Various CI improvements - #461
Merged
Merged
Conversation
The incremental comparison falls back to the final commit when a pull request is first opened. This can hide an earlier container change and make the result depend on a previously published pull request image. Use the action defaults: pull requests are compared with their base branch, while pushes are compared with the previous remote head.
utils.sh is not copied into the Docker image, so changing the script cannot alter the container. It can alter firmware setup, compilation, and packaging, however. Move it to the firmware input group to avoid an unnecessary container build while still validating the resulting firmware.
The firmware allowlist must be updated whenever a new source tree, build manifest, binding, asset, or workflow is added. Missing an entry silently skips the build. Build for every changed file by default and exclude only documentation, Home Assistant tooling, and miscellaneous developer tools. Container changes still take the ordered container-and-firmware path.
The image-existence action does not define the result output consumed by the meta workflow. The value is always empty, so source-only builds use main even when the matching branch image exists. A complete pull request comparison no longer needs mutable PR images. Select the target branch image instead, using a manifest lookup to fall back to main when a release branch has no independent container yet.
Pull requests that change container inputs deliberately rebuild the container on every update so the firmware never uses stale tooling. Persist BuildKit layers in the GitHub Actions cache to make unchanged layers reusable across those builds. Configure the maintained Buildx setup action required to export the GitHub Actions cache. Pin its v4.2.0 commit instead of the mutable release tag, while recording the tag beside the reference for readability and automated updates.
Every container build still dumps its filesystem, identity, environment, and working directory. Its debug expression also refers to an input the reusable workflow does not define. Remove the bring-up diagnostics while retaining the working-directory, Git ownership, and ESP-IDF shell handling they helped establish.
tj-actions/changed-files release tags through v45 were retargeted to a malicious commit in March 2025. It exposed runner secrets in workflow logs. Continuing to trust the mutable v45 tag is unnecessary. Use the narrower paths-filter action and pin its reviewed v4.0.2 commit. It provides the two boolean path groups this workflow needs without the custom shell implementation or a mutable action reference.
The clang-format wrapper pulls a mutable container tag even when the action itself is pinned. Ubuntu 22.04 runners already provide the exact clang-format-15 release used by Willow, so invoke it directly. The EditorConfig wrapper has not been released since 2021. It installs an unpinned PyPI package and checks only the final commit. Use the maintained upstream setup action at an immutable commit and check the whole tree with a fixed editorconfig-checker release.
Update the GitHub and Docker actions to their current Node 24 releases. The hosted Ubuntu runners meet their minimum runner requirement, and the workflows do not use any of the options with changed behavior. Pin every action to the full release commit so retargeting a version tag cannot change the code executed by the workflow.
Update release-action within its compatible v1 series for the maintained Node 24 runtime and current GitHub API dependencies. Pin the exact release commit to prevent mutable-tag replacement in the publishing job.
Immutable action commits prevent tag retargeting from changing workflow code, but they also require an explicit update path. Ask Dependabot to open one grouped monthly update for GitHub Actions dependencies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.