githubci.yml

name: Build

on:
  pull_request:
  merge_group:
  #  push:
  #  repository_dispatch:
  release:
    types:
      - created

# The repo's default is write (checked via `gh api .../actions/permissions/workflow`),
# so every job here would otherwise get a write-capable GITHUB_TOKEN even
# though only the release-asset upload needs one — and this workflow runs on
# every PR. Every job that runs PR-controlled code (make, the Python tools)
# is read-only and does not persist the checkout token; contents:write lives
# only in the `release` job, which runs on release events and only uploads
# what the build jobs already produced.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  set-matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set matrix
        id: set-matrix
        working-directory: src/boards
        run: |
          MATRIX_JSON=$(ls -d */ | sed 's/\/$//' | jq -R -s -c 'split("\n")[:-1]')
          echo "matrix=$MATRIX_JSON"
          echo "matrix=$MATRIX_JSON" >> $GITHUB_OUTPUT

  # The factory-erase UF2 is one file for every board, so it is checked in and
  # attached once by the `release` job rather than by each per-board build
  # job, which would race deleting and re-uploading the same asset name.
  # Not a required status check on master unless a human adds it to branch
  # protection.
  factory-erase-uf2:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check the committed file matches the generator
        run: |
          python3 tools/make_factory_erase_uf2.py /tmp/meshtastic_factory_erase.uf2
          cmp /tmp/meshtastic_factory_erase.uf2 tools/meshtastic_factory_erase.uf2

  build:
    needs: set-matrix
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        board: ${{ fromJSON(needs.set-matrix.outputs.matrix) }}
    steps:
    - name: Checkout Code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        fetch-depth: 0
        submodules: true
        persist-credentials: false

    - name: Install ARM GCC
      uses: carlosperate/arm-none-eabi-gcc-action@49f4db4520f840e77ab1e99b24cfac2c540a21b1 # v1.14.1
      with:
        release: '12.3.Rel1'

    - name: Install Tools
      run: |
        pip3 install adafruit-nrfutil uritemplate requests intelhex setuptools

    - name: Build
      run: |
        make BOARD=${{ matrix.board }} all
        make BOARD=${{ matrix.board }} copy-artifact

    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
      with:
        name: ${{ matrix.board }}
        path: _bin/${{ matrix.board }}
        retention-days: ${{ github.event_name == 'release' && 90 || 1 }}

  # The only job with write access. It runs no repo code: it re-uploads the
  # build jobs' artifacts and the checked-in factory-erase file.
  release:
    needs: [build, factory-erase-uf2]
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'release' }}
    permissions:
      contents: write
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download build artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          path: _bin

      - name: Upload Release Assets
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
        with:
          files: |
            _bin/*/*_bootloader-*.zip
            _bin/*/*_bootloader-*.hex
            _bin/*/update-*_bootloader-*.uf2
            tools/meshtastic_factory_erase.uf2