Skip to content

Commit c1f9c4d

Browse files
pennampennam
committed
SecureElement: add github workflows
1 parent af347e5 commit c1f9c4d

7 files changed

+372
-0
lines changed

‎.codespellrc

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[codespell]
2+
# In the event of a false positive, add the problematic word, in all lowercase, to a comma-separated list here:
3+
ignore-words-list = ,
4+
check-filenames =
5+
check-hidden =
6+
skip = ./.git

‎.github/dependabot.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# See: https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#about-the-dependabotyml-file
2+
version: 2
3+
4+
updates:
5+
# Configure check for outdated GitHub Actions actions in workflows.
6+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/dependabot/README.md
7+
# See: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-actions-up-to-date-with-dependabot
8+
- package-ecosystem: github-actions
9+
directory: / # Check the repository's workflows under /.github/workflows/
10+
schedule:
11+
interval: daily
12+
labels:
13+
- "topic: infrastructure"

‎.github/workflows/arduino-lint.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Arduino Lint
2+
on:
3+
push:
4+
pull_request:
5+
# Scheduled trigger checks for breakage caused by new rules added to Arduino Lint
6+
schedule:
7+
# run every Saturday at 3 AM UTC
8+
- cron: "0 3 * * 6"
9+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#workflow_dispatch
10+
workflow_dispatch:
11+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#repository_dispatch
12+
repository_dispatch:
13+
14+
jobs:
15+
lint:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v4
21+
22+
- name: Arduino Lint
23+
uses: arduino/arduino-lint-action@v1
24+
with:
25+
official: true
26+
library-manager: update

‎.github/workflows/compile-examples.yml

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
name: Compile Examples
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- ".github/workflows/compile-examples.yml"
7+
- "library.properties"
8+
- "examples/**"
9+
- "src/**"
10+
push:
11+
paths:
12+
- ".github/workflows/compile-examples.yml"
13+
- "library.properties"
14+
- "examples/**"
15+
- "src/**"
16+
# Scheduled trigger checks for breakage caused by changes to external resources (libraries, platforms)
17+
schedule:
18+
# run every Saturday at 3 AM UTC
19+
- cron: "0 3 * * 6"
20+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#workflow_dispatch
21+
workflow_dispatch:
22+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#repository_dispatch
23+
repository_dispatch:
24+
25+
jobs:
26+
build:
27+
name: ${{ matrix.board.fqbn }}
28+
runs-on: ubuntu-latest
29+
30+
env:
31+
SKETCHES_REPORTS_PATH: sketches-reports
32+
33+
strategy:
34+
fail-fast: false
35+
36+
matrix:
37+
board:
38+
- fqbn: "arduino:samd:mkr1000"
39+
platform-name: arduino:samd
40+
- fqbn: "arduino:samd:mkrwifi1010"
41+
platform-name: arduino:samd
42+
- fqbn: "arduino:samd:nano_33_iot"
43+
platform-name: arduino:samd
44+
- fqbn: "arduino:samd:mkrgsm1400"
45+
platform-name: arduino:samd
46+
- fqbn: "arduino:samd:mkrnb1500"
47+
platform-name: arduino:samd
48+
- fqbn: "arduino:mbed_portenta:envie_m7"
49+
platform-name: arduino:mbed_portenta
50+
- fqbn: arduino:mbed_nano:nanorp2040connect
51+
platform-name: arduino:mbed_nano
52+
- fqbn: arduino:mbed_nicla:nicla_vision
53+
platform-name: arduino:mbed_nicla
54+
- fqbn: arduino:mbed_opta:opta
55+
platform-name: arduino:mbed_opta
56+
- fqbn: arduino:mbed_giga:giga
57+
platform-name: arduino:mbed_giga
58+
- fqbn: arduino:renesas_portenta:portenta_c33
59+
platform-name: arduino:renesas_portenta
60+
- fqbn: arduino:renesas_uno:unor4wifi
61+
platform-name: arduino:renesas_uno
62+
63+
include:
64+
- board:
65+
platform-name: arduino:samd
66+
platforms: |
67+
# Install Arduino SAMD Boards via Boards Manager
68+
- name: arduino:samd
69+
libraries: |
70+
- name: ArduinoECCX08
71+
- board:
72+
platform-name: arduino:mbed_portenta
73+
platforms: |
74+
# Install Arduino mbed_portenta Boards via Boards Manager
75+
- name: arduino:mbed_portenta
76+
libraries: |
77+
- name: ArduinoECCX08
78+
- board:
79+
platform-name: arduino:mbed_nano
80+
platforms: |
81+
# Install Arduino mbed_nano Boards via Boards Manager
82+
- name: arduino:mbed_nano
83+
libraries: |
84+
- name: ArduinoECCX08
85+
- board:
86+
platform-name: arduino:mbed_nicla
87+
platforms: |
88+
# Install Arduino mbed_nano Boards via Boards Manager
89+
- name: arduino:mbed_nicla
90+
- board:
91+
platform-name: arduino:mbed_opta
92+
platforms: |
93+
# Install Arduino mbed_opta Boards via Boards Manager
94+
- name: arduino:mbed_opta
95+
libraries: |
96+
- name: ArduinoECCX08
97+
- board:
98+
platform-name: arduino:mbed_giga
99+
platforms: |
100+
# Install Arduino mbed_giga Boards via Boards Manager
101+
- name: arduino:mbed_giga
102+
libraries: |
103+
- name: ArduinoECCX08
104+
- board:
105+
platform-name: arduino:renesas_portenta
106+
platforms: |
107+
# Install Arduino renesas_portenta Boards via Boards Manager
108+
- name: arduino:renesas_portenta
109+
- board:
110+
platform-name: arduino:renesas_uno
111+
platforms: |
112+
# Install Arduino renesas_uno Boards via Boards Manager
113+
- name: arduino:renesas_uno
114+
115+
steps:
116+
- name: Checkout
117+
uses: actions/checkout@v4
118+
119+
- name: Install ESP32 platform dependencies
120+
if: matrix.board.platform-name == 'esp32'
121+
run: pip3 install pyserial
122+
123+
- name: Compile examples
124+
uses: arduino/compile-sketches@v1
125+
with:
126+
github-token: ${{ secrets.GITHUB_TOKEN }}
127+
platforms: ${{ matrix.platforms }}
128+
fqbn: ${{ matrix.board.fqbn }}
129+
libraries: |
130+
# Install the library from the local path.
131+
- source-path: ./
132+
${{ matrix.libraries }}
133+
enable-deltas-report: true
134+
sketches-report-path: ${{ env.SKETCHES_REPORTS_PATH }}
135+
136+
- name: Save memory usage change report as artifact
137+
uses: actions/upload-artifact@v3
138+
with:
139+
name: ${{ env.SKETCHES_REPORTS_PATH }}
140+
if-no-files-found: error
141+
path: ${{ env.SKETCHES_REPORTS_PATH }}

‎.github/workflows/report-size-deltas.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Report Size Deltas
2+
3+
on:
4+
push:
5+
paths:
6+
- ".github/workflows/report-size-deltas.ya?ml"
7+
schedule:
8+
- cron: '*/5 * * * *'
9+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#workflow_dispatch
10+
workflow_dispatch:
11+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#repository_dispatch
12+
repository_dispatch:
13+
14+
jobs:
15+
report:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
# See: https://github.com/arduino/actions/blob/master/libraries/report-size-deltas/README.md
20+
- name: Comment size deltas reports to PRs
21+
uses: arduino/report-size-deltas@v1
22+
with:
23+
# The name of the workflow artifact created by the "Compile Examples" workflow
24+
sketches-reports-source: sketches-reports

‎.github/workflows/spell-check.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Spell Check
2+
3+
on:
4+
pull_request:
5+
push:
6+
schedule:
7+
# Run every Saturday at 3 AM UTC to catch new misspelling detections resulting from dictionary updates.
8+
- cron: "0 3 * * 6"
9+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#workflow_dispatch
10+
workflow_dispatch:
11+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#repository_dispatch
12+
repository_dispatch:
13+
14+
jobs:
15+
spellcheck:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v4
21+
22+
# See: https://github.com/codespell-project/actions-codespell/blob/master/README.md
23+
- name: Spell check
24+
uses: codespell-project/actions-codespell@v2

‎.github/workflows/sync-labels.yml

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/sync-labels.md
2+
name: Sync Labels
3+
4+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
5+
on:
6+
push:
7+
paths:
8+
- ".github/workflows/sync-labels.ya?ml"
9+
- ".github/label-configuration-files/*.ya?ml"
10+
pull_request:
11+
paths:
12+
- ".github/workflows/sync-labels.ya?ml"
13+
- ".github/label-configuration-files/*.ya?ml"
14+
schedule:
15+
# Run daily at 8 AM UTC to sync with changes to shared label configurations.
16+
- cron: "0 8 * * *"
17+
workflow_dispatch:
18+
repository_dispatch:
19+
20+
env:
21+
CONFIGURATIONS_FOLDER: .github/label-configuration-files
22+
CONFIGURATIONS_ARTIFACT: label-configuration-files
23+
24+
jobs:
25+
check:
26+
runs-on: ubuntu-latest
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v4
31+
32+
- name: Download JSON schema for labels configuration file
33+
id: download-schema
34+
uses: carlosperate/download-file-action@v2
35+
with:
36+
file-url: https://raw.githubusercontent.com/arduino/tooling-project-assets/main/workflow-templates/assets/sync-labels/arduino-tooling-gh-label-configuration-schema.json
37+
location: ${{ runner.temp }}/label-configuration-schema
38+
39+
- name: Install JSON schema validator
40+
run: |
41+
sudo npm install \
42+
--global \
43+
ajv-cli \
44+
ajv-formats
45+
46+
- name: Validate local labels configuration
47+
run: |
48+
# See: https://github.com/ajv-validator/ajv-cli#readme
49+
ajv validate \
50+
--all-errors \
51+
-c ajv-formats \
52+
-s "${{ steps.download-schema.outputs.file-path }}" \
53+
-d "${{ env.CONFIGURATIONS_FOLDER }}/*.{yml,yaml}"
54+
55+
download:
56+
needs: check
57+
runs-on: ubuntu-latest
58+
59+
strategy:
60+
matrix:
61+
filename:
62+
# Filenames of the shared configurations to apply to the repository in addition to the local configuration.
63+
# https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/sync-labels
64+
- universal.yml
65+
66+
steps:
67+
- name: Download
68+
uses: carlosperate/download-file-action@v2
69+
with:
70+
file-url: https://raw.githubusercontent.com/arduino/tooling-project-assets/main/workflow-templates/assets/sync-labels/${{ matrix.filename }}
71+
72+
- name: Pass configuration files to next job via workflow artifact
73+
uses: actions/upload-artifact@v3
74+
with:
75+
path: |
76+
*.yaml
77+
*.yml
78+
if-no-files-found: error
79+
name: ${{ env.CONFIGURATIONS_ARTIFACT }}
80+
81+
sync:
82+
needs: download
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Set environment variables
87+
run: |
88+
# See: https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
89+
echo "MERGED_CONFIGURATION_PATH=${{ runner.temp }}/labels.yml" >> "$GITHUB_ENV"
90+
91+
- name: Determine whether to dry run
92+
id: dry-run
93+
if: >
94+
github.event_name == 'pull_request' ||
95+
(
96+
(
97+
github.event_name == 'push' ||
98+
github.event_name == 'workflow_dispatch'
99+
) &&
100+
github.ref != format('refs/heads/{0}', github.event.repository.default_branch)
101+
)
102+
run: |
103+
# Use of this flag in the github-label-sync command will cause it to only check the validity of the
104+
# configuration.
105+
echo "flag=--dry-run" >> $GITHUB_OUTPUT
106+
107+
- name: Checkout repository
108+
uses: actions/checkout@v4
109+
110+
- name: Download configuration files artifact
111+
uses: actions/download-artifact@v3
112+
with:
113+
name: ${{ env.CONFIGURATIONS_ARTIFACT }}
114+
path: ${{ env.CONFIGURATIONS_FOLDER }}
115+
116+
- name: Remove unneeded artifact
117+
uses: geekyeggo/delete-artifact@v2
118+
with:
119+
name: ${{ env.CONFIGURATIONS_ARTIFACT }}
120+
121+
- name: Merge label configuration files
122+
run: |
123+
# Merge all configuration files
124+
shopt -s extglob
125+
cat "${{ env.CONFIGURATIONS_FOLDER }}"/*.@(yml|yaml) > "${{ env.MERGED_CONFIGURATION_PATH }}"
126+
127+
- name: Install github-label-sync
128+
run: sudo npm install --global github-label-sync
129+
130+
- name: Sync labels
131+
env:
132+
GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
133+
run: |
134+
# See: https://github.com/Financial-Times/github-label-sync
135+
github-label-sync \
136+
--labels "${{ env.MERGED_CONFIGURATION_PATH }}" \
137+
${{ steps.dry-run.outputs.flag }} \
138+
${{ github.repository }}

0 commit comments

Comments
 (0)