ci: pin cross-repo emulator compatibility

Author: BitHighlander

.circleci/config.yml

@@ -4,15 +4,22 @@ jobs:
   emulator-build-test:
     docker:
       - image: circleci/python:3.7      # upgrade to cimg/python:3.12 if you like
+    environment:
+      # Exact 7.14.2 production-code baseline. Later firmware commits on the
+      # release branch change only CI/reporting and the durable Python pin.
+      FIRMWARE_SHA: 5109f395413647df47237b8e69ad541faacb29df
     steps:
       # ────────────────────────────────────────────────────────────────
-      # 1) Clone the current branch of python-keepkey via HTTPS
+      # 1) Fetch the exact triggering python-keepkey commit via HTTPS
       # ────────────────────────────────────────────────────────────────
       - run:
-          name: Clone python-keepkey (current branch)
+          name: Checkout exact python-keepkey revision
           command: |
-            git clone --depth 1 -b "$CIRCLE_BRANCH" https://github.com/keepkey/python-keepkey.git .pykk
-            cd .pykk && git submodule update --init --recursive
+            git init .pykk
+            git -C .pykk remote add origin https://github.com/keepkey/python-keepkey.git
+            git -C .pykk fetch --depth 1 origin "$CIRCLE_SHA1"
+            git -C .pykk checkout --detach FETCH_HEAD
+            git -C .pykk submodule update --init --recursive
 
       # ────────────────────────────────────────────────────────────────
       # 2) Grab firmware repo and inject our fresh python-keepkey copy
@@ -27,8 +34,11 @@ jobs:
             # Move python-keepkey out of the way
             mv .pykk ../
 
-            # Clone firmware repository (expects $FIRMWARE_REPO env var)
-            git clone --depth 1 -b master "$FIRMWARE_REPO" .
+            # Fetch the exact reviewed 7.14.2 production-code baseline.
+            git init .
+            git remote add origin "$FIRMWARE_REPO"
+            git fetch --depth 1 origin "$FIRMWARE_SHA"
+            git checkout --detach FETCH_HEAD
 
             # Initialise firmware submodules
             git submodule update --init --recursive