Run MIMXRT700 M33MU scenarios on pull requests only when labelled

.github/workflows/README.md

@@ -1,8 +1,9 @@
 # wolfTrust CI
 
 CI has a fast per-PR host lane, the tiered M33MU emulator matrix, and static
-analysis. M33MU runs a per-port smoke set on every pull request and the full
-matrix on labels, main pushes, and nightly.
+analysis. M33MU runs the STM32H563 smoke set on every pull request and the
+full matrix on labels, main pushes, and nightly. MIMXRT700 runs on a pull
+request only when labelled.
 
 `codeql.yml` runs C security queries. `coverity.yml` runs on Sundays at
 00:00 UTC or by manual dispatch. Both build the host suites and secure images
@@ -21,8 +22,8 @@ An accepted upload queues analysis; results appear after Coverity processes it.
 | Tier | Trigger | Purpose |
 |------|---------|---------|
 | **Fast (per-PR)** | every PR; push to main | host unit suites, ISO C99, house style, bare-scope scan, Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard |
-| **M33MU smoke** | every PR | per port, on both crypto engines: STM32H563 `positive gtzcneg crossdomain bothpsa confboot devcrypto`; MIMXRT700 `positive ahbscneg crossdomain bothpsa confboot devcrypto` |
-| **M33MU full** | PR labels `ci:all`, `ci:h5`, `ci:rt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
+| **M33MU smoke** | every PR | STM32H563 on both crypto engines: `positive gtzcneg crossdomain bothpsa confboot devcrypto` |
+| **M33MU full** | PR labels `ci:all`, `ci:m33mu`, `ci:h5`, `ci:rt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
 
 The M33MU workflow (`m33mu.yml`) is label-selected the way wolfProvider's
 `pr-osp-select.yml` is: a `select` job checks the routing table
@@ -32,7 +33,7 @@ groups it picked, so a job that is not selected never appears as skipped.
 
 | Label | Effect |
 |-------|--------|
-| (no label) | each port's smoke tier on both engines |
+| (no label) | the STM32H563 smoke tier on both engines; no MIMXRT700 jobs |
 | `ci:h5` | the STM32H563 full matrix (the change touched only that port) |
 | `ci:rt700` | the MIMXRT700 full matrix (the change touched only that port) |
 | `ci:all` / `ci:m33mu` | every scenario of every port (a core change) |
@@ -75,8 +76,8 @@ test-target` also reads. The table below is a representative slice:
 | `mimxrt700_devcrypto_vaultrecover_vaultrecoversec_<engine>` | `devcrypto vaultrecover vaultrecoversec` | PSA Crypto conformance on wolfPSA; a foreign vault pool self-heals in development and fails closed when SECURED |
 | `mimxrt700_rollbackneg_remeasureneg_manifestneg_spbudgetneg_<engine>` | `rollbackneg remeasureneg manifestneg spbudgetneg` | shared Secure-verdict table: rollback refusal, re-measure tamper, corrupted manifest, restart budget |
 
-An unlabeled PR runs only each port's smoke tier; the full matrix needs a
-`ci:` label. To run a single scenario locally, use `tests/target/run_m33mu_scenario.sh <key>` (the
+An unlabeled PR runs only the STM32H563 smoke tier; MIMXRT700 and the full
+matrix need a `ci:` label. To run a single scenario locally, use `tests/target/run_m33mu_scenario.sh <key>` (the
 RT700 checks use `tests/target/run_rt700_m33mu.sh <key>`); to run a port's
 full matrix on a PR, add its `ci:` label; off-PR against a branch,
 `workflow_dispatch` on `m33mu.yml` with the `port` input.

.github/workflows/m33mu.yml

@@ -1,9 +1,9 @@
 name: M33MU
 
 on:
-  # Pull requests run each port's smoke tier; the ci:all, ci:h5, and ci:rt700
-  # labels, pushes to main, the nightly schedule (workflow_call from
-  # nightly.yml), and manual dispatch run a port's full matrix.
+  # Pull requests run the STM32H563 smoke tier; MIMXRT700 runs on a PR only
+  # with ci:rt700, ci:all, or ci:m33mu. Those labels, ci:h5, pushes to main,
+  # the nightly schedule, and manual dispatch run a port's full matrix.
   pull_request:
     types: [opened, synchronize, reopened, labeled]
   push:
@@ -280,7 +280,7 @@ jobs:
   # Label-selected, the wolfProvider way: one select job reads the ci:* labels
   # (ci:h5 or ci:rt700 for that port's full matrix when only that port
   # changed, ci:all or ci:m33mu for everything after a core change, no label
-  # for each port's smoke tier), the event, and the dispatch input, then one
+  # for the STM32H563 smoke tier), the event, and the dispatch input, then one
   # matrix job runs exactly those scenario groups, so nothing shows up skipped.
   select:
     name: m33mu_select

docs/Testing.md

@@ -514,13 +514,12 @@ nightly schedule and manual dispatch run the 600-second soak instead.
 The `M33MU` workflow (wolfBoot plus both guest lifecycles, then a `select` job
 that picks each port's tier and one matrix job that runs exactly those scenario
 groups) is tiered. Every pull request runs
-each port's smoke tier on both crypto engines (STM32H563: `positive`,
-`gtzcneg`, `crossdomain`, `bothpsa`, `confboot`, `devcrypto`; MIMXRT700:
-`positive`, `ahbscneg`, `crossdomain`, `bothpsa`, `confboot`, `devcrypto`).
-The full matrix runs on a
-push to `main`, on the nightly schedule, on
-manual dispatch (with a `port` input), and on a pull request that carries the
-`ci:h5`, `ci:rt700`, or `ci:all` label. The scenario groups per port and tier
+the STM32H563 smoke tier on both crypto engines (`positive`, `gtzcneg`,
+`crossdomain`, `bothpsa`, `confboot`, `devcrypto`). MIMXRT700 runs on a pull
+request only with the `ci:rt700`, `ci:all`, or `ci:m33mu` label. The full
+matrix runs on a push to `main`, on the nightly schedule, on manual dispatch
+(with a `port` input), and on a pull request that carries the `ci:h5`,
+`ci:rt700`, `ci:all`, or `ci:m33mu` label. The scenario groups per port and tier
 are in `tests/target/lib/scenario_matrix.py`; `make test-target TARGET=<port>`
 runs the same smoke tier locally and `WT_TIER=full` every scenario.
 

tests/target/lib/scenario_matrix.py

@@ -55,6 +55,7 @@
 
 # smoke: the per-PR set (one job per scenario and engine). groups: the full
 # tier, packed so each job builds the emulator and wolfBoot once.
+# label_only: an unlabeled pull request runs none of this port.
 PORTS = {
     "stm32h563": {
         "label": "ci:h5",
@@ -115,6 +116,7 @@
     },
     "mimxrt700": {
         "label": "ci:rt700",
+        "label_only": True,
         "arm": "rt700-m33mu",
         "image": "ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.25",
         "smoke": ("positive", "ahbscneg", "crossdomain", "bothpsa", "confboot",
@@ -199,14 +201,17 @@ def entries(port, tier, engine):
 
 def ci_plan(event, labels, port_input):
     """Every job of one workflow run: a pull request gets each port's smoke
-    tier unless its label (or ci:all) asks for the full one; a push, the
-    schedule, or a dispatch gets the full tier of the selected ports."""
+    tier unless its label (or ci:all) asks for the full one, and a label_only
+    port runs only when labelled; a push, the schedule, or a dispatch gets the
+    full tier of the selected ports."""
     out = []
     for port in sorted(PORTS):
         label = PORTS[port]["label"]
         if event == "pull_request":
             full = ("ci:all" in labels or "ci:m33mu" in labels or
                     label in labels)
+            if not full and PORTS[port].get("label_only"):
+                continue
         elif event == "workflow_dispatch":
             full = port_input in ("", "all", port)
             if not full:
@@ -218,9 +223,9 @@ def ci_plan(event, labels, port_input):
 
 
 SELFTEST = (
-    ("pull_request", "", "", "mimxrt700:smoke stm32h563:smoke"),
+    ("pull_request", "", "", "stm32h563:smoke"),
     ("pull_request", "ci:rt700", "", "mimxrt700:full stm32h563:smoke"),
-    ("pull_request", "ci:h5", "", "mimxrt700:smoke stm32h563:full"),
+    ("pull_request", "ci:h5", "", "stm32h563:full"),
     ("pull_request", "ci:all", "", "mimxrt700:full stm32h563:full"),
     ("pull_request", "ci:m33mu", "", "mimxrt700:full stm32h563:full"),
     ("pull_request", "ci:h5 ci:rt700", "", "mimxrt700:full stm32h563:full"),