Merge pull request #783 from eclipse-threadx/devv6.5.2.202603_rel

Merged changes ahead of the v6.5.2.202603 release

1 files changed, 45 insertions, 34 deletions

diff --git a/.github/workflows/ports_arch_check.yml b/.github/workflows/ports_arch_check.yml
index 4a99c032..334a5386 100644
--- a/.github/workflows/ports_arch_check.yml
+++ b/.github/workflows/ports_arch_check.yml
@@ -6,7 +6,10 @@ name: ports_arch_check
 # events but only for the master branch
 on:
   pull_request:
-    branches: [ master ]
+    # dev is included as well as master. The check only ever ran against master,
+    # so eight months of port fixes merged into dev without it, and the ports
+    # drifted from ports_arch unnoticed.
+    branches: [ master, dev ]
     paths:
       - ".github/workflows/ports_arch_check.yml"
       - 'common/**'
@@ -22,52 +25,60 @@ jobs:
   # Check ports for cortex-m
   cortex-m:
     # The type of runner that the job will run on
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - name: Checkout sources recursively
-      uses: actions/checkout@v2
-      with:
-        token: ${{ secrets.REPO_SCOPED_TOKEN }}
-        submodules: true
+    # No token input: secrets are not available to pull requests from forks, so
+    # passing one made this job fail at checkout with "Input required and not
+    # supplied: token" and the check never evaluated anything. The default
+    # GITHUB_TOKEN is enough to check out a public repository, and the
+    # repository has no submodules.
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
+    - name: Checkout sources
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    # Copy ports arch
-    - name: Copy ports arch
-      run: |
-        scripts/copy_armv7_m.sh && scripts/copy_armv8_m.sh && scripts/copy_module_armv7_m.sh
-        if [[ -n $(git status --porcelain -uno) ]]; then
-          echo "Ports for ARM architecture is not updated"
-          git status
-          exit 1
-        fi
+    # Check the port trees: the generated ports must be reproducible from
+    # ports_arch, and no port header may be left unbalanced or carrying code
+    # outside a function. The same script runs locally, so a contributor sees
+    # exactly what CI sees.
+    - name: Check ports
+      run: scripts/check_ports.sh
 
   cortex-a:
-    # Check ports for cortex-a
-    runs-on: windows-latest
+    # Check ports for cortex-a. This ran on Windows because the A profile
+    # tooling was PowerShell only; update.sh beside each update.ps1 means it
+    # runs on the same image as every other job now.
+    runs-on: ubuntu-24.04
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - name: Checkout sources recursively
-      uses: actions/checkout@v2
-      with:
-        token: ${{ secrets.REPO_SCOPED_TOKEN }}
-        submodules: true
+    # No token input: secrets are not available to pull requests from forks, so
+    # passing one made this job fail at checkout with "Input required and not
+    # supplied: token" and the check never evaluated anything. The default
+    # GITHUB_TOKEN is enough to check out a public repository, and the
+    # repository has no submodules.
+    - name: Checkout sources
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    # Copy ports arch
-    - name: Copy ports arch
+    # Regenerate the A profile ports and fail if anything changed, which means
+    # a generated port was edited directly instead of ports_arch.
+    - name: Check the Cortex-A ports
       run: |
-        cd ports_arch/ARMv7-A
-        pwsh -Command ./update.ps1 -PortSets tx -CopyCommonFiles -CopyPortFiles -CopyExample -PatchFiles
-        cd ../../ports_arch/ARMv8-A
-        pwsh -Command ./update.ps1 -PortSets tx,tx_smp -CopyCommonFiles -CopyPortFiles -CopyExample -PatchFiles
-        if ((git status --porcelain -uno) -ne $null) {
-          Write-Host "Ports for ARM architecture is not updated"
-          git status
-          Exit 1
-        }
+        (cd ports_arch/ARMv7-A && ./update.sh --port-sets tx \
+            --copy-common-files --copy-port-files --copy-example --patch-files)
+        (cd ports_arch/ARMv8-A && ./update.sh --port-sets tx,tx_smp \
+            --copy-common-files --copy-port-files --copy-example --patch-files)
+        if [[ -n $(git status --porcelain -uno) ]]; then
+          echo "The Cortex-A ports are not reproducible from ports_arch:"
+          git status --porcelain -uno
+          exit 1
+        fi