Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 0 additions & 44 deletions .github/workflows/build-using-docker.yml

This file was deleted.

75 changes: 75 additions & 0 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
name: Build code

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on:

# Trigger on pushes to branches and pull requests
push:
branches:
- '**'

# Trigger on pull requests targeting the specified branch
pull_request:
branches:
- '**'
workflow_call:
jobs:
build:
runs-on: ubuntu-latest
container: ghcr.io/nrfconnect/sdk-nrf-toolchain:v3.0.2
defaults:
run:
# Bash shell is needed to set toolchain related environment variables in docker container
# It is a workaround for GitHub Actions limitation https://github.com/actions/runner/issues/1964
shell: bash
strategy:
matrix:
board: [nrf54l15dk/nrf54l15/cpuapp] # Add


steps:
- name: Checkout repository pslabel
uses: actions/checkout@v4
with:
path: pslabel

- name: Prepare west project
run: |
west init -l pslabel
west update -o=--depth=1 -n

- name: Build Firmware
working-directory: pslabel
run: |
west build app -b ${{ matrix.board }}

- name: Extract version and create prefix
run: |
MAJOR=$(grep VERSION_MAJOR pslabel/app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs)
MINOR=$(grep VERSION_MINOR pslabel/app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs)
PATCH=$(grep PATCHLEVEL pslabel/app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs)
VERSION="${MAJOR}.${MINOR}.${PATCH}"
echo "PREFIX=${{ github.event.repository.name }}-v${VERSION}" >> $GITHUB_ENV

- name: Generate short SHA
uses: benjlevesque/short-sha@v3.0

- name: Prepare artifacts
run: |
cd pslabel/build
mkdir -p artifacts
mv merged.hex artifacts/${{ env.PREFIX }}-${{ env.SHA }}.hex
if [ -f dfu_application.zip ]; then
mv dfu_application.zip artifacts/${{ env.PREFIX }}-FOTA-${{ env.SHA }}.zip
fi

# Run IDs are unique per repo but are reused on re-runs
- name: Save artifact
uses: actions/upload-artifact@v4
with:
name: build_artifacts_${{ github.run_id }}
path: |
pslabel/build/artifacts/*
Comment on lines +21 to +75

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 10 months ago

To fix the issue, we will explicitly add a permissions block to the workflow. The permissions block will limit the GITHUB_TOKEN access to only the permissions required for the workflow's operations. Based on the tasks in the workflow (checking out the repository, building firmware, preparing artifacts, and uploading artifacts), the following permissions will be set:

  • contents: read — Required for reading repository contents (e.g., actions/checkout).
  • actions: write — Required for uploading artifacts (actions/upload-artifact).

The permissions block will be added at the root of the workflow, ensuring that all jobs inherit these minimal permissions unless overridden.

Suggested changeset 1
.github/workflows/build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+  actions: write
 name: Build code
 
 concurrency:
EOF
@@ -1,3 +1,6 @@
permissions:
contents: read
actions: write
name: Build code

concurrency:
Copilot is powered by AI and may make mistakes. Always verify output.
13 changes: 12 additions & 1 deletion .github/workflows/docs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,18 @@

name: Documentation

on: [push, pull_request]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on:
push:
branches:
- main
pull_request:
release:
types: [published]
workflow_dispatch:

env:
DOXYGEN_VERSION: 1.9.6
Expand Down
81 changes: 81 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
name: Create Release

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on:
push:
tags:
- 'v*.*.*'
# workflow_dispatch:
# inputs:
# version:
# description: "Release Version."
# required: true
# default: "v0.0.0"
# type: string

jobs:
stage-release:
runs-on: ubuntu-latest
permissions: write-all
outputs:
version: ${{ steps.read_version.outputs.VERSION }}
steps:
- name: Checkout repo
uses: actions/checkout@v4

- name: Read version from VERSION file
id: read_version
run: |
MAJOR=$(grep VERSION_MAJOR app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs)
MINOR=$(grep VERSION_MINOR app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs)
PATCH=$(grep PATCHLEVEL app/VERSION | awk -F'=' '{print $2}' | tr -d '\r' | xargs)
VERSION="v${MAJOR}.${MINOR}.${PATCH}"
echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
echo "file_version=$VERSION" >> $GITHUB_OUTPUT

# - name: Create Release manually with GH CLI
# if: ${{ github.event_name == 'workflow_dispatch' }}
# run: gh release create --draft ${{ steps.read_version.outputs.VERSION }}
# env:
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Fail if tag and VERSION mismatch
run: |
TAG_VERSION="${GITHUB_REF##*/}"
echo "Tag pushed: $TAG_VERSION"
echo "Internal version: $FILE_VERSION"
if [ "$TAG_VERSION" != "$FILE_VERSION" ]; then
echo "❌ ERROR: Tag ($TAG_VERSION) does not match VERSION file ($FILE_VERSION)"
exit 1
else
echo "✅ Tag and VERSION file match."
fi
env:
FILE_VERSION: ${{ steps.read_version.outputs.file_version }}

build-binaries:
needs: stage-release
uses: ./.github/workflows/build.yml

upload-binaries:
Comment on lines +60 to +63

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 10 months ago

To fix the issue, we will add a permissions key at the root of the workflow file, setting the least privileges necessary for all jobs. Additionally, we will review the permissions for each job that does not already define them explicitly. For example:

  • At the root level, set default permissions to contents: read, which is usually sufficient for most workflows.
  • For the stage-release and upload-binaries jobs, which require elevated permissions, retain their explicit permissions: write-all configuration.
  • Ensure that all jobs or workflows that use GITHUB_TOKEN explicitly declare permissions.
Suggested changeset 1
.github/workflows/release.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,9 @@
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
   
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -59,6 +62,8 @@
   build-binaries:
     needs: stage-release
     uses: ./.github/workflows/build.yml
+    permissions:
+      contents: read
 
   upload-binaries:
     needs: [build-binaries, stage-release]
EOF
@@ -4,6 +4,9 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions:
contents: read

on:
push:
tags:
@@ -59,6 +62,8 @@
build-binaries:
needs: stage-release
uses: ./.github/workflows/build.yml
permissions:
contents: read

upload-binaries:
needs: [build-binaries, stage-release]
Copilot is powered by AI and may make mistakes. Always verify output.
needs: [build-binaries, stage-release]
runs-on: ubuntu-latest
permissions: write-all

steps:
- name: Checkout repo
uses: actions/checkout@v4

- name: Download artifact
uses: actions/download-artifact@v4
with:
name: build_artifacts_${{ github.run_id }}
path: ~/artifacts

- name: Upload artifacts to release
run: gh release upload --clobber ${{ needs.stage-release.outputs.version }} ~/artifacts/*.*
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
14 changes: 9 additions & 5 deletions .github/workflows/sonarcloud.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
name: SonarCloud

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on:
push:
branches:
Expand Down Expand Up @@ -59,12 +64,12 @@ jobs:
- name: Build and test
working-directory: pslabel-oob
run: |
build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} west twister -T . -C --coverage-platform=native_sim -v --inline-logs --integration
build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} west build app -b native_sim -- -DCONFIG_COVERAGE=y

- name: Extract coverage into sonarqube xml format
working-directory: pslabel-oob
run: |
gcovr twister-out -v --merge-mode-functions=separate --exclude='twister-out|drivers' --sonarqube coverage.xml
gcovr build -v --merge-mode-functions=separate --exclude='build' --sonarqube coverage.xml

- name: Run sonar-scanner on main
working-directory: pslabel-oob
Expand All @@ -78,8 +83,7 @@ jobs:
--define project.settings=sonar-project.properties \
--define sonar.coverageReportPaths=coverage.xml \
--define sonar.inclusions=**/*.c,**/*.h \
--define sonar.exclusions=tests/,drivers/sensor/*_dummy/

--define sonar.exclusions=build/**,modules/**,bootloader/**,doc/**,boards/**,west.yml,*.md,*.txt,*.json,*.yml,*.yaml
- name: Run sonar-scanner on PR
working-directory: pslabel-oob
if: github.event_name == 'pull_request'
Expand All @@ -96,7 +100,7 @@ jobs:
--define project.settings=sonar-project.properties \
--define sonar.coverageReportPaths=coverage.xml \
--define sonar.inclusions=**/*.c,**/*.h \
--define sonar.exclusions=tests/,drivers/sensor/*_dummy/ \
--define sonar.exclusions=build/**,modules/**,bootloader/**,doc/**,boards/**,west.yml,*.md,*.txt,*.json,*.yml,*.yaml \
--define sonar.scm.revision=${{ env.HEAD_SHA }} \
--define sonar.pullrequest.key=${{ env.PR_NUMBER }} \
--define sonar.pullrequest.branch=${{ env.PR_BRANCH }} \
Expand Down
6 changes: 0 additions & 6 deletions CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,3 @@

# This is needed so that custom driver classes using system calls are taken into
# account
zephyr_syscall_include_directories(include)

zephyr_include_directories(include)

add_subdirectory(drivers)
add_subdirectory(lib)
2 changes: 0 additions & 2 deletions Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,3 @@
# as the module Kconfig entry point (see zephyr/module.yml). You can browse
# module options by going to Zephyr -> Modules in Kconfig.

rsource "drivers/Kconfig"
rsource "lib/Kconfig"
2 changes: 1 addition & 1 deletion app/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,6 @@
cmake_minimum_required(VERSION 3.13.1)
find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})

project(app LANGUAGES C)
project(pslabel LANGUAGES C)

target_sources(app PRIVATE src/main.c)
Comment thread
hprstech marked this conversation as resolved.
6 changes: 0 additions & 6 deletions app/boards/nrf54l15dk_nrf54l15_cpuapp.overlay
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,3 @@
* already provided by Zephyr or NCS.
*/

/ {
example_sensor: example-sensor {
compatible = "zephyr,example-sensor";
input-gpios = <&gpio1 13 (GPIO_PULL_UP | GPIO_ACTIVE_LOW)>;
};
};
12 changes: 0 additions & 12 deletions app/debug.conf

This file was deleted.

16 changes: 0 additions & 16 deletions app/sample.yaml

This file was deleted.

2 changes: 0 additions & 2 deletions app/src/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,8 @@
*/

#include <zephyr/kernel.h>
#include <zephyr/drivers/sensor.h>
#include <zephyr/logging/log.h>

#include <app/drivers/blink.h>

#include <app_version.h>

Expand Down
4 changes: 2 additions & 2 deletions doc/Doxyfile
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ FULL_PATH_NAMES = YES
# will be relative from the directory where doxygen is started.
# This tag requires that the tag FULL_PATH_NAMES is set to YES.

STRIP_FROM_PATH = ../include
STRIP_FROM_PATH = ../app/src \

# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of the
# path mentioned in the documentation of a class, which tells the reader which
Expand Down Expand Up @@ -919,7 +919,7 @@ WARN_LOGFILE =

INPUT = _doxygen/main.md \
_doxygen/groups.dox \
../include
../app

# This tag can be used to specify the character encoding of the source files
# that doxygen parses. Internally doxygen uses the UTF-8 encoding. Doxygen uses
Expand Down
5 changes: 0 additions & 5 deletions drivers/CMakeLists.txt

This file was deleted.

6 changes: 0 additions & 6 deletions drivers/Kconfig

This file was deleted.

4 changes: 0 additions & 4 deletions drivers/sensor/CMakeLists.txt

This file was deleted.

6 changes: 0 additions & 6 deletions drivers/sensor/Kconfig

This file was deleted.

5 changes: 0 additions & 5 deletions drivers/sensor/example_sensor/CMakeLists.txt

This file was deleted.

Loading
Loading