release.yml

name: Verify and release

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Check whitespace
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          if git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
            git diff --check "$BASE_SHA" "$GITHUB_SHA"
          else
            git diff-tree --check --root --no-commit-id -r "$GITHUB_SHA"
          fi
      - name: Test relay
        run: node --test relay/worker.test.mjs
      - name: Test storage helper
        run: |
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/storage_io.c tests/storage_io_test.c -o "$RUNNER_TEMP/storage_io_test"
          "$RUNNER_TEMP/storage_io_test"
      - name: Test storage failure boundaries
        run: python3 tools/test_storage_faults.py --compiler cc
      - name: Test CSV tail recovery
        run: python3 tools/test_storage_csv_tail.py --compiler cc
      - name: Test HTTP and MQTT metadata writes
        run: python3 tools/test_metadata_log.py --compiler cc
      - name: Test Notes storage
        run: python3 tools/test_notes_io.py --compiler cc
      - name: Test ride history storage
        run: python3 tools/test_ride_history.py --compiler cc
      - name: Test ride recording
        run: python3 tools/test_ride_recording.py --compiler cc
      - name: Test BLE evidence storage
        run: python3 tools/test_ble_evidence.py --compiler cc
      - name: Test Ring history storage
        run: python3 tools/test_ring_history.py --compiler cc
      - name: Test ebook pages
        run: python3 tools/test_ebook_pages.py --compiler cc
      - name: Test ebook library
        run: python3 tools/test_ebook_library.py --compiler cc
      - name: Test ebook downloads
        run: python3 tools/test_ebook_download.py --compiler cc

      - name: Test ebook worker lifecycle
        run: python3 tools/test_ebook_worker.py --compiler cc
      - name: Test capture writers
        run: python3 tools/test_capture_write.py --compiler cc
      - name: Test serial log writers
        run: python3 tools/test_serial_log_write.py --compiler cc
      - name: Test Files text previews
        run: python3 tools/test_file_preview.py --compiler cc
      - name: Test Files directories
        run: python3 tools/test_files_directory.py --compiler cc
      - name: Test capture reader
        run: |
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/capture_data.c tests/capture_data_test.c -o "$RUNNER_TEMP/capture_data_test"
          "$RUNNER_TEMP/capture_data_test"
      - name: Test serial log reader
        run: |
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/serial_log_data.c tests/serial_log_data_test.c -o "$RUNNER_TEMP/serial_log_data_test"
          "$RUNNER_TEMP/serial_log_data_test"
      - name: Test I2C register transactions
        run: |
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I tests/i2c_host -I main main/i2c_register.c tests/i2c_register_test.c -o "$RUNNER_TEMP/i2c_register_test"
          "$RUNNER_TEMP/i2c_register_test"
      - name: Check Python tools
        run: |
          python3 -m compileall -q tools
          python3 tools/remote_desktop.py --self-test
          python3 tools/modbus_test_server.py --self-test
          python3 tools/udp_device_fixture.py --self-test
          python3 tools/test_ota_result.py --compiler cc
          python3 tests/http_fixture_test.py
          python3 tests/dns_fixture_test.py
          python3 tests/board_config_test.py
      - name: Test bounded ping worker
        run: |
          for ipv6 in 0 1; do
            cc -std=c11 -Wall -Wextra -Werror -pedantic -DLWIP_IPV6=$ipv6 -I tests/network_ping_host/stubs -I main main/network_ping.c tests/network_ping_host/ping_test.c -o "$RUNNER_TEMP/network_ping_test"
            "$RUNNER_TEMP/network_ping_test"
          done
      - name: Test resolver dispatch deadlines
        run: python3 tools/test_resolver_dispatch.py --compiler cc
      - name: Test app calculations and protocol parsing
        run: |
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/payload_clipboard.c tests/payload_clipboard_test.c -o "$RUNNER_TEMP/payload_clipboard_test"
          "$RUNNER_TEMP/payload_clipboard_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/uart_data.c tests/uart_data_test.c -o "$RUNNER_TEMP/uart_data_test"
          "$RUNNER_TEMP/uart_data_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/ipv4_data.c tests/ipv4_data_test.c -o "$RUNNER_TEMP/ipv4_data_test"
          "$RUNNER_TEMP/ipv4_data_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/electronics_math.c tests/electronics_math_test.c -lm -o "$RUNNER_TEMP/electronics_math_test"
          "$RUNNER_TEMP/electronics_math_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/byte_data.c tests/byte_data_test.c -lm -o "$RUNNER_TEMP/byte_data_test"
          "$RUNNER_TEMP/byte_data_test"
          python3 tests/byte_reference_test.py "$RUNNER_TEMP/byte_data_test"
          python3 tests/byte_encode_reference_test.py "$RUNNER_TEMP/byte_data_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/modbus_data.c main/byte_data.c tests/modbus_data_test.c -lm -o "$RUNNER_TEMP/modbus_data_test"
          "$RUNNER_TEMP/modbus_data_test"
          python3 tests/modbus_reference_test.py "$RUNNER_TEMP/modbus_data_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/modbus_data.c main/byte_data.c tests/modbus_rtu_test.c -lm -o "$RUNNER_TEMP/modbus_rtu_test"
          "$RUNNER_TEMP/modbus_rtu_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/ntp_data.c tests/ntp_data_test.c -lm -o "$RUNNER_TEMP/ntp_data_test"
          "$RUNNER_TEMP/ntp_data_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/wol_data.c main/ipv4_data.c tests/wol_data_test.c -o "$RUNNER_TEMP/wol_data_test"
          "$RUNNER_TEMP/wol_data_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/subnet_data.c main/ipv4_data.c tests/subnet_data_test.c -o "$RUNNER_TEMP/subnet_data_test"
          "$RUNNER_TEMP/subnet_data_test"
          python3 tests/subnet_reference_test.py "$RUNNER_TEMP/subnet_data_test"
          cc -std=c11 -Wall -Wextra -Werror -pedantic -I main main/resistor_data.c tests/resistor_data_test.c -lm -o "$RUNNER_TEMP/resistor_data_test"
          "$RUNNER_TEMP/resistor_data_test"

      - name: Retain resolver dispatch evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: resolver-dispatch-logs
          path: |
            build/resolver-dispatch/compile-*.log
            build/resolver-dispatch/result-*.log
            build/resolver-dispatch/source.json
            build/resolver-dispatch/sources/
          if-no-files-found: warn
          retention-days: 14
      - name: Retain OTA result test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ota-result-logs
          path: |
            build/ota-result/compile.log
            build/ota-result/result.log
            build/ota-result/source.json
            build/ota-result/ota_result.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain metadata write test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: metadata-log-logs
          path: |
            build/metadata-log/http-compile.log
            build/metadata-log/mqtt-compile.log
            build/metadata-log/http-result.log
            build/metadata-log/mqtt-result.log
            build/metadata-log/source.json
            build/metadata-log/http_log.inc
            build/metadata-log/mqtt_log.inc
            build/metadata-log/http_log_types.inc
            build/metadata-log/mqtt_log_types.inc
            build/metadata-log/http_log_config.inc
            build/metadata-log/mqtt_log_config.inc
            build/metadata-log/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain storage failure test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: storage-faults-logs
          path: |
            build/storage-faults/compile.log
            build/storage-faults/result.log
            build/storage-faults/source.json
            build/storage-faults/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain CSV recovery test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: storage-csv-tail-logs
          path: |
            build/storage-csv-tail/compile.log
            build/storage-csv-tail/result.log
            build/storage-csv-tail/source.json
            build/storage-csv-tail/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain Notes storage test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: notes-io-logs
          path: |
            build/notes-io/compile.log
            build/notes-io/result.log
            build/notes-io/source.json
            build/notes-io/notes_callbacks.inc
            build/notes-io/notes_config.inc
            build/notes-io/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain ride history test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ride-history-logs
          path: |
            build/ride-history/compile.log
            build/ride-history/result.log
            build/ride-history/source.json
            build/ride-history/ride_history.inc
            build/ride-history/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain ride recording evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ride-recording-logs
          path: |
            build/ride-recording/compile.log
            build/ride-recording/result.log
            build/ride-recording/source.json
            build/ride-recording/ride_recording.inc
            build/ride-recording/ride_recording_config.inc
            build/ride-recording/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain BLE evidence storage checks
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ble-evidence-logs
          path: |
            build/ble-evidence/compile.log
            build/ble-evidence/result.log
            build/ble-evidence/source.json
            build/ble-evidence/ble_evidence.inc
            build/ble-evidence/ble_evidence_types.inc
            build/ble-evidence/ble_evidence_config.inc
            build/ble-evidence/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain Ring history test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ring-history-logs
          path: |
            build/ring-history/compile.log
            build/ring-history/result.log
            build/ring-history/source.json
            build/ring-history/ring_history.inc
            build/ring-history/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain ebook page test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ebook-pages-logs
          path: |
            build/ebook-pages/compile.log
            build/ebook-pages/result.log
            build/ebook-pages/source.json
            build/ebook-pages/ebook_pages.inc
            build/ebook-pages/ebook_config.inc
            build/ebook-pages/reader_initialization.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain ebook library evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ebook-library-logs
          path: |
            build/ebook-library/compile.log
            build/ebook-library/result.log
            build/ebook-library/source.json
            build/ebook-library/ebook_library.inc
            build/ebook-library/ebook_library_config.inc
            build/ebook-library/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain ebook download evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ebook-download-logs
          path: |
            build/ebook-download/compile.log
            build/ebook-download/result.log
            build/ebook-download/source.json
            build/ebook-download/ebook_download.inc
            build/ebook-download/ebook_download_types.inc
            build/ebook-download/ebook_download_config.inc
            build/ebook-download/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain ebook worker evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ebook-worker-logs
          path: |
            build/ebook-worker/compile.log
            build/ebook-worker/result.log
            build/ebook-worker/source.json
            build/ebook-worker/ebook_worker.inc
            build/ebook-worker/ebook_worker_types.inc
            build/ebook-worker/ebook_worker_signals.inc
            build/ebook-worker/ebook_worker_config.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain capture writer evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: capture-write-logs
          path: |
            build/capture-write/compile.log
            build/capture-write/result.log
            build/capture-write/source.json
            build/capture-write/capture_write.inc
            build/capture-write/capture_write_config.inc
            build/capture-write/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain serial log writer evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: serial-log-write-logs
          path: |
            build/serial-log-write/compile.log
            build/serial-log-write/result.log
            build/serial-log-write/source.json
            build/serial-log-write/serial_log_write.inc
            build/serial-log-write/serial_log_config.inc
            build/serial-log-write/storage_source.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain Files text preview evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: file-preview-logs
          path: |
            build/file-preview/compile.log
            build/file-preview/result.log
            build/file-preview/source.json
            build/file-preview/file_preview.inc
            build/file-preview/file_preview_config.inc
          if-no-files-found: warn
          retention-days: 14

      - name: Retain Files directory evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: files-directory-logs
          path: |
            build/files-directory/compile.log
            build/files-directory/result.log
            build/files-directory/source.json
            build/files-directory/files_directory.inc
            build/files-directory/files_directory_config.inc
          if-no-files-found: warn
          retention-days: 14

  firmware:
    runs-on: ubuntu-latest
    container: espressif/idf:v5.4.2
    steps:
      - uses: actions/checkout@v4
      - name: Clean ESP-IDF build
        shell: bash
        env:
          MINIMUM_PREDECESSOR: v0.5.1
        run: |
          set -o pipefail
          . "$IDF_PATH/export.sh"
          REF_VERSION="${GITHUB_REF_NAME//\//-}"
          PROJECT_VER="${REF_VERSION:0:22}-${GITHUB_SHA:0:8}"
          idf.py set-target esp32p4
          idf.py -D PROJECT_VER="$PROJECT_VER" build
          idf.py size | tee build/image-size.txt
          {
            echo '### Firmware size'
            echo '```text'
            cat build/image-size.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            if ! [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
              echo "::error::Release tags must use vMAJOR.MINOR.PATCH with an optional prerelease suffix"
              exit 1
            fi
            IMAGE_SIZE="$(stat -c %s build/tab5_os.bin)"
            IMAGE_SHA256="$(sha256sum build/tab5_os.bin | cut -d' ' -f1)"
            RELEASE_CHANNEL=stable
            [[ "$GITHUB_REF_NAME" == *-* ]] && RELEASE_CHANNEL=beta
            PROJECT_VER="$PROJECT_VER" IMAGE_SIZE="$IMAGE_SIZE" IMAGE_SHA256="$IMAGE_SHA256" \
              RELEASE_CHANNEL="$RELEASE_CHANNEL" \
              python3 - <<'PY'
          import json
          import os
          from pathlib import Path

          tag = os.environ["GITHUB_REF_NAME"]
          manifest = {
              "schema": 1,
              "version": os.environ["PROJECT_VER"],
              "hardware": "m5stack-tab5",
              "size": int(os.environ["IMAGE_SIZE"]),
              "sha256": os.environ["IMAGE_SHA256"],
              "url": f"https://github.com/{os.environ['GITHUB_REPOSITORY']}/releases/download/{tag}/tab5_os.bin",
              "channel": os.environ["RELEASE_CHANNEL"],
              "minimum_predecessor": os.environ["MINIMUM_PREDECESSOR"],
          }
          Path("build/tab5_os.json").write_text(json.dumps(manifest, indent=2) + "\n", encoding="ascii")
          PY
            idf.py -D PROJECT_VER="$PROJECT_VER" merge-bin -o tab5_os_factory.bin -f raw --fill-flash-size 16MB
            cp LICENSE THIRD_PARTY_NOTICES.md dependencies.lock build/
            cp managed_components/lvgl__lvgl/LICENCE.txt build/LVGL_LICENSE.txt
            cp managed_components/lvgl__lvgl/COPYRIGHTS.md build/LVGL_COPYRIGHTS.md
            (cd build && sha256sum tab5_os.bin tab5_os_factory.bin tab5_os.json LICENSE \
              THIRD_PARTY_NOTICES.md dependencies.lock LVGL_LICENSE.txt LVGL_COPYRIGHTS.md > SHA256SUMS)
          fi
      - shell: bash
        run: test -s build/tab5_os.bin
      - name: Package native UI source dependencies
        shell: bash
        run: python3 tools/package_native_ui_sources.py --idf-path "$IDF_PATH"
      - uses: actions/upload-artifact@v4
        with:
          name: native-ui-sources
          path: build/native-ui-sources.tar.gz
          if-no-files-found: error
          retention-days: 7
      - uses: actions/upload-artifact@v4
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          name: firmware
          path: |
            build/tab5_os.bin
            build/tab5_os_factory.bin
            build/tab5_os.json
            build/SHA256SUMS
            build/LICENSE
            build/THIRD_PARTY_NOTICES.md
            build/dependencies.lock
            build/LVGL_LICENSE.txt
            build/LVGL_COPYRIGHTS.md
          if-no-files-found: error

  native-ui:
    needs: firmware
    runs-on: windows-2025
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: native-ui-sources
          path: build
      - name: Extract pinned source dependencies
        shell: pwsh
        run: |
          tar -xzf build/native-ui-sources.tar.gz
          if ($LASTEXITCODE) { throw 'Native UI source extraction failed.' }
          Get-Content build/native-ui-sources.json
      - name: Test offline apps, network consoles and OTA manifests/images
        shell: pwsh
        run: ./tools/test_native_ui_ci.ps1
      - name: Test Notes with real LVGL
        shell: pwsh
        run: python tools/test_notes_io.py --compiler clang --lvgl-library build/offline-ui/out/lvgl_host.lib --output build/notes-ui
      - name: Test CSV viewers with real LVGL
        shell: pwsh
        run: python tools/test_csv_viewer.py --compiler clang --lvgl-library build/offline-ui/out/lvgl_host.lib --output build/csv-viewer-ci
      - name: Test Modbus TCP with loopback peers
        shell: pwsh
        run: ./tools/test_modbus_network.ps1
      - name: Test UDP tools with loopback peers
        shell: pwsh
        run: ./tools/test_device_network.ps1
      - name: Retain UDP tool evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: device-network-logs
          path: |
            build/device-network/compile.log
            build/device-network/result.log
            build/device-network/source.json
            build/device-network/*-wire.json
            build/device-network/sources/
          if-no-files-found: warn
          retention-days: 14
      - name: Retain Modbus TCP evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: modbus-network-logs
          path: |
            build/modbus-network/compile.log
            build/modbus-network/result.log
            build/modbus-network/source.json
            build/modbus-network/*-wire.json
            build/modbus-network/sources/
          if-no-files-found: warn
          retention-days: 14
      - name: Retain CSV viewer UI evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: csv-viewer-logs
          path: |
            build/csv-viewer-ci/compile.log
            build/csv-viewer-ci/result.log
            build/csv-viewer-ci/source.json
            build/csv-viewer-ci/capture_viewer.c
            build/csv-viewer-ci/capture_data.c
            build/csv-viewer-ci/serial_log_viewer.c
            build/csv-viewer-ci/serial_log_data.c
            build/csv-viewer-ci/payload_clipboard.c
          if-no-files-found: warn
          retention-days: 14
      - name: Retain Notes UI test evidence
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: notes-ui-logs
          path: |
            build/notes-ui/compile.log
            build/notes-ui/result.log
            build/notes-ui/source.json
            build/notes-ui/notes_callbacks.inc
            build/notes-ui/notes_config.inc
            build/notes-ui/storage_source.inc
          if-no-files-found: warn
          retention-days: 14
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: native-ui-logs
          path: |
            build/offline-ui/ci.log
            build/native-ui.log
            build/mqtt-ui/*.log
            build/mqtt-ui/wire-fixtures/
            build/mqtt-network/*.log
            build/mqtt-network/*-wire.json
            build/mqtt-network/client-checks.json
            build/mqtt-network/storage-app-*/MQTTLOG.CSV
            build/http-network/*.log
            build/http-network/storage-*/HTTP/HTTPLOG.CSV
            build/network-ui/ci.log
            build/network-ui/dns-*/*.log
            build/ota-manifest/*.log
            build/ota-image/*.log
            build/ota-image/*-wire.json
            build/ota-image/image-checks.json
            build/ota-image/fixture.bin
            build/native-ui-sources.json
          if-no-files-found: warn
          retention-days: 14

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [checks, firmware, native-ui]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: firmware
          path: firmware
      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          options=()
          [[ "$GITHUB_REF_NAME" == *-* ]] && options+=(--prerelease)
          gh release create "$GITHUB_REF_NAME" firmware/* --repo "$GITHUB_REPOSITORY" \
            --generate-notes --title "Tab5 OS $GITHUB_REF_NAME" "${options[@]}"