Bring back EKU verifications #69
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Firmware | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: esp32c5 | |
| variant: esp32c5 | |
| flash_size: 4MB | |
| - target: esp32c6 | |
| variant: esp32c6 | |
| flash_size: 4MB | |
| - target: esp32p4 | |
| board: waveshare_lcd_4b | |
| variant: esp32p4_waveshare_lcd_4b | |
| flash_size: 32MB | |
| - target: esp32p4 | |
| board: dfr1172_firebeetle | |
| variant: esp32p4_dfr1172_firebeetle | |
| flash_size: 16MB | |
| container: | |
| image: espressif/idf:v5.5.1 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build firmware | |
| shell: bash | |
| run: | | |
| . $IDF_PATH/export.sh | |
| if [ -n "${{ matrix.board }}" ]; then | |
| idf.py @boards/${{ matrix.board }}.cfg set-target ${{ matrix.target }} | |
| else | |
| idf.py set-target ${{ matrix.target }} | |
| fi | |
| idf.py build | |
| - name: Create merged firmware binary | |
| shell: bash | |
| run: | | |
| . $IDF_PATH/export.sh | |
| cd build | |
| esptool.py --chip ${{ matrix.target }} merge_bin \ | |
| -o wendy_mcu_${{ matrix.variant }}.bin \ | |
| --flash_mode dio \ | |
| --flash_size ${{ matrix.flash_size }} \ | |
| @flash_args | |
| - name: Upload build artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: wendy_mcu_${{ matrix.variant }} | |
| path: build/wendy_mcu_${{ matrix.variant }}.bin | |
| nightly: | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| - name: Update nightly release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| # Delete existing nightly release and tag if present | |
| gh release delete nightly --yes --cleanup-tag 2>/dev/null || true | |
| # Create new nightly pre-release at current commit | |
| gh release create nightly \ | |
| --prerelease \ | |
| --title "Nightly" \ | |
| --notes "Automated nightly build from \`main\` ($(date -u '+%Y-%m-%d %H:%M UTC')), commit ${{ github.sha }}" \ | |
| wendy_mcu_esp32c5/wendy_mcu_esp32c5.bin \ | |
| wendy_mcu_esp32c6/wendy_mcu_esp32c6.bin \ | |
| wendy_mcu_esp32p4_waveshare_lcd_4b/wendy_mcu_esp32p4_waveshare_lcd_4b.bin \ | |
| wendy_mcu_esp32p4_dfr1172_firebeetle/wendy_mcu_esp32p4_dfr1172_firebeetle.bin | |
| release: | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| - name: Attach firmware to release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| wendy_mcu_esp32c5/wendy_mcu_esp32c5.bin | |
| wendy_mcu_esp32c6/wendy_mcu_esp32c6.bin | |
| wendy_mcu_esp32p4_waveshare_lcd_4b/wendy_mcu_esp32p4_waveshare_lcd_4b.bin | |
| wendy_mcu_esp32p4_dfr1172_firebeetle/wendy_mcu_esp32p4_dfr1172_firebeetle.bin | |
| # Publish firmware to the GCS bucket + manifests that `wendy os install` | |
| # reads from (firmware/<chip>/<version>/ and manifests/<chip>.json + | |
| # manifests/master.json). Mirrors the OS-image publish flow in | |
| # wendylabsinc/meta-wendyos-jetson by reusing its tools/publisher CLI. | |
| # Tag-triggered (stable releases) only. | |
| publish: | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # required for GCP workload-identity federation | |
| steps: | |
| - name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} | |
| - name: Set up Cloud SDK | |
| uses: google-github-actions/setup-gcloud@v2 | |
| # The publisher lives in the WendyOS builder repo so the OS and firmware | |
| # publish paths share one tool. Needs a token with read access to it. | |
| - name: Check out publisher tool | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: wendylabsinc/meta-wendyos-jetson | |
| path: builder | |
| token: ${{ secrets.PUBLISHER_REPO_TOKEN }} | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: builder/tools/publisher/go.mod | |
| cache-dependency-path: builder/tools/publisher/go.sum | |
| - name: Build publisher | |
| run: | | |
| cd builder/tools/publisher | |
| go build -o "$RUNNER_TEMP/publisher" . | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| - name: Publish firmware to GCS | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| # Tags are vX.Y.Z; GCS manifests use plain X.Y.Z. | |
| VERSION="${REF_NAME#v}" | |
| TOKEN="$(gcloud auth print-access-token)" | |
| # The variant name is the chip key that `wendy os install` queries. | |
| for variant in \ | |
| esp32c5 \ | |
| esp32c6 \ | |
| esp32p4_waveshare_lcd_4b \ | |
| esp32p4_dfr1172_firebeetle; do | |
| bin="wendy_mcu_${variant}/wendy_mcu_${variant}.bin" | |
| echo "Publishing ${variant} v${VERSION} from ${bin}" | |
| # Sequential loop keeps master.json writes serial (no race). | |
| "$RUNNER_TEMP/publisher" \ | |
| --firmware \ | |
| --chip "$variant" \ | |
| --version "$VERSION" \ | |
| --file "$bin" \ | |
| --notify-discord=false \ | |
| --access-token "$TOKEN" </dev/null | |
| done |