7f2e3f6dad
Some checks failed
Lint & Build / C/C++ Static Analysis (push) Failing after 32s
Lint & Build / Security Flaw Analysis (push) Successful in 21s
Lint & Build / Secret Scanning (push) Successful in 8s
Lint & Build / Shell Script Analysis (push) Successful in 10s
Lint & Build / Build Firmware (push) Successful in 2m7s
Lint & Build / Deploy to ESP Fleet (push) Successful in 3m0s
Build improvements: - Enable ccache via IDF_CCACHE_ENABLE=1 - Mount /var/cache/ccache volume for persistent cache - Show ccache stats after build Deployment improvements: - Deploy to all sensors in parallel (max 3) - Reduced total deploy time from ~2.5min to ~1min Note: Runner needs /var/cache/ccache directory with write permissions
267 lines
8.4 KiB
YAML
267 lines
8.4 KiB
YAML
name: Lint & Build
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
inputs:
|
|
deploy:
|
|
description: 'Deploy to ESP fleet after build'
|
|
required: false
|
|
default: 'false'
|
|
type: choice
|
|
options:
|
|
- 'false'
|
|
- 'true'
|
|
|
|
jobs:
|
|
build:
|
|
name: Build Firmware
|
|
runs-on: anvil
|
|
container:
|
|
image: docker.io/espressif/idf:v5.3
|
|
volumes:
|
|
- /var/cache/ccache:/ccache
|
|
env:
|
|
CCACHE_DIR: /ccache
|
|
IDF_CCACHE_ENABLE: 1
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
git clone --depth=1 --branch=${{ github.ref_name }} \
|
|
https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
|
|
|
|
- name: Setup ccache
|
|
run: |
|
|
apt-get update && apt-get install -y --no-install-recommends ccache
|
|
ccache --zero-stats
|
|
ccache --show-config | grep -E "(cache_dir|max_size)"
|
|
|
|
- name: Build firmware
|
|
run: |
|
|
. /opt/esp/idf/export.sh
|
|
cd get-started/csi_recv_router
|
|
idf.py build
|
|
|
|
- name: Show ccache stats
|
|
run: ccache --show-stats
|
|
|
|
- name: Show binary size
|
|
run: |
|
|
ls -lh get-started/csi_recv_router/build/*.bin
|
|
|
|
- name: Upload firmware artifact
|
|
run: |
|
|
mkdir -p /tmp/artifacts
|
|
cp get-started/csi_recv_router/build/csi_recv_router.bin /tmp/artifacts/
|
|
cp get-started/csi_recv_router/build/bootloader/bootloader.bin /tmp/artifacts/
|
|
cp get-started/csi_recv_router/build/partition_table/partition-table.bin /tmp/artifacts/
|
|
cp get-started/csi_recv_router/build/ota_data_initial.bin /tmp/artifacts/
|
|
echo "Artifacts ready in /tmp/artifacts"
|
|
ls -la /tmp/artifacts/
|
|
|
|
deploy:
|
|
name: Deploy to ESP Fleet
|
|
runs-on: anvil
|
|
needs: build
|
|
if: github.event_name == 'workflow_dispatch' && github.event.inputs.deploy == 'true' || startsWith(github.ref, 'refs/tags/v')
|
|
container:
|
|
image: docker.io/espressif/idf:v5.3
|
|
options: --network host
|
|
volumes:
|
|
- /var/cache/ccache:/ccache
|
|
env:
|
|
CCACHE_DIR: /ccache
|
|
IDF_CCACHE_ENABLE: 1
|
|
steps:
|
|
- name: Install tools
|
|
run: |
|
|
apt-get update && apt-get install -y --no-install-recommends netcat-openbsd curl jq ccache
|
|
|
|
- name: Checkout
|
|
run: |
|
|
git clone --depth=1 --branch=${{ github.ref_name }} \
|
|
https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
|
|
|
|
- name: Build firmware
|
|
run: |
|
|
. /opt/esp/idf/export.sh
|
|
cd get-started/csi_recv_router
|
|
idf.py build
|
|
ccache --show-stats | head -5
|
|
|
|
- name: Create release and upload firmware
|
|
env:
|
|
GITEA_TOKEN: ${{ github.token }}
|
|
run: |
|
|
TAG="${{ github.ref_name }}"
|
|
REPO="${{ github.repository }}"
|
|
API_URL="https://git.mymx.me/api/v1"
|
|
|
|
echo "Creating release for tag: $TAG"
|
|
|
|
# Check if release exists
|
|
RELEASE=$(curl -s -H "Authorization: token $GITEA_TOKEN" \
|
|
"$API_URL/repos/$REPO/releases/tags/$TAG")
|
|
|
|
RELEASE_ID=$(echo "$RELEASE" | jq -r '.id // empty')
|
|
|
|
if [ -z "$RELEASE_ID" ]; then
|
|
# Create new release
|
|
RELEASE=$(curl -s -X POST -H "Authorization: token $GITEA_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"tag_name\": \"$TAG\", \"name\": \"$TAG\", \"body\": \"Automated release from CI\"}" \
|
|
"$API_URL/repos/$REPO/releases")
|
|
RELEASE_ID=$(echo "$RELEASE" | jq -r '.id')
|
|
echo "Created release ID: $RELEASE_ID"
|
|
else
|
|
echo "Release exists with ID: $RELEASE_ID"
|
|
fi
|
|
|
|
# Upload firmware binary
|
|
echo "Uploading firmware..."
|
|
curl -s -X POST -H "Authorization: token $GITEA_TOKEN" \
|
|
-F "attachment=@get-started/csi_recv_router/build/csi_recv_router.bin" \
|
|
"$API_URL/repos/$REPO/releases/$RELEASE_ID/assets?name=csi_recv_router.bin"
|
|
|
|
- name: Deploy via OTA
|
|
run: |
|
|
SENSORS="muddy-storm:192.168.129.29 amber-maple:192.168.129.30 hollow-acorn:192.168.129.31"
|
|
OTA_PORT=8899
|
|
MAX_PARALLEL=3
|
|
|
|
# Get runner IP (first non-loopback interface)
|
|
RUNNER_IP=$(hostname -I | awk '{print $1}')
|
|
echo "Runner IP: $RUNNER_IP"
|
|
|
|
# Start HTTP server to serve firmware
|
|
cd get-started/csi_recv_router/build
|
|
python3 -m http.server $OTA_PORT &
|
|
HTTP_PID=$!
|
|
sleep 2
|
|
|
|
FIRMWARE_URL="http://${RUNNER_IP}:${OTA_PORT}/csi_recv_router.bin"
|
|
echo "Firmware URL: $FIRMWARE_URL"
|
|
|
|
# Verify server is running
|
|
curl -sI "http://localhost:${OTA_PORT}/csi_recv_router.bin" | head -1
|
|
|
|
# Deploy function
|
|
deploy_sensor() {
|
|
NAME="$1"
|
|
IP="$2"
|
|
URL="$3"
|
|
echo "=== Starting OTA on $NAME ($IP) ==="
|
|
RESPONSE=$(echo "OTA $URL" | nc -u -w 2 "$IP" 5501 2>/dev/null || echo "no response")
|
|
echo "$NAME: $RESPONSE"
|
|
}
|
|
|
|
# Deploy to all sensors in parallel (max $MAX_PARALLEL)
|
|
echo "=== Deploying to all sensors in parallel ==="
|
|
PIDS=""
|
|
for entry in $SENSORS; do
|
|
NAME="${entry%%:*}"
|
|
IP="${entry##*:}"
|
|
deploy_sensor "$NAME" "$IP" "$FIRMWARE_URL" &
|
|
PIDS="$PIDS $!"
|
|
done
|
|
|
|
# Wait for all OTA commands to be sent
|
|
for PID in $PIDS; do
|
|
wait $PID 2>/dev/null || true
|
|
done
|
|
|
|
echo "=== OTA commands sent, waiting for devices to update (60s) ==="
|
|
sleep 60
|
|
|
|
# Stop HTTP server
|
|
kill $HTTP_PID 2>/dev/null || true
|
|
|
|
echo "=== Deployment complete ==="
|
|
|
|
cppcheck:
|
|
name: C/C++ Static Analysis
|
|
runs-on: anvil
|
|
container:
|
|
image: docker.io/library/debian:bookworm-slim
|
|
steps:
|
|
- name: Install tools
|
|
run: |
|
|
apt-get update && apt-get install -y --no-install-recommends git cppcheck ca-certificates
|
|
|
|
- name: Checkout
|
|
run: |
|
|
git clone --depth=1 --branch=${{ github.ref_name }} \
|
|
https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
|
|
|
|
- name: Run cppcheck
|
|
run: |
|
|
cppcheck --enable=warning,style,performance,portability \
|
|
--suppress=missingIncludeSystem \
|
|
--error-exitcode=1 \
|
|
--inline-suppr \
|
|
-I get-started/csi_recv_router/main \
|
|
get-started/csi_recv_router/main/*.c
|
|
|
|
flawfinder:
|
|
name: Security Flaw Analysis
|
|
runs-on: anvil
|
|
container:
|
|
image: docker.io/library/python:3.12-slim
|
|
steps:
|
|
- name: Install tools
|
|
run: |
|
|
apt-get update && apt-get install -y --no-install-recommends git ca-certificates
|
|
pip install --no-cache-dir flawfinder
|
|
|
|
- name: Checkout
|
|
run: |
|
|
git clone --depth=1 --branch=${{ github.ref_name }} \
|
|
https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
|
|
|
|
- name: Run flawfinder
|
|
run: |
|
|
flawfinder --minlevel=2 --error-level=4 \
|
|
get-started/csi_recv_router/main/
|
|
|
|
gitleaks:
|
|
name: Secret Scanning
|
|
runs-on: anvil
|
|
container:
|
|
image: docker.io/zricethezav/gitleaks:latest
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
git clone --branch=${{ github.ref_name }} \
|
|
https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
|
|
|
|
- name: Run gitleaks
|
|
run: gitleaks detect --source . --verbose --redact
|
|
|
|
shellcheck:
|
|
name: Shell Script Analysis
|
|
runs-on: anvil
|
|
container:
|
|
image: docker.io/koalaman/shellcheck-alpine:stable
|
|
steps:
|
|
- name: Install git
|
|
run: apk add --no-cache git
|
|
|
|
- name: Checkout
|
|
run: |
|
|
git clone --depth=1 --branch=${{ github.ref_name }} \
|
|
https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
|
|
|
|
- name: Find and check shell scripts
|
|
run: |
|
|
SCRIPTS=$(find . -name "*.sh" -type f 2>/dev/null || true)
|
|
if [ -n "$SCRIPTS" ]; then
|
|
echo "Checking: $SCRIPTS"
|
|
echo "$SCRIPTS" | xargs shellcheck --severity=warning
|
|
else
|
|
echo "No shell scripts found, skipping"
|
|
fi
|