Add CI check for duplicate firmware_image_type

On PRs, only entries changed vs the base are checked so the pre-existing duplicates don't block; an --all mode (wired up with the dedup PR) guards main.

Author: eakorolev

.github/workflows/test.yml

@@ -23,3 +23,20 @@ jobs:
           sudo apt-get install -y make python3 python3-pytest
       - name: Run tests
         run: make tests
+
+  image-types-changed:
+    # On PRs, check only entries changed vs the target branch, so pre-existing
+    # duplicates don't turn this permanently red. Re-fetches the base at run
+    # time, so re-running the PR validates against current main.
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Install dependencies
+        run: sudo apt-get update && sudo apt-get install -y make python3 && pip install pyyaml
+      - name: Check changed firmware_image_type entries
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          make tools/check_image_types_changed BASE_REF=origin/${{ github.base_ref }}

helper_scripts/check_image_types.py

@@ -0,0 +1,112 @@
+"""Check device_db.yaml for duplicate firmware_image_type values.
+
+Each device must own a unique firmware_image_type. OTA clients (notably zigpy /
+Home Assistant ZHA) match an image by manufacturerCode + imageType and refuse
+to choose when two images share both, so a duplicate silently breaks OTA for
+the colliding devices.
+
+Modes:
+  --changed BASE_REF
+      Only devices whose firmware_image_type is new or changed versus BASE_REF
+      are checked. Pre-existing duplicates do not fail, so this never turns red
+      on unrelated PRs; but no PR can claim an image type that is already taken.
+      Use on pull requests.
+
+  --all
+      Every device is checked; fails if ANY firmware_image_type is shared.
+      Use on the main branch to assert the whole db stays clean.
+"""
+import argparse
+import subprocess
+import sys
+
+import yaml
+
+DB = "device_db.yaml"
+
+
+def image_types(db):
+    result = {}
+    for name, fields in (db or {}).items():
+        if not isinstance(fields, dict):
+            continue
+        image_type = fields.get("firmware_image_type")
+        if image_type in (None, "null"):
+            continue
+        result[name] = image_type
+    return result
+
+
+def load_worktree():
+    with open(DB) as f:
+        return yaml.safe_load(f)
+
+
+def load_ref(ref):
+    blob = subprocess.run(
+        ["git", "show", f"{ref}:{DB}"], capture_output=True, text=True
+    )
+    if blob.returncode != 0:
+        print(f"warning: cannot read {DB} from {ref}, treating base as empty")
+        return {}
+    return yaml.safe_load(blob.stdout)
+
+
+def owners_by_type(head):
+    owners = {}
+    for name, image_type in head.items():
+        owners.setdefault(image_type, []).append(name)
+    return owners
+
+
+def fail(collisions):
+    print("firmware_image_type collisions:\n")
+    for image_type, devices in sorted(collisions.items()):
+        print(f"  {image_type}: {', '.join(sorted(devices))}")
+    print("\nEach device needs a unique firmware_image_type.")
+    print("Get the next free id with: make tools/unused_image_type")
+    sys.exit(1)
+
+
+def check_all(head):
+    owners = owners_by_type(head)
+    collisions = {it: devs for it, devs in owners.items() if len(devs) > 1}
+    if collisions:
+        fail(collisions)
+    print(f"OK: {len(head)} devices, all firmware_image_type values unique")
+
+
+def check_changed(head, base_ref):
+    base = image_types(load_ref(base_ref))
+    owners = owners_by_type(head)
+    changed = [name for name, it in head.items() if base.get(name) != it]
+    collisions = {}
+    for name in changed:
+        others = [o for o in owners[head[name]] if o != name]
+        if others:
+            collisions.setdefault(head[name], set()).update([name, *others])
+    if collisions:
+        fail(collisions)
+    print(f"OK: {len(changed)} added/changed entries checked against "
+          f"{base_ref}, no image_type collisions")
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Check firmware_image_type uniqueness in device_db.yaml")
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument("--all", action="store_true",
+                       help="check every device (use on main)")
+    group.add_argument("--changed", metavar="BASE_REF",
+                       help="check only entries changed vs BASE_REF (use on PRs)")
+    args = parser.parse_args()
+
+    head = image_types(load_worktree())
+    if args.all:
+        check_all(head)
+    else:
+        check_changed(head, args.changed)
+
+
+if __name__ == "__main__":
+    main()

tools.mk

@@ -19,6 +19,8 @@ help:
 	@echo ""
 	@echo "  Development Utilities:"
 	@echo "    unused_image_type      - Show next available firmware image type ID"
+	@echo "    check_image_types_changed - Fail if a changed device reuses an existing image type (PRs)"
+	@echo "    check_image_types_all     - Fail if the whole db has any duplicate image type (main)"
 	@echo ""
 
 
@@ -58,4 +60,12 @@ freeze_ota_links:
 
 
 unused_image_type:
-	@yq '[.[] | .firmware_image_type] | max + 1' device_db.yaml
+	@yq '[.[] | .firmware_image_type] | max + 1' device_db.yaml
+
+
+check_image_types_changed:
+	python3 helper_scripts/check_image_types.py --changed $(BASE_REF)
+
+
+check_image_types_all:
+	python3 helper_scripts/check_image_types.py --all