diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 368cdf15..3996055f 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -1,8 +1,9 @@ # wolfTrust CI CI has a fast per-PR host lane, the tiered M33MU emulator matrix, and static -analysis. M33MU runs a per-port smoke set on every pull request and the full -matrix on labels, main pushes, and nightly. +analysis. M33MU runs the STM32H563 smoke set on every pull request and the +full matrix on labels, main pushes, and nightly. MIMXRT700 runs on a pull +request only when labelled. `codeql.yml` runs C security queries. `coverity.yml` runs on Sundays at 00:00 UTC or by manual dispatch. Both build the host suites and secure images @@ -21,8 +22,8 @@ An accepted upload queues analysis; results appear after Coverity processes it. | Tier | Trigger | Purpose | |------|---------|---------| | **Fast (per-PR)** | every PR; push to main | host unit suites, ISO C99, house style, bare-scope scan, Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard | -| **M33MU smoke** | every PR | per port, on both crypto engines: STM32H563 `positive gtzcneg crossdomain bothpsa confboot devcrypto`; MIMXRT700 `positive ahbscneg crossdomain bothpsa confboot devcrypto` | -| **M33MU full** | PR labels `ci:all`, `ci:h5`, `ci:rt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) | +| **M33MU smoke** | every PR | STM32H563 on both crypto engines: `positive gtzcneg crossdomain bothpsa confboot devcrypto` | +| **M33MU full** | PR labels `ci:all`, `ci:m33mu`, `ci:h5`, `ci:rt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) | The M33MU workflow (`m33mu.yml`) is label-selected the way wolfProvider's `pr-osp-select.yml` is: a `select` job checks the routing table @@ -32,7 +33,7 @@ groups it picked, so a job that is not selected never appears as skipped. | Label | Effect | |-------|--------| -| (no label) | each port's smoke tier on both engines | +| (no label) | the STM32H563 smoke tier on both engines; no MIMXRT700 jobs | | `ci:h5` | the STM32H563 full matrix (the change touched only that port) | | `ci:rt700` | the MIMXRT700 full matrix (the change touched only that port) | | `ci:all` / `ci:m33mu` | every scenario of every port (a core change) | @@ -75,8 +76,8 @@ test-target` also reads. The table below is a representative slice: | `mimxrt700_devcrypto_vaultrecover_vaultrecoversec_` | `devcrypto vaultrecover vaultrecoversec` | PSA Crypto conformance on wolfPSA; a foreign vault pool self-heals in development and fails closed when SECURED | | `mimxrt700_rollbackneg_remeasureneg_manifestneg_spbudgetneg_` | `rollbackneg remeasureneg manifestneg spbudgetneg` | shared Secure-verdict table: rollback refusal, re-measure tamper, corrupted manifest, restart budget | -An unlabeled PR runs only each port's smoke tier; the full matrix needs a -`ci:` label. To run a single scenario locally, use `tests/target/run_m33mu_scenario.sh ` (the +An unlabeled PR runs only the STM32H563 smoke tier; MIMXRT700 and the full +matrix need a `ci:` label. To run a single scenario locally, use `tests/target/run_m33mu_scenario.sh ` (the RT700 checks use `tests/target/run_rt700_m33mu.sh `); to run a port's full matrix on a PR, add its `ci:` label; off-PR against a branch, `workflow_dispatch` on `m33mu.yml` with the `port` input. diff --git a/.github/workflows/m33mu.yml b/.github/workflows/m33mu.yml index 68d84ea1..30241b4c 100644 --- a/.github/workflows/m33mu.yml +++ b/.github/workflows/m33mu.yml @@ -1,9 +1,9 @@ name: M33MU on: - # Pull requests run each port's smoke tier; the ci:all, ci:h5, and ci:rt700 - # labels, pushes to main, the nightly schedule (workflow_call from - # nightly.yml), and manual dispatch run a port's full matrix. + # Pull requests run the STM32H563 smoke tier; MIMXRT700 runs on a PR only + # with ci:rt700, ci:all, or ci:m33mu. Those labels, ci:h5, pushes to main, + # the nightly schedule, and manual dispatch run a port's full matrix. pull_request: types: [opened, synchronize, reopened, labeled] push: @@ -280,7 +280,7 @@ jobs: # Label-selected, the wolfProvider way: one select job reads the ci:* labels # (ci:h5 or ci:rt700 for that port's full matrix when only that port # changed, ci:all or ci:m33mu for everything after a core change, no label - # for each port's smoke tier), the event, and the dispatch input, then one + # for the STM32H563 smoke tier), the event, and the dispatch input, then one # matrix job runs exactly those scenario groups, so nothing shows up skipped. select: name: m33mu_select diff --git a/docs/Testing.md b/docs/Testing.md index 258bb17e..f114812e 100644 --- a/docs/Testing.md +++ b/docs/Testing.md @@ -514,13 +514,12 @@ nightly schedule and manual dispatch run the 600-second soak instead. The `M33MU` workflow (wolfBoot plus both guest lifecycles, then a `select` job that picks each port's tier and one matrix job that runs exactly those scenario groups) is tiered. Every pull request runs -each port's smoke tier on both crypto engines (STM32H563: `positive`, -`gtzcneg`, `crossdomain`, `bothpsa`, `confboot`, `devcrypto`; MIMXRT700: -`positive`, `ahbscneg`, `crossdomain`, `bothpsa`, `confboot`, `devcrypto`). -The full matrix runs on a -push to `main`, on the nightly schedule, on -manual dispatch (with a `port` input), and on a pull request that carries the -`ci:h5`, `ci:rt700`, or `ci:all` label. The scenario groups per port and tier +the STM32H563 smoke tier on both crypto engines (`positive`, `gtzcneg`, +`crossdomain`, `bothpsa`, `confboot`, `devcrypto`). MIMXRT700 runs on a pull +request only with the `ci:rt700`, `ci:all`, or `ci:m33mu` label. The full +matrix runs on a push to `main`, on the nightly schedule, on manual dispatch +(with a `port` input), and on a pull request that carries the `ci:h5`, +`ci:rt700`, `ci:all`, or `ci:m33mu` label. The scenario groups per port and tier are in `tests/target/lib/scenario_matrix.py`; `make test-target TARGET=` runs the same smoke tier locally and `WT_TIER=full` every scenario. diff --git a/tests/target/lib/scenario_matrix.py b/tests/target/lib/scenario_matrix.py index 992a2613..12326525 100755 --- a/tests/target/lib/scenario_matrix.py +++ b/tests/target/lib/scenario_matrix.py @@ -55,6 +55,7 @@ # smoke: the per-PR set (one job per scenario and engine). groups: the full # tier, packed so each job builds the emulator and wolfBoot once. +# label_only: an unlabeled pull request runs none of this port. PORTS = { "stm32h563": { "label": "ci:h5", @@ -115,6 +116,7 @@ }, "mimxrt700": { "label": "ci:rt700", + "label_only": True, "arm": "rt700-m33mu", "image": "ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.25", "smoke": ("positive", "ahbscneg", "crossdomain", "bothpsa", "confboot", @@ -199,14 +201,17 @@ def entries(port, tier, engine): def ci_plan(event, labels, port_input): """Every job of one workflow run: a pull request gets each port's smoke - tier unless its label (or ci:all) asks for the full one; a push, the - schedule, or a dispatch gets the full tier of the selected ports.""" + tier unless its label (or ci:all) asks for the full one, and a label_only + port runs only when labelled; a push, the schedule, or a dispatch gets the + full tier of the selected ports.""" out = [] for port in sorted(PORTS): label = PORTS[port]["label"] if event == "pull_request": full = ("ci:all" in labels or "ci:m33mu" in labels or label in labels) + if not full and PORTS[port].get("label_only"): + continue elif event == "workflow_dispatch": full = port_input in ("", "all", port) if not full: @@ -218,9 +223,9 @@ def ci_plan(event, labels, port_input): SELFTEST = ( - ("pull_request", "", "", "mimxrt700:smoke stm32h563:smoke"), + ("pull_request", "", "", "stm32h563:smoke"), ("pull_request", "ci:rt700", "", "mimxrt700:full stm32h563:smoke"), - ("pull_request", "ci:h5", "", "mimxrt700:smoke stm32h563:full"), + ("pull_request", "ci:h5", "", "stm32h563:full"), ("pull_request", "ci:all", "", "mimxrt700:full stm32h563:full"), ("pull_request", "ci:m33mu", "", "mimxrt700:full stm32h563:full"), ("pull_request", "ci:h5 ci:rt700", "", "mimxrt700:full stm32h563:full"),