Various CI improvements

.github/dependabot.yml

@@ -0,0 +1,11 @@
+---
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/build-container.yml

@@ -1,9 +1,6 @@
 ---
 name: build-container
 
-env:
-  GH_TOKEN: ${{ github.token }}
-
 on:
   workflow_call:
     inputs:
@@ -24,18 +21,23 @@ jobs:
       packages: write
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
       - name: build container
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
+          cache-from: type=gha,scope=willow-build-container
+          cache-to: type=gha,mode=max,scope=willow-build-container
           context: .
           file: ./Dockerfile
           push: true

.github/workflows/build-willow.yml

@@ -1,10 +1,6 @@
 ---
 name: build-willow
 
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
 on:
   workflow_call:
     inputs:
@@ -40,24 +36,7 @@ jobs:
       packages: read
     steps:
       - name: checkout
-        uses: actions/checkout@v4
-      - name: debug
-        run: echo ${{ inputs.container-tag }}
-      - name: ls -al
-        run: ls -al
-      - name: ls -al /
-        run: ls -al /
-      # fatal: detected dubious ownership in repository at '/willow'
-      - name: id
-        run: id
-      # ./utils.sh: line 193: idf.py: command not found
-      # - name: . $IDF_PATH/export.sh
-      #  run: . "$IDF_PATH/export.sh"
-      #  need to run it in the same step as utils.sh bloody hell
-      - name: env
-        run: env
-      - name: pwd
-        run: pwd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: add /willow to git safe directories
         run: git config --global --add safe.directory /willow
       # need to run with bash to avoid this error:
@@ -82,17 +61,17 @@ jobs:
         run: cd /willow/build && sha256sum "${{ env.dist_filename }}" > "${{ env.dist_filename }}.sha256sum.txt"
 
       - name: upload willow-dist.bin artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: "${{ env.dist_filename }}"
           path: "/willow/build/${{ env.dist_filename }}*"
       - name: upload willow-ota.bin artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: "${{ env.ota_filename }}"
           path: "/willow/build/${{ env.ota_filename }}*"
       - name: upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: "${{ env.partitions_filename }}"
           path: |
@@ -111,21 +90,15 @@ jobs:
       packages: read
     steps:
       - name: download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: '!*.dockerbuild'
 
-      - name: pwd
-        run: pwd
-
-      - name: find -ls
-        run: find -ls
-
       - name: create sha256sums.txt
         run: find -type f -name '*.sha256sum.txt' -exec cat {} + | sort -u > sha256sums.txt
 
       - name: create release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           allowUpdates: false
           artifacts: "sha256sums.txt,willow-dist-*/willow-dist-*.bin,willow-ota-*/willow-ota-*.bin"

.github/workflows/code-formatting.yml

@@ -7,19 +7,19 @@ jobs:
     name: clang-format
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: clang-format
-        uses: jidicula/clang-format-action@v4.14.0
-        with:
-          clang-format-version: 15
-          check-path: 'main'
+        run: |
+          git ls-files -z 'main/*.c' 'main/*.h' |
+              xargs -0 --no-run-if-empty clang-format-15 --dry-run --Werror
   editorconfig-checker:
     name: editorconfig-check
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - name: editorconfig-check
-        uses: wow-rp-addons/actions-editorconfig-check@v1.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: install editorconfig-checker
+        uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2.2.0
         with:
-          files: $(git log -1 --name-only --pretty='')
-
+          version: v3.8.0
+      - name: editorconfig-check
+        run: editorconfig-checker

.github/workflows/meta.yml

@@ -3,7 +3,6 @@ name: meta
 
 env:
   GHCR_URL: "ghcr.io/${{ github.repository }}"
-  GH_TOKEN: ${{ github.token }}
 
 on:
   pull_request:
@@ -19,10 +18,9 @@ jobs:
     name: trigger workflow based on changed files
     runs-on: ubuntu-22.04
     outputs:
-      check_container_image: ${{ steps.check_container_image.outputs.result }}
-      container_any_changed: ${{ steps.changed_files_yaml.outputs.container_any_changed }}
-      ghcr_url: ${{ steps.lower.outputs.ghcr_url }}
-      image_any_changed: ${{ steps.changed_files_yaml.outputs.image_any_changed }}
+      base_container_image: ${{ steps.base_container.outputs.image }}
+      container_any_changed: ${{ steps.paths.outputs.container }}
+      image_any_changed: ${{ steps.paths.outputs.image }}
       metadata_json: ${{ steps.metadata.outputs.json }}
       metadata_labels: ${{ steps.metadata.outputs.labels }}
       metadata_tags: ${{ steps.metadata.outputs.tags }}
@@ -32,62 +30,51 @@ jobs:
         run: |
           echo "ghcr_url=${GHCR_URL@L}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # fetch full history to be able to gather changed files in all new commits
+          # Compare pull requests with their base and pushes with their previous head.
           fetch-depth: 0
 
-      - uses: tj-actions/changed-files@v45
+      - name: detect changed build inputs
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         if: ${{ github.ref_type != 'tag' }}
-        id: changed_files_yaml
+        id: paths
         with:
-          files_yaml: |
+          base: ${{ github.ref_name }}
+          filters: |
             container:
               - '.github/workflows/build-container.yml'
               - 'Dockerfile'
               - 'container.gitconfig'
-              - 'utils.sh'
             image:
-              - 'CMakeLists.txt'
-              - 'main/**'
-              - 'partitions_willow.csv'
-              - 'sdkconfig.defaults'
-              - 'spiffs/**'
-          since_last_remote_commit: true
+              - '**'
+              - '!**/*.md'
+              - '!ha/**'
+              - '!misc/**'
 
       - name: extract metadata
         id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ steps.lower.outputs.ghcr_url }}
           tags: |
             type=ref,event=tag
             type=ref,event=pr
             type=ref,event=branch
 
-      - name: extract tag name
-        id: tag
+      - name: select base branch container
+        id: base_container
+        if: ${{ steps.paths.outputs.container == 'false' && steps.paths.outputs.image == 'true' }}
+        env:
+          BASE_REF: ${{ github.event_name == 'pull_request' && github.base_ref || github.ref_name }}
+          REGISTRY_IMAGE: ${{ steps.lower.outputs.ghcr_url }}
         run: |
-          tag=${{ fromJSON(steps.metadata.outputs.json).tags[0] }}
-          echo "tag=${tag##*:}" >> $GITHUB_OUTPUT
-
-      - name: debug
-        run: |
-          echo "${{ steps.metadata.outputs.json }}"
-          echo "${{ steps.tag.outputs.tag }}"
-
-      - uses: cloudposse/github-action-docker-image-exists@0.2.0
-        continue-on-error: true
-        id: check_container_image
-        if: ${{ steps.changed_files_yaml.outputs.container_any_changed == 'false' && steps.changed_files_yaml.outputs.image_any_changed == 'true' }}
-        with:
-          image_name: "${{ github.repository }}"
-          registry: ghcr.io
-          tag: "${{ steps.tag.outputs.tag }}"
-
-      - name: debug
-        run: |
-          echo "${{ steps.check_container_image.outputs.result }}"
+          tag=$(printf '%s' "$BASE_REF" | sed 's/[^A-Za-z0-9_.-]/-/g')
+          image="$REGISTRY_IMAGE:$tag"
+          if ! docker manifest inspect "$image" >/dev/null 2>&1; then
+              image="$REGISTRY_IMAGE:main"
+          fi
+          echo "image=$image" >> "$GITHUB_OUTPUT"
 
   build_container:
     if: ${{ needs.trigger_workflow.outputs.container_any_changed == 'true' || github.ref_type == 'tag' }}
@@ -103,4 +90,4 @@ jobs:
     uses: ./.github/workflows/build-willow.yml
     needs: trigger_workflow
     with:
-      container-image: ${{ needs.trigger_workflow.outputs.check_container_image && fromJSON(needs.trigger_workflow.outputs.metadata_json).tags[0] || format('{0}:main', needs.trigger_workflow.outputs.ghcr_url) }}
+      container-image: ${{ needs.trigger_workflow.outputs.base_container_image }}