rootfs cache: refresh configng every build; fingerprint tier + hash into cache_type

Two bugs that conspired to make 'new configng commit but still
served the old rootfs from cache' the default behaviour.

1. The fetch_from_repo for armbian-configng was gated inside the
   '[[ -z $DESKTOP_ENVIRONMENT ]]' branch of
   interactive_desktop_main_configuration, so it only fired when
   the user picked a DE from the interactive dialog. Every
   non-interactive build (CI, items-from-inventory, scripted
   local with DESKTOP_ENVIRONMENT= pre-set) skipped the fetch —
   which left whatever stale clone happened to live in
   cache/sources/armbian-configng/ as the source of truth for
   the CONFIGNG_DESKTOPS_HASH input.

   Hoist the fetch + parser-path sanity check up above the gate
   so every BUILD_DESKTOP=yes invocation pulls branch:main.
   fetch_from_repo is idempotent on an already-cloned tree
   (just a git pull) so the warm-cache cost is one up-to-date
   check.

2. The resolved rootfs tarball filename is
   rootfs-<arch>-<release>-<cache_type>_<yyyymm>-<cache_id>.tar.zst.
   cache_id = packages_hash came from AGGREGATED_ROOTFS_HASH +
   hook hash + bash hash — none of which see armbian-configng.
   cache_type encoded DESKTOP_ENVIRONMENT ('xfce-desktop',
   'gnome-desktop', …) but not DESKTOP_TIER and not any
   fingerprint of the configng tree. Consequences:

   - A tier=minimal rootfs and a tier=full rootfs for the same
     DE collided on one filename. Whichever built first got
     cached; every subsequent tier silently reused its tarball.

   - A configng commit that changed which packages a DE
     installs (yaml edit, tier_override bump, new browser
     mapping) produced a different CONFIGNG_DESKTOPS_HASH in
     artifact_input_variables, but the local tarball was still
     named the same, so the lookup kept hitting the pre-change
     artifact.

   Fold both into cache_type. Net rename:
     rootfs-arm64-trixie-xfce-desktop_…tar.zst
       →
     rootfs-arm64-trixie-xfce-desktop-mid-a1b2c3d4_…tar.zst

   8-char suffix is the configng commit prefix. Only injected
   for BUILD_DESKTOP=yes; only when the value is a real SHA
   (not the 'undetermined' / 'unknown' sentinels the
   computation falls back to on clone failures).

Author: igorpecovnik

lib/functions/configuration/config-desktop.sh

@@ -30,22 +30,38 @@ function interactive_desktop_main_configuration() {
 
 	display_alert "desktop-config" "DESKTOP_ENVIRONMENT entry: ${DESKTOP_ENVIRONMENT}" "debug"
 
+	# Refresh the armbian-configng clone on EVERY desktop build,
+	# regardless of whether DESKTOP_ENVIRONMENT was pre-set. The
+	# clone feeds two downstream consumers:
+	#
+	#   1. The interactive DE-selection dialog below — only fires
+	#      when DESKTOP_ENVIRONMENT is empty.
+	#   2. artifact_rootfs_config_dump, which reads the clone's
+	#      `git log -1 -- tools/modules/desktops/` as the
+	#      CONFIGNG_DESKTOPS_HASH input that (via create-cache.sh's
+	#      cache_type) fingerprints the rootfs tarball filename.
+	#
+	# Keeping the fetch inside the `-z DESKTOP_ENVIRONMENT` branch
+	# meant every non-interactive build (CI, items-from-inventory,
+	# scripted local) skipped it — so the hash was computed against
+	# whatever stale clone happened to be on disk and the build
+	# happily cache-hit a pre-configng-change rootfs. Hoisting the
+	# fetch up here makes the clone authoritative for every
+	# BUILD_DESKTOP=yes invocation.
+	fetch_from_repo "https://github.com/armbian/configng" "armbian-configng" "branch:main"
+
+	local configng_dir="${SRC}/cache/sources/armbian-configng"
+	local yaml_dir="${configng_dir}/tools/modules/desktops/yaml"
+	local parser="${configng_dir}/tools/modules/desktops/scripts/parse_desktop_yaml.py"
+
+	if [[ ! -f "${parser}" ]]; then
+		exit_with_error "Desktop parser not found at ${parser}" \
+			"armbian-config clone may be incomplete"
+	fi
+
 	# --- DE selection ---
 	if [[ -z $DESKTOP_ENVIRONMENT ]]; then
 
-		# Fetch armbian-config (configng) to get the YAML desktop
-		# definitions and the standalone Python parser.
-		fetch_from_repo "https://github.com/armbian/configng" "armbian-configng" "branch:main"
-
-		local configng_dir="${SRC}/cache/sources/armbian-configng"
-		local yaml_dir="${configng_dir}/tools/modules/desktops/yaml"
-		local parser="${configng_dir}/tools/modules/desktops/scripts/parse_desktop_yaml.py"
-
-		if [[ ! -f "${parser}" ]]; then
-			exit_with_error "Desktop parser not found at ${parser}" \
-				"armbian-config clone may be incomplete"
-		fi
-
 		# EXPERT mode controls which editorial `status:` values are
 		# surfaced in the dialog:
 		#   default: `status: supported` only

lib/functions/rootfs/create-cache.sh

@@ -39,6 +39,41 @@ function calculate_rootfs_cache_id() {
 	[[ -n ${DESKTOP_ENVIRONMENT} ]] && cache_type="${DESKTOP_ENVIRONMENT}-desktop"
 	[[ ${BUILD_MINIMAL} == yes ]] && cache_type="minimal"
 
+	# Fold DESKTOP_TIER into the cache name for desktop builds.
+	# tier=minimal, tier=mid and tier=full install different
+	# package sets under the same DE, so they can't share a
+	# cache tarball — otherwise the first tier to build wins and
+	# every subsequent tier of that DE silently reuses its rootfs.
+	if [[ ${BUILD_DESKTOP} == yes && -n ${DESKTOP_TIER} ]]; then
+		cache_type="${cache_type}-${DESKTOP_TIER}"
+	fi
+
+	# Fold a short fingerprint of the resolved armbian-configng
+	# desktop tree into the cache name. The desktop package set is
+	# chosen by configng YAMLs at rootfs-create time
+	# (`armbian-config --api module_desktops install mode=build`),
+	# not by the aggregation layer — so packages_hash and
+	# AGGREGATED_ROOTFS_HASH are blind to configng entirely. Without
+	# this, a configng commit that changes which packages a DE
+	# installs leaves the existing rootfs tarball untouched in the
+	# cache and every subsequent build cache-hits the pre-change
+	# version.
+	#
+	# CONFIGNG_DESKTOPS_HASH is set by artifact_rootfs_config_dump
+	# above from `git log -1 -- tools/modules/desktops/` in the
+	# cache/sources/armbian-configng clone. 8-char prefix keeps
+	# the filename readable while still giving us ~2^32 of
+	# collision resistance — same truncation style the rest of
+	# this file uses for the hash_hooks/bash_hash components.
+	if [[ ${BUILD_DESKTOP} == yes ]]; then
+		declare _configng_fp="${artifact_input_variables[CONFIGNG_DESKTOPS_HASH]:-}"
+		if [[ -n "${_configng_fp}" \
+				&& "${_configng_fp}" != "undetermined" \
+				&& "${_configng_fp}" != "unknown" ]]; then
+			cache_type="${cache_type}-${_configng_fp:0:8}"
+		fi
+	fi
+
 	# allow extensions to modify cache_type, since they may have used add_packages_to_rootfs() or remove_packages()
 	cache_type="${cache_type}${EXTRA_ROOTFS_NAME:-""}"