED_FILES" | grep -q $(echo $TARGET | cut -d "/" -f 1); then
-              TUPLE='{"target":"'"$(echo $TARGET | cut -d "/" -f 1)"'","subtarget":"'"$(echo $TARGET | cut -d "/" -f 2)"'"}'
-              [[ $FIRST -ne 1 ]] && JSON_TARGETS="$JSON_TARGETS"','
-              JSON_TARGETS="$JSON_TARGETS""$TUPLE"
-              FIRST=0
-            fi
-          done
-          JSON_TARGETS="$JSON_TARGETS"']'
-
-          echo -e "\n---- targets to build ----\n"
-          echo "$JSON_TARGETS_SUBTARGETS"
-          echo -e "\n---- targets to build ----\n"
-
-          echo -e "\n---- targets to check patch ----\n"
-          echo "$JSON_TARGETS"
-          echo -e "\n---- targets to check patch ----\n"
-
-          echo "targets_subtargets=$JSON_TARGETS_SUBTARGETS" >> $GITHUB_OUTPUT
-          echo "targets=$JSON_TARGETS" >> $GITHUB_OUTPUT
-
-  build:
-    name: Build Kernel with external toolchain
-    needs: determine_targets
+  build-kernels:
+    name: Build all affected Kernels
     permissions:
       contents: read
       packages: read
       actions: write
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.determine_targets.outputs.targets_subtargets)}}
-    uses: ./.github/workflows/build.yml
-    with:
-      container_name: toolchain
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      build_kernel: true
-      build_all_kmods: true
-      upload_ccache_cache: ${{ github.repository_owner == 'openwrt' }}
-
-  check-kernel-patches:
-    name: Check Kernel patches
-    needs: determine_targets
-    permissions:
-      contents: read
-      packages: read
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.determine_targets.outputs.targets)}}
-    uses: ./.github/workflows/check-kernel-patches.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-
-  upload-ccache-cache-in-s3:
-    if: github.event_name == 'push' && github.repository_owner == 'openwrt'
-    name: Upload ccache cache to s3
-    needs: [determine_targets, build]
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.determine_targets.outputs.targets_subtargets)}}
     secrets:
       s3_access_key: ${{ secrets.GCS_S3_ACCESS_KEY }}
       s3_secret_key: ${{ secrets.GCS_S3_SECRET_KEY }}
-    uses: ./.github/workflows/upload-file-s3.yml
-    with:
-      endpoint: https://storage.googleapis.com
-      bucket: openwrt-ci-cache
-      download_id: ${{ matrix.target }}-${{ matrix.subtarget }}-ccache-cache
-      filename: ccache-kernel-${{ matrix.target }}-${{ matrix.subtarget }}.tar
+    uses: openwrt/actions-shared-workflows/.github/workflows/kernel.yml@main
diff --git a/.github/workflows/label-kernel.yml b/.github/workflows/label-kernel.yml
index eab79cf0c0..655d7d6ff3 100644
--- a/.github/workflows/label-kernel.yml
+++ b/.github/workflows/label-kernel.yml
@@ -7,123 +7,10 @@ on:
       - labeled
 
 jobs:
-  set_target:
-    if: startsWith(github.event.label.name, 'ci:kernel:')
-    name: Set target
-    runs-on: ubuntu-latest
-    outputs:
-      targets_subtargets: ${{ steps.set_target.outputs.targets_subtargets }}
-      targets: ${{ steps.set_target.outputs.targets }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Parse label
-        id: parse_label
-        env:
-          CI_EVENT_LABEL_NAME: ${{ github.event.label.name }}
-        run: |
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/ci:kernel:\([^:]*\):\([^:]*\):*\([^:]*\)$/target=\1/p' | tee --append $GITHUB_OUTPUT
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/ci:kernel:\([^:]*\):\([^:]*\):*\([^:]*\)$/subtarget=\2/p' | tee --append $GITHUB_OUTPUT
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/ci:kernel:\([^:]*\):\([^:]*\):*\([^:]*\)$/testing=\3/p' | tee --append $GITHUB_OUTPUT
-
-      - name: Set targets
-        id: set_target
-        run: |
-          ALL_TARGETS="$(perl ./scripts/dump-target-info.pl kernels 2>/dev/null)"
-
-          TARGETS_SUBTARGETS="$(echo "$ALL_TARGETS" | sort -u -t '/' -k1)"
-          TARGETS="$(echo "$ALL_TARGETS" | sort -u -t '/' -k1,1)"
-
-          [ "${{ steps.parse_label.outputs.subtarget }}" = "first" ] && TARGETS_SUBTARGETS=$TARGETS
-
-          JSON_TARGETS_SUBTARGETS='['
-          FIRST=1
-          while IFS= read -r line; do
-            TARGET_SUBTARGET=$(echo $line | cut -d " " -f 1)
-            TARGET=$(echo $TARGET_SUBTARGET | cut -d "/" -f 1)
-            SUBTARGET=$(echo $TARGET_SUBTARGET | cut -d "/" -f 2)
-
-            [ "${{ steps.parse_label.outputs.target }}" != "all" ] && [ "${{ steps.parse_label.outputs.target }}" != "$TARGET" ] && continue
-            [ "${{ steps.parse_label.outputs.subtarget }}" != "all" ] && [ "${{ steps.parse_label.outputs.subtarget }}" != "first" ] &&
-              [ "${{ steps.parse_label.outputs.subtarget }}" != $SUBTARGET ] && continue
-            if [ "${{ steps.parse_label.outputs.testing }}" = "testing" ]; then
-              TESTING_KERNEL_VER=$(echo $line | cut -d " " -f 3)
-              [ -z "$TESTING_KERNEL_VER" ] && continue
-            fi
-
-            TUPLE='{"target":"'"$TARGET"'","subtarget":"'"$SUBTARGET"'","testing":"'"$TESTING_KERNEL_VER"'"}'
-            [[ $FIRST -ne 1 ]] && JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS"','
-            JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS""$TUPLE"
-            FIRST=0
-          done <<< "$TARGETS_SUBTARGETS"
-          JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS"']'
-
-          JSON_TARGETS='['
-          FIRST=1
-          while IFS= read -r line; do
-            TARGET_SUBTARGET=$(echo $line | cut -d " " -f 1)
-            TARGET=$(echo $TARGET_SUBTARGET | cut -d "/" -f 1)
-            SUBTARGET=$(echo $TARGET_SUBTARGET | cut -d "/" -f 2)
-
-            [ "${{ steps.parse_label.outputs.target }}" != "all" ] && [ "${{ steps.parse_label.outputs.target }}" != $TARGET ] && continue
-            if [ "${{ steps.parse_label.outputs.testing }}" = "testing" ]; then
-              TESTING_KERNEL_VER=$(echo $line | cut -d " " -f 3)
-              [ -z "$TESTING_KERNEL_VER" ] && continue
-            fi
-
-            TUPLE='{"target":"'"$TARGET"'","subtarget":"'"$SUBTARGET"'","testing":"'"$TESTING_KERNEL_VER"'"}'
-            [[ $FIRST -ne 1 ]] && JSON_TARGETS="$JSON_TARGETS"','
-            JSON_TARGETS="$JSON_TARGETS""$TUPLE"
-            FIRST=0
-          done <<< "$TARGETS"
-          JSON_TARGETS="$JSON_TARGETS"']'
-
-          echo -e "\n---- targets to build ----\n"
-          echo "$JSON_TARGETS_SUBTARGETS"
-          echo -e "\n---- targets to build ----\n"
-
-          echo -e "\n---- targets to check patch ----\n"
-          echo "$JSON_TARGETS"
-          echo -e "\n---- targets to check patch ----\n"
-
-          echo "targets_subtargets=$JSON_TARGETS_SUBTARGETS" >> $GITHUB_OUTPUT
-          echo "targets=$JSON_TARGETS" >> $GITHUB_OUTPUT
-
-  build_kernel:
-    name: Build Kernel with external toolchain
-    needs: set_target
-    permissions:
-      contents: read
-      packages: read
-      actions: write
-    uses: ./.github/workflows/build.yml
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.set_target.outputs.targets_subtargets)}}
-    with:
-      container_name: toolchain
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      testing: ${{ matrix.testing != '' && true }}
-      build_kernel: true
-      build_all_kmods: true
-
-  check-kernel-patches:
-    name: Check Kernel patches
-    needs: set_target
+  build-kernels-label:
+    name: Build all affected Kernels from defined label
     permissions:
       contents: read
       packages: read
       actions: write
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.set_target.outputs.targets)}}
-    uses: ./.github/workflows/check-kernel-patches.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      testing: ${{ matrix.testing != '' && true }}
+    uses: openwrt/actions-shared-workflows/.github/workflows/label-kernel.yml@main
diff --git a/.github/workflows/label-target.yml b/.github/workflows/label-target.yml
index 610aab026a..989ee9fcb4 100644
--- a/.github/workflows/label-target.yml
+++ b/.github/workflows/label-target.yml
@@ -7,36 +7,10 @@ on:
       - labeled
 
 jobs:
-  set_target:
-    if: startsWith(github.event.label.name, 'ci:target:')
-    name: Set target
-    runs-on: ubuntu-latest
-    outputs:
-      target: ${{ steps.set_target.outputs.target }}
-      subtarget: ${{ steps.set_target.outputs.subtarget }}
-
-    steps:
-      - name: Set target
-        id: set_target
-        env:
-          CI_EVENT_LABEL_NAME: ${{ github.event.label.name }}
-        run: |
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/.*:\(.*\):\(.*\)$/target=\1/p' | tee --append $GITHUB_OUTPUT
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/.*:\(.*\):\(.*\)$/subtarget=\2/p' | tee --append $GITHUB_OUTPUT
-
-  build_target:
-    name: Build target
-    needs: set_target
+  build-target-label:
+    name: Build target from defined label
     permissions:
       contents: read
       packages: read
       actions: write
-    uses: ./.github/workflows/build.yml
-    with:
-      container_name: toolchain
-      target: ${{ needs.set_target.outputs.target }}
-      subtarget: ${{ needs.set_target.outputs.subtarget }}
-      build_full: true
-      build_all_kmods: true
-      build_all_boards: true
-      build_all_modules: true
+    uses: openwrt/actions-shared-workflows/.github/workflows/label-target.yml@main
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index fe2898cacd..07621dcb4a 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -3,7 +3,6 @@ name: Build all core packages
 on:
   pull_request:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/packages.yml'
       - 'config/**'
       - 'include/**'
@@ -12,7 +11,6 @@ on:
       - 'toolchain/**'
   push:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/packages.yml'
       - 'config/**'
       - 'include/**'
@@ -30,51 +28,13 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  build:
-    name: Build Packages with external toolchain
+  build-packages:
+    name: Build all core packages for selected target
     permissions:
       contents: read
       packages: read
       actions: write
-    strategy:
-      fail-fast: False
-      matrix:
-        include:
-          - target: malta
-            subtarget: be
-          - target: x86
-            subtarget: 64
-    uses: ./.github/workflows/build.yml
-    with:
-      container_name: toolchain
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      build_kernel: true
-      build_all_kmods: true
-      build_all_modules: true
-      build_full: true
-      ccache_type: packages
-      upload_ccache_cache: ${{ github.repository_owner == 'openwrt' }}
-
-  upload-ccache-cache-in-s3:
-    if: github.event_name == 'push' && github.repository_owner == 'openwrt'
-    name: Upload ccache cache to s3
-    needs: build
-    strategy:
-       fail-fast: False
-       matrix:
-        include:
-          - target: malta
-            subtarget: be
-          - target: x86
-            subtarget: 64
     secrets:
       s3_access_key: ${{ secrets.GCS_S3_ACCESS_KEY }}
       s3_secret_key: ${{ secrets.GCS_S3_SECRET_KEY }}
-    uses: ./.github/workflows/upload-file-s3.yml
-    with:
-      endpoint: https://storage.googleapis.com
-      bucket: openwrt-ci-cache
-      download_id: ${{ matrix.target }}-${{ matrix.subtarget }}-ccache-cache
-      filename: ccache-packages-${{ matrix.target }}-${{ matrix.subtarget }}.tar
-
+    uses: openwrt/actions-shared-workflows/.github/workflows/packages.yml@main
diff --git a/.github/workflows/push-containers.yml b/.github/workflows/push-containers.yml
index 04a9b8d8e9..74f534d57a 100644
--- a/.github/workflows/push-containers.yml
+++ b/.github/workflows/push-containers.yml
@@ -6,13 +6,8 @@ on:
       - 'include/version.mk'
       - 'include/cmake.mk'
       - 'tools/**'
-      - '.github/workflows/build-tools.yml'
       - '.github/workflows/push-containers.yml'
-      - '.github/workflows/Dockerfile.tools'
       - 'toolchain/**'
-      - '.github/workflows/build.yml'
-      - '.github/workflows/toolchain.yml'
-      - '.github/workflows/Dockerfile.toolchain'
     branches-ignore:
       - master
 
@@ -24,198 +19,10 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  determine-container-info:
-    name: Determine needed info to push containers
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    runs-on: ubuntu-latest
-    outputs:
-      owner-lc: ${{ steps.generate-owner-lc.outputs.owner-lc }}
-      container-tag: ${{ steps.determine-container-tag.outputs.container-tag }}
-
-    steps:
-      - name: Set lower case owner name
-        id: generate-owner-lc
-        env:
-          OWNER: ${{ github.repository_owner }}
-        run: |
-          echo "owner-lc=${OWNER,,}" >> "$GITHUB_OUTPUT"
-
-      # Per branch tools container tag
-      # By default stick to latest
-      # For official test targetting openwrt stable branch
-      # Get the branch or parse the tag and push dedicated tools containers
-      # Any branch that will match this pattern openwrt-[0-9][0-9].[0-9][0-9]
-      # will refresh the tools container with the matching tag.
-      # (example branch openwrt-22.03 -> tools:openwrt-22.03)
-      # (example branch openwrt-22.03-test -> tools:openwrt-22.03)
-      - name: Determine tools container tag
-        id: determine-container-tag
-        run: |
-          CONTAINER_TAG=latest
-
-          if [ ${{ github.ref_type }} == "branch" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E 'openwrt-[0-9][0-9]\.[0-9][0-9]'; then
-              CONTAINER_TAG="$(echo ${{ github.ref_name }} | sed 's/^\(openwrt-[0-9][0-9]\.[0-9][0-9]\).*/\1/')"
-            fi
-          elif [ ${{ github.ref_type }} == "tag" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E 'v[0-9][0-9]\.[0-9][0-9]\..+'; then
-              CONTAINER_TAG=openwrt-"$(echo ${{ github.ref_name }} | sed 's/v\([0-9][0-9]\.[0-9][0-9]\)\..\+/\1/')"
-            fi
-          fi
-
-          echo "Container tag to push for tools and toolchain is $CONTAINER_TAG"
-          echo "container-tag=$CONTAINER_TAG" >> "$GITHUB_OUTPUT"
-
-  build-linux-buildbot:
-    name: Build tools with buildbot container
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    uses: ./.github/workflows/build-tools.yml
-    with:
-      generate_prebuilt_artifacts: true
-
-  push-tools-container:
-    needs: [ determine-container-info, build-linux-buildbot ]
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    name: Push prebuilt tools container
-    runs-on: ubuntu-latest
-
+  build-push-containers:
+    name: Build and Push all prebuilt containers
     permissions:
       contents: read
       packages: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: 'openwrt'
-
-      - name: Download prebuilt tools from build job
-        uses: actions/download-artifact@v3
-        with:
-          name: linux-buildbot-prebuilt-tools
-          path: openwrt
-
-      - name: Extract prebuild tools
-        working-directory: openwrt
-        run: tar -xf tools.tar
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v3
-        with:
-          context: openwrt
-          push: true
-          tags: ghcr.io/${{ needs.determine-container-info.outputs.owner-lc }}/tools:${{ needs.determine-container-info.outputs.container-tag }}
-          file: openwrt/.github/workflows/Dockerfile.tools
-
-  determine-targets:
-    name: Set targets
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    runs-on: ubuntu-latest
-    outputs:
-      target: ${{ steps.find_targets.outputs.target }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set targets
-        id: find_targets
-        run: |
-          export TARGETS="$(perl ./scripts/dump-target-info.pl targets 2>/dev/null \
-            | awk '{ print $1 }')"
-
-          JSON='['
-          FIRST=1
-          for TARGET in $TARGETS; do
-            TUPLE='{"target":"'"$(echo $TARGET | cut -d "/" -f 1)"'","subtarget":"'"$(echo $TARGET | cut -d "/" -f 2)"'"}'
-            [[ $FIRST -ne 1 ]] && JSON="$JSON"','
-            JSON="$JSON""$TUPLE"
-            FIRST=0
-          done
-          JSON="$JSON"']'
-
-          echo -e "\n---- targets ----\n"
-          echo "$JSON"
-          echo -e "\n---- targets ----\n"
-
-          echo "target=$JSON" >> $GITHUB_OUTPUT
-
-  build:
-    name: Build Target Toolchain
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    needs: [ determine-targets, push-tools-container ]
-    permissions:
-      contents: read
-      packages: read
       actions: write
-    strategy:
-      fail-fast: False
-      matrix:
-        include: ${{fromJson(needs.determine-targets.outputs.target)}}
-    uses: ./.github/workflows/build.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      build_toolchain: true
-      build_external_toolchain: true
-      upload_external_toolchain: true
-
-  push-toolchain-container:
-    name: Push Target Toolchain container
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    needs: [ determine-container-info, determine-targets, build ]
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: False
-      matrix:
-        include: ${{fromJson(needs.determine-targets.outputs.target)}}
-
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: 'openwrt'
-
-      - name: Download external toolchain from build job
-        uses: actions/download-artifact@v3
-        with:
-          name: ${{ matrix.target }}-${{ matrix.subtarget }}-external-toolchain
-          path: openwrt
-
-      - name: Find external toolchain name
-        id: get-toolchain-name
-        working-directory: openwrt
-        run: |
-          TOOLCHAIN_NAME=$(ls | grep toolchain-${{ matrix.target }}-${{ matrix.subtarget }})
-          echo "toolchain-name=$TOOLCHAIN_NAME" >> $GITHUB_OUTPUT
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v3
-        with:
-          context: openwrt
-          push: true
-          tags: ghcr.io/${{ needs.determine-container-info.outputs.owner-lc }}/toolchain:${{ matrix.target }}-${{ matrix.subtarget }}-${{ needs.determine-container-info.outputs.container-tag }}
-          file: openwrt/.github/workflows/Dockerfile.toolchain
-          build-args: |
-            OWNER_LC=${{ needs.determine-container-info.outputs.owner-lc }}
-            CONTAINER_TAG=${{ needs.determine-container-info.outputs.container-tag }}
-            TOOLCHAIN_NAME=${{ steps.get-toolchain-name.outputs.toolchain-name }}
+    uses: openwrt/actions-shared-workflows/.github/workflows/push-containers.yml@main
diff --git a/.github/workflows/toolchain.yml b/.github/workflows/toolchain.yml
index 4f4d78f4f8..0bc9fec179 100644
--- a/.github/workflows/toolchain.yml
+++ b/.github/workflows/toolchain.yml
@@ -3,12 +3,10 @@ name: Build Toolchains
 on:
   pull_request:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/toolchain.yml'
       - 'toolchain/**'
   push:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/toolchain.yml'
       - 'toolchain/**'
     branches-ignore:
@@ -22,52 +20,10 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  determine_targets:
-    name: Set targets
-    runs-on: ubuntu-latest
-    outputs:
-      target: ${{ steps.find_targets.outputs.target }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set targets
-        id: find_targets
-        run: |
-          export TARGETS="$(perl ./scripts/dump-target-info.pl targets 2>/dev/null \
-            | sort -u -t '/' -k1,1 \
-            | awk '{ print $1 }')"
-
-          JSON='['
-          FIRST=1
-          for TARGET in $TARGETS; do
-            TUPLE='{"target":"'"$(echo $TARGET | cut -d "/" -f 1)"'","subtarget":"'"$(echo $TARGET | cut -d "/" -f 2)"'"}'
-            [[ $FIRST -ne 1 ]] && JSON="$JSON"','
-            JSON="$JSON""$TUPLE"
-            FIRST=0
-          done
-          JSON="$JSON"']'
-
-           echo -e "\n---- targets ----\n"
-           echo "$JSON"
-           echo -e "\n---- targets ----\n"
-
-           echo "target=$JSON" >> $GITHUB_OUTPUT
-
-  build:
-    name: Build Target Toolchain
-    needs: determine_targets
+  build-toolchains:
+    name: Build Toolchains for each target
     permissions:
       contents: read
       packages: read
       actions: write
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.determine_targets.outputs.target)}}
-    uses: ./.github/workflows/build.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      build_toolchain: true
+    uses: openwrt/actions-shared-workflows/.github/workflows/toolchain.yml@main
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index 83bf5e98f5..35904a5e56 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -5,13 +5,11 @@ on:
     paths:
       - 'include/**'
       - 'tools/**'
-      - '.github/workflows/build-tools.yml'
       - '.github/workflows/tools.yml'
   push:
     paths:
       - 'include/**'
       - 'tools/**'
-      - '.github/workflows/build-tools.yml'
       - '.github/workflows/tools.yml'
     branches-ignore:
       - master
@@ -24,72 +22,6 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  build-macos-latest:
-    name: Build tools with macos latest
-    runs-on: macos-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: openwrt
-
-      - name: Setup MacOS
-        run: |
-          echo "WORKPATH=/Volumes/OpenWrt" >> "$GITHUB_ENV"
-          hdiutil create -size 20g -type SPARSE -fs "Case-sensitive HFS+" -volname OpenWrt OpenWrt.sparseimage
-          hdiutil attach OpenWrt.sparseimage
-          mv "$GITHUB_WORKSPACE/openwrt" /Volumes/OpenWrt/
-
-      - name: Install required prereq on MacOS
-        working-directory: ${{ env.WORKPATH }}/openwrt
-        run: |
-          brew install \
-            automake \
-            coreutils \
-            diffutils \
-            findutils \
-            gawk \
-            git-extras \
-            gnu-getopt \
-            gnu-sed \
-            grep \
-            make
-
-            echo "/bin" >> "$GITHUB_PATH"
-            echo "/sbin/Library/Apple/usr/bin" >> "$GITHUB_PATH"
-            echo "/usr/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/coreutils/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/findutils/libexec/gnubin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/gettext/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/gnu-getopt/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/make/libexec/gnubin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/make/libexec/gnubin" >> "$GITHUB_PATH"
-            echo "/usr/sbin" >> "$GITHUB_PATH"
-
-      - name: Make prereq
-        working-directory: ${{ env.WORKPATH }}/openwrt
-        run: make defconfig
-
-      - name: Build tools MacOS
-        working-directory: ${{ env.WORKPATH }}/openwrt
-        run: make tools/install -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Upload logs
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: macos-latest-logs
-          path: ${{ env.WORKPATH }}/openwrt/logs
-
-      - name: Upload config
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: macos-latest-config
-          path: ${{ env.WORKPATH }}/openwrt/.config
-
-  build-linux-buildbot:
-    name: Build tools with buildbot container
-    uses: ./.github/workflows/build-tools.yml
+  build-tools:
+    name: Build host tools for linux and macos based systems
+    uses: openwrt/actions-shared-workflows/.github/workflows/tools.yml@main