36 Commits

Author	SHA1	Message	Date
user	796c6ced28	fix: Exclude known NVS key names from secret detection ... The strings check was matching 'auth_secret' (NVS key) and 'secret=%s' (printf format) as false positives. Filter out known firmware patterns.	2026-02-15 00:14:05 +01:00
user	ba6a2a13ee	fix: Add IDF_PATH_FORCE for export.sh detection ... export.sh requires IDF_PATH_FORCE=1 to honor the IDF_PATH env var instead of auto-detecting from script location.	2026-02-15 00:09:43 +01:00
user	e96ec06a18	fix: Set IDF_PATH explicitly in build job ... The espressif/idf:v5.5 container fails to auto-detect IDF_PATH from export.sh when run under Gitea Actions. Set it explicitly as an env var.	2026-02-15 00:07:24 +01:00
user	c895f52151	feat: Push firmware to Harbor for Trivy scanning ... Add crane-based OCI image push step to CI workflow. Packages firmware binary into scratch image and pushes to harbor.mymx.me/library/firmware:<sha> on every build. Tag pushes also get a version tag. Harbor auto-scans with Trivy.	2026-02-14 23:03:27 +01:00
user	c76c1ee61b	feat: OTA TLS cert verification + CI release pipeline ... Wire ESP-IDF's built-in 150-CA root bundle to the OTA HTTP client so HTTPS OTA verifies server certificates. Pin bundle config in sdkconfig.defaults. Replace dead artifact-copy step with Gitea release creation on tag push. Bump CI container to IDF v5.5.	2026-02-14 22:38:41 +01:00
user	2e4fa30b84	ci: Remove deploy job (deploy locally instead)	2026-02-05 23:46:37 +01:00
user	89e05bbb7e	ci: Use absolute path for ESP-IDF on host runner	2026-02-05 23:43:59 +01:00
user	f9d22cbe39	ci: Use curl/tar for deploy checkout (host has no git)	2026-02-05 23:29:52 +01:00
user	9e3038e85f	ci: Run deploy on host with local HTTP server for OTA	2026-02-05 23:23:45 +01:00
user	de3e120c7e	ci: Use Gitea release URL for OTA instead of local HTTP server	2026-02-05 23:14:06 +01:00
user	a84abf03ca	ci: Add security checks (secrets scan, config validation)	2026-02-05 23:02:46 +01:00
user	4da0679d4e	ci: Skip build job on tag pushes (deploy rebuilds)	2026-02-05 23:00:10 +01:00
user	da9859571b	ci: Remove shellcheck, run deploy in container with host network ... - Remove shellcheck job (no shell scripts) - Deploy job now uses espressif/idf container with --network=host - Install git, curl, jq, netcat in deploy container	2026-02-05 22:54:16 +01:00
user	52603fb097	fix: Use git clone instead of curl for deploy checkout	2026-02-05 22:47:51 +01:00
user	974ffadb1c	ci: Add firmware size check and version tag validation ... - Fail build if binary exceeds 1920 KB partition - Warn at 85% capacity - Warn if git tag differs from embedded version	2026-02-05 22:42:49 +01:00
user	456b4f0b9a	ci: Run build after checks pass, fix deploy checkout	2026-02-05 22:24:38 +01:00
user	a338c9f65f	ci: Fix multiline command syntax for host runner	2026-02-05 22:18:50 +01:00
user	fbf2e9a7c1	ci: Add OTA progress monitoring with version checks	2026-02-05 22:11:13 +01:00
user	1377abe248	ci: Run deploy on host instead of container for network access	2026-02-05 22:09:47 +01:00
user	7f2e3f6dad	ci: Add ccache for faster builds + parallel OTA deployment ... Build improvements: - Enable ccache via IDF_CCACHE_ENABLE=1 - Mount /var/cache/ccache volume for persistent cache - Show ccache stats after build Deployment improvements: - Deploy to all sensors in parallel (max 3) - Reduced total deploy time from ~2.5min to ~1min Note: Runner needs /var/cache/ccache directory with write permissions	2026-02-05 22:02:29 +01:00
user	a85a2d776b	ci: Use host network for deploy container	2026-02-05 21:55:21 +01:00
user	6dbab23329	ci: Serve firmware from runner for OTA deployment ... Instead of having ESP devices download from Gitea (TLS cert issues), the runner now serves firmware via local HTTP server and triggers OTA with the local URL.	2026-02-05 21:48:53 +01:00
user	a1074319f2	ci: Upload firmware to Gitea releases for OTA	2026-02-05 13:48:08 +01:00
user	9ece83bac0	ci: Simplify deploy script to pure POSIX sh	2026-02-05 13:28:28 +01:00
user	cfa22e9e2a	ci: Fix deploy script for POSIX sh, use explicit bash	2026-02-05 13:21:38 +01:00
user	baf2c69aee	ci: Use hardcoded sensor IPs for deploy	2026-02-05 13:14:38 +01:00
user	7be795a26e	ci: Fix deploy job - use container with host networking	2026-02-05 12:29:22 +01:00
user	63ff9c4931	ci: Add deploy job for OTA firmware updates ... - Triggers on manual workflow_dispatch with deploy=true - Triggers automatically on version tags (v*) - Deploys to muddy-storm, amber-maple, hollow-acorn via OTA - Uses podman to rebuild, then serves firmware via HTTP	2026-02-05 12:20:19 +01:00
user	b4c898a741	ci: Source ESP-IDF export.sh before build	2026-02-05 12:16:20 +01:00
user	9e7fab9e09	ci: Add ESP-IDF firmware build job	2026-02-05 12:13:56 +01:00
user	cae599f49f	ci: Use containers for all lint jobs (podman)	2026-02-05 12:10:16 +01:00
user	7b9f0b9242	ci: Download gitleaks binary, use python3 -m pip for flawfinder	2026-02-05 12:08:17 +01:00
user	9430832dfc	ci: Remove sudo - assume tools pre-installed on runner	2026-02-05 12:07:16 +01:00
user	5d8fbd4bf6	ci: Use github.token for authenticated checkout	2026-02-05 12:06:31 +01:00
user	033aaccd46	ci: Use git clone instead of actions/checkout (runner lacks node)	2026-02-05 12:02:15 +01:00
user	8265f96f3b	ci: Add Gitea workflow for lint and security checks ... - cppcheck: C/C++ static analysis (warnings, style, performance, portability) - flawfinder: Security-focused C/C++ analysis - gitleaks: Secret scanning across repo history - shellcheck: Shell script analysis All jobs run on 'anvil' labeled runner.	2026-02-05 11:33:44 +01:00