Pslb 4 ncs version example finalize and build for pslb#26
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| container: ghcr.io/nrfconnect/sdk-nrf-toolchain:v3.0.2 | ||
| defaults: | ||
| run: | ||
| # Bash shell is needed to set toolchain related environment variables in docker container | ||
| # It is a workaround for GitHub Actions limitation https://github.com/actions/runner/issues/1964 | ||
| shell: bash | ||
| strategy: | ||
| matrix: | ||
| board: [nrf54l15dk/nrf54l15/cpuapp] # Add | ||
|
|
||
|
|
||
| steps: | ||
| - name: Checkout repository pslabel | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| path: pslabel | ||
|
|
||
| - name: Prepare west project | ||
| run: | | ||
| west init -l pslabel | ||
| west update -o=--depth=1 -n | ||
|
|
||
| - name: Build Firmware | ||
| working-directory: pslabel | ||
| run: | | ||
| west build app -b ${{ matrix.board }} | ||
|
|
||
| - name: Extract version and create prefix | ||
| run: | | ||
| MAJOR=$(grep VERSION_MAJOR pslabel/app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs) | ||
| MINOR=$(grep VERSION_MINOR pslabel/app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs) | ||
| PATCH=$(grep PATCHLEVEL pslabel/app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs) | ||
| VERSION="${MAJOR}.${MINOR}.${PATCH}" | ||
| echo "PREFIX=${{ github.event.repository.name }}-v${VERSION}" >> $GITHUB_ENV | ||
|
|
||
| - name: Generate short SHA | ||
| uses: benjlevesque/short-sha@v3.0 | ||
|
|
||
| - name: Prepare artifacts | ||
| run: | | ||
| cd pslabel/build | ||
| mkdir -p artifacts | ||
| mv merged.hex artifacts/${{ env.PREFIX }}-${{ env.SHA }}.hex | ||
| if [ -f dfu_application.zip ]; then | ||
| mv dfu_application.zip artifacts/${{ env.PREFIX }}-FOTA-${{ env.SHA }}.zip | ||
| fi | ||
|
|
||
| # Run IDs are unique per repo but are reused on re-runs | ||
| - name: Save artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: build_artifacts_${{ github.run_id }} | ||
| path: | | ||
| pslabel/build/artifacts/* |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we will explicitly add a permissions block to the workflow. The permissions block will limit the GITHUB_TOKEN access to only the permissions required for the workflow's operations. Based on the tasks in the workflow (checking out the repository, building firmware, preparing artifacts, and uploading artifacts), the following permissions will be set:
contents: read— Required for reading repository contents (e.g., actions/checkout).actions: write— Required for uploading artifacts (actions/upload-artifact).
The permissions block will be added at the root of the workflow, ensuring that all jobs inherit these minimal permissions unless overridden.
| @@ -1,3 +1,6 @@ | ||
| permissions: | ||
| contents: read | ||
| actions: write | ||
| name: Build code | ||
|
|
||
| concurrency: |
| needs: stage-release | ||
| uses: ./.github/workflows/build.yml | ||
|
|
||
| upload-binaries: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we will add a permissions key at the root of the workflow file, setting the least privileges necessary for all jobs. Additionally, we will review the permissions for each job that does not already define them explicitly. For example:
- At the root level, set default permissions to
contents: read, which is usually sufficient for most workflows. - For the
stage-releaseandupload-binariesjobs, which require elevated permissions, retain their explicitpermissions: write-allconfiguration. - Ensure that all jobs or workflows that use
GITHUB_TOKENexplicitly declare permissions.
| @@ -4,6 +4,9 @@ | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| @@ -59,6 +62,8 @@ | ||
| build-binaries: | ||
| needs: stage-release | ||
| uses: ./.github/workflows/build.yml | ||
| permissions: | ||
| contents: read | ||
|
|
||
| upload-binaries: | ||
| needs: [build-binaries, stage-release] |
There was a problem hiding this comment.
Pull Request Overview
Finalize and streamline the PSLabel application build by bumping NCS revisions, removing example libraries/tests, renaming the project, and updating CI/CD workflows.
- Bump NCS
sdk-nrfrevision and strip out sample libraries, drivers, and tests - Rename CMake project from
apptopslabeland adjust source references - Revise GitHub Actions for SonarCloud, documentation, build, and release
Reviewed Changes
Copilot reviewed 36 out of 36 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| west.yml | Updated sdk-nrf revision to v3.0.2 and removed example west-commands section |
| app/CMakeLists.txt | Renamed project to pslabel but left target_sources referencing app |
| .github/workflows/sonarcloud.yml | Swapped Twister build for coverage build and adjusted exclusion patterns |
| doc/Doxyfile | Changed STRIP_FROM_PATH to point at ../app/src instead of ../include |
| .github/workflows/build.yml | Updated Docker container version, checkout path, and left an incomplete comment in matrix |
Comments suppressed due to low confidence (4)
.github/workflows/sonarcloud.yml:86
- This line lacks a trailing backslash, so the subsequent
--define sonar.scm.revisionisn't included in the same command. Add\to continue the shell command.
--define sonar.exclusions=build/**,modules/**,bootloader/**,doc/**,boards/**,west.yml,*.md,*.txt,*.json,*.yml,*.yaml
doc/Doxyfile:187
- [nitpick] The original
../includepath was removed. If your headers still live underinclude/, consider listing both paths here (e.g.,= ../app/src ../include).
STRIP_FROM_PATH = ../app/src \
.github/workflows/build.yml:30
- [nitpick] The
# Addcomment is incomplete and may confuse future readers. Either remove it or clarify what additional entries should be added.
board: [nrf54l15dk/nrf54l15/cpuapp] # Add
west.yml:4
- [nitpick] The
self:section and itswest-commandsentry were removed without adjusting indentation. Verify that the manifest structure is still valid and re-add or correctly indent theselfblock if needed.
manifest:
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
ParthSanepara
deleted the
PSLB-4-NCS-Version-example-finalize-and-build-for-PSLB
branch
No description provided.