* CI: guard PRs and their linked issues against the Backlog milestone
Anything with an implementation belongs in the release it ships in. A PR
parked on Backlog - or on no milestone at all - drops out of the release
notes and out of the milestone-per-release tracking, and so does an issue
that is actively being implemented.
The check fails when the PR has no milestone or sits on Backlog, and when
any issue the PR closes does the same. Linked issues come from GitHub's own
closingIssuesReferences rather than from grepping the description, so it
sees exactly what the merge will close; a PR that closes nothing is fine.
Issues nobody is implementing are never looked at - they may stay in
Backlog or be closed with a reason.
Nothing is checked out and every permission is read-only, so plain
pull_request stays safe for fork PRs. milestoned/demilestoned are in the
trigger list so setting the milestone re-runs the check by itself.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* CI: close the fail-open paths in the milestone guard
Review of #1162 found three ways the guard could pass a PR it had not
actually checked.
grep read the milestone title as its own options when the title started
with a dash, exited 2, and is_blocked reported "not blocked" - a guard
failing open. The blocklist is now normalised once, with blank lines
stripped (an empty line made is_blocked "" return true, harmless only
because both callers tested for empty first) and matched with `--`. An
empty list now refuses to run instead of silently passing everything.
closingIssuesReferences was capped at 50 with nothing reading totalCount,
so references past the cap vanished. The count is now fetched and
exceeding it fails. A row the loop cannot parse used to be skipped
silently; it now reports. Merging stderr into the captured data meant a
stray gh warning became a data row and suppressed the "closes nothing"
line, so stderr goes to its own file - which also lets the annotation lead
with gh's one-line reason instead of 400 characters of raw JSON body.
Cross-repo issues warn rather than notice: skipping one is a real pass for
an unchecked issue. The PR and issue branches were identical bar their
wording and are now one helper.
Comments: the security note credited the permissions block for fork-PR
safety. A fork ships its own copy of this file - what protects us is
GitHub capping the token read-only, as pr-build.yml already says. Also
corrected the claim that only Closes/Fixes are seen (every closing keyword
and sidebar links are) and documented the cross-repo carve-out.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* CI: run the milestone guard through github-script
Most of the step was transport, not logic: build a query string, shell out
to gh, flatten objects to TSV, smuggle totalCount in as the first output
line, capture stderr to a temp file, reverse-engineer gh's error layout for
a readable reason, check that line one is a number, re-split TSV in a read
loop. actions/github-script is already a dependency here (pr-comment.yml)
and hands back an object, so all of that goes.
It also deletes the row contract that lived in three places at once - the
jq projection, the head/tail split and the field unpacking. Adding a field
to the query and forgetting the unpacking would have shifted a column into
the milestone variable, where an unrecognised title reads as "not blocked"
and the check passes a PR it should fail, green and silent.
Three things that were awkward in bash and are now cheap:
The PR's own milestone comes from the API rather than the event payload, so
both halves of the check are equally fresh. A re-run from the Checks tab
replays the original payload, which is the one workflow the file tells
people to use for a changed issue milestone.
The call is retried twice on a 5xx or a dropped connection. It runs on
every push, so at roughly a thousand calls per release cycle even a rare
transient becomes a red X no contributor can clear. A GraphQL error is the
server answering rather than failing, so those are not retried.
A milestone that is neither blocked nor unlshd-NNN now warns. A deny-list
cannot tell a new release from a new parking lot, and a typo'd unlshd-94
passed silently before. Warning rather than failing keeps the policy where
it was: contributors cannot set milestones, so a red X they are not allowed
to clear is worse than a leaked unusual milestone.
Error text now addresses the maintainer, since triage permission is what
setting a milestone needs. Documented that none of this gates anything
until "Release milestone" is a required status check.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Pushing straight to dev never worked: dev's push allowlist doesn't include
github-actions[bot], so the unlshd-090 run died on GH006 after doing all the
work. The bot can push its own branch, so the bump now lands as a PR from
ci/bump-issue-template-<tag> (force-pushed per tag, so a re-run refreshes the
open PR instead of stacking duplicates).
Also adds workflow_dispatch with a tag input to redo a release whose automatic
run failed, or to fix the dropdown at any other time. The release path keeps
its not-a-prerelease + unlshd-* gate; manual runs are checked by a new tag
validation step instead, since a typo would otherwise reach every bug reporter.
GITHUB_TOKEN events don't trigger workflows, so the PR gets no labeler or
template check of its own: the area/ci-build label is applied at creation and
the body already ticks the AI disclosure.
Needs "Allow GitHub Actions to create and approve pull requests" enabled. If
it isn't, the run fails naming that setting and links a compare URL for
opening the PR by hand -- the branch is pushed either way.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
PR template: port the "No AI assistance" option and the "tick exactly one" note
from all-the-plugins (xMasterX/all-the-plugins#249) so the two repos agree, and
add a check that fails the PR unless exactly one of the three boxes is ticked.
The check needs no token and checks out nothing (`permissions: {}`), so plain
`pull_request` is safe for forks; `edited` is in the trigger list so fixing the
description re-runs it.
pr-build.yml: #1052 bound github.head_ref/ref_name to env, but the branch name
still reached a `run:` block through steps.vars.outputs.ref/.dist, which the
"Assemble PR report" step interpolated. A branch named `x$(id)` still executed
there. Bind those outputs to env as well, and reduce SAFE_REF to
[A-Za-z0-9._-] instead of only replacing '/', so the outputs are inert for
every consumer. Artifact names are unchanged for ordinary branch names.
Pin the two third-party actions to commits: dessant/lock-threads runs with
issues+pull-requests write, and a mutable tag can be repointed at any time.
CodeQL runs are still reporting green, but every run carries a
failure-level annotation: "CodeQL Action major versions v1 and v2 have
been deprecated." It is running on a compatibility shim. Move all four
pins to v4, and bump checkout from v3 to v6 to match the rest of the
repo and clear the Node 20 deprecation warning. Drop
setup-python-dependencies, which the run log confirms has had no effect
since CodeQL 2.16. Add a concurrency group so back-to-back pushes to dev
no longer run several full firmware builds plus analyses at once.
pr-comment.yml trusted pr_number.txt from the report artifact and
validated it only as an integer. That artifact is written by a job that
checks out and runs the PR's own code, so both the comment body and its
destination were attacker-controlled: a malicious fork PR could make the
privileged commenter post arbitrary markdown onto any open thread in the
repo. Check the named PR's head SHA against the triggering run's
head_sha, which comes from the event payload and cannot be forged, and
refuse to comment on a mismatch.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This reverts commit d71868364f.
The stale closed-thread backlog was locked silently beforehand, so the
restored daily lock-threads bot only comments on newly-idle threads
instead of re-flooding old ones.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Daily dessant/lock-threads@v6 sweep + manual dispatch. Locks only closed
threads that have been inactive for 14 days; never closes anything and open
threads are untouched. Leaves a comment pointing users to open a fresh issue.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a workflow that, when a stable `unlshd-*` release is published, rewrites
the bug-report template's "Found in version" dropdown to keep exactly one
stable option (the new release tag) + "dev", then commits it to dev.
- Prerelease/non-unlshd tags are skipped.
- Surgical regex edit (minimal one-line diff), validated with yq before commit.
- Pushes via GITHUB_TOKEN don't retrigger CI; [ci skip] added to match convention.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci: post Build & analyze report on fork PRs via workflow_run
The Comment PR report step in pr-build.yml fails with 403 "Resource not
accessible by integration" on fork PRs: GitHub gives `pull_request` runs
from forks a read-only GITHUB_TOKEN (they build untrusted code), so
issues.createComment is forbidden and the whole f7 build check goes red
even though the firmware built fine.
Split delivery from analysis:
- pr-build.yml keeps all build/size/API analysis on the fork's code with
the read-only token, but instead of commenting it uploads the assembled
report + PR number as the `pr-report` artifact. Drops pull-requests:write.
- pr-comment.yml (new) is triggered on workflow_run when the build
completes. It runs from the default branch in the base-repo context, so
it gets a read-write token even for fork-triggered builds, downloads the
artifact, and posts/updates the comment. It never checks out or runs PR
code. The PR number travels via the artifact because
workflow_run.pull_requests is empty for fork PRs.
Same-repo PRs keep working; fork PRs now get the report comment a few
seconds later, and the build check is no longer falsely red.
Closes#1026
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci: harden fork-PR comment workflow after review
Review + simplify pass on the workflow_run split:
- pr-comment.yml: add `actions: read` — an explicit permissions block sets
unlisted scopes to none, and a cross-run download-artifact needs it; without
it the download 403s, continue-on-error swallows it, and the comment silently
never posts. This is the fix that makes the feature actually work on forks.
- pr-comment.yml: skip cancelled/skipped builds in the job `if`, and warn (job
annotation) when the artifact can't be downloaded, so a genuine failure isn't
a green check with no comment and no signal.
- pr-comment.yml: add a concurrency group (keyed on the build run id, since
workflow_run.pull_requests is empty for forks) so a re-run can't race the
find-or-create into duplicate comments; log incomplete artifact at warning,
not info; per_page:100 on listComments to cut pagination round-trips.
- pr-build.yml: mark the report upload continue-on-error so a transient upload
hiccup can't redden an otherwise-green build (the point of the split); fix
two comment overstatements (push/dispatch summary omits the PR-only API
section; concurrency also covers pushes to dev).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds actions/labeler config + workflow that tags each PR with the
relevant area/* label(s) based on the files it touches, so the
subsystem taxonomy stays applied to PRs without manual effort.
- sync-labels is off: labels are only added, never stripped, so
hand-applied labels are preserved.
- Uses pull_request_target so PRs from forks can be labeled; the
workflow never checks out or executes PR code.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* removed all continue-on-error lines
* Github: add assets deployment after format
Co-authored-by: Konstantin Volkov <k.volkov@flipperdevices.com>
Co-authored-by: あく <alleteam@gmail.com>
* fbt: fixed py scripts for gdb
* fbt: removed compiled dolphin assets from tracked files; resolved cached dependency issues by globally disabling deps cache; changed dependency tracking for dolphin assets
* fbt: fix for "resources" node lookup
* toolchain: bump to v.16 with scons + x64 win binaries
* fbt: using scons from toolchain
* vscode: fixed paths for 64-bit Windows toolchain
* fbt: added colors!
* fbt: moved import validator to ansi lib coloring
* fbt: moved COMSTR vars to tools
* fbt: custom action for fap dist
* fbt: added OPENOCD_ADAPTER_SERIAL configuration var for openocd operations
* fbt: added get_stlink target
* docs: details on libs for faps
* vscode: added DAP config for using Flipper as a debugger for a 2nd Flipper
* fbt: blind deps fix for sdk_origin
* fbt: sdk: moved deployment actions to pure python
* Github: disable disableLicenseExpirationCheck option for pvs
Co-authored-by: Aleksandr Kutuzov <alleteam@gmail.com>
* fix quotes in amap
* try to fix quotes
* try to read "commit_message"
* Add new actions anv parser
* fix amap_anayse
* fix script ssl error
* test build with new get commit details method
* fix build.yml
* add fbt envs to get_env.py
* fix envs
* using new commit info "way"
* try to fix report link in PR page
* fix "pvs_studio.yml" again
* fix vars
* fix "build.yml"
Co-authored-by: あく <alleteam@gmail.com>
* enable sparseCheckout, moving github actions from docker to raw shell
* fix missing known_hosts while setting ssh priv key
* fix build.yml
* add ssh key to upload just in time
* fixing rsync syntax
* fix build.yml
* try to fix build.yml again
* testing rsync
* test rsync again
* add linters
* add Black Python linter to submodules
* add Black submodule
* add working python linter target, dirty file list
* up toolchain to version 4
* up toolchain to ver 5
* up toolchain version to 6
* fbt: using black 22.6.0
* remove Black submodule, up toolchain to ver 7
* fbt: added lint_py, format_py targets
* add pvs_studio workflow
* fix pvs_studio segfault
* fix pvs_studio command
* fix pvs_studio command 2
* show env before run pvs_studio
* try to debug pvs_studio
* try to strace pvs_studio..
* Add FBT_TOOLCHAIN_PATH, MacOS Rosseta check, and ignore non-x86_64 linux architectures
* prevent redownloading toolchain on github-runners
* fix toolchain download exitcode
* add strace to debug pvs_studio segfault
* disable strace to catch full code dump
* Add './fbt cli' target to access Flipper CLI via PySerial
* remove pvs_studio from this PR
* removing clang-format from toolchain due errors
* make source easy, and fix some mistakes found by @hedger
* Add check_submodules workflow, some fixes
* fixing mistakes
Co-authored-by: hedger <hedger@nanode.su>
Co-authored-by: hedger <hedger@users.noreply.github.com>
* Fixing compiler warnings with -Wextra
* More warnings suppression, WIP
* Even more warning fixes
* Added new lines at end of text files.
* Padding fix
* Additional fixes to warnings on different build configurations; added -Wextra to default build pipeline
* Fixes for Secplus v1
* -additional warnings
* +-Wredundant-decls fixes
* FuriHal: print stack overflow task name in console
* FuriHal: add missing include
Co-authored-by: Aleksandr Kutuzov <alleteam@gmail.com>
* C2OTA: wip
* Update Cube to 1.13.3
* Fixed prio
* Functional Core2 updater
* Removed hardware CRC usage; code cleanup & linter fixes
* Moved hardcoded stack params to copro.mk
* Fixing CI bundling of core2 fw
* Removed last traces of hardcoded radio stack
* OB processing draft
* Python scripts cleanup
* Support for comments in ob data
* Sacrificed SD card icon in favor of faster update. Waiting for Storage fix
* Additional handling for OB mismatched values
* Description for new furi_hal apis; spelling fixes
* Rework of OB write, WIP
* Properly restarting OB verification loop
* Split update_task_workers.c
* Checking OBs after enabling post-update mode
* Moved OB verification before flashing
* Removed ob.data for custom stacks
* Fixed progress calculation for OB
* Removed unnecessary OB mask cast
Co-authored-by: Aleksandr Kutuzov <alleteam@gmail.com>
