Squash and merge in changes from upstream panda

.github/workflows/test.yaml

@@ -11,133 +11,73 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  RUN: docker run -v ${{ github.workspace }}:/tmp/pythonpath/panda -w /tmp/pythonpath/panda --rm panda /bin/bash -c
-  BUILD: |
-      export DOCKER_BUILDKIT=1
-      docker build --pull --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ghcr.io/commaai/panda:latest -t panda -f Dockerfile .
-
-  PYTHONWARNINGS: "error"
+  RUN: source .venv/bin/activate && /bin/bash -c
 
 jobs:
-  docker_push:
-    name: docker push
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && github.repository == 'commaai/panda'
-    steps:
-      - uses: actions/checkout@v2
-      - name: Build Docker image
-        timeout-minutes: 11
-        run: eval "$BUILD"
-      - name: Login to dockerhub
-        run: docker login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
-      - name: Tag image
-        run: docker tag panda ghcr.io/commaai/panda:latest
-      - name: Push image
-        run: docker push ghcr.io/commaai/panda:latest
-
   build:
     name: build
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - uses: actions/checkout@v4
+      - run: ./setup.sh
       - name: Test python package installer
-        run: ${{ env.RUN }} "python3 setup.py install"
+        run: ${{ env.RUN }} "pip install --break-system-packages .[dev]"
       - name: Build panda images and bootstub
         run: ${{ env.RUN }} "scons -j4"
-      - name: Build panda with SPI support
-        run: ${{ env.RUN }} "ENABLE_SPI=1 scons -j4"
       - name: Build with UBSan
         run: ${{ env.RUN }} "scons -j4 --ubsan"
       - name: Build jungle firmware with FINAL_PROVISIONING support
         run: ${{ env.RUN }} "FINAL_PROVISIONING=1 scons -j4 board/jungle"
       - name: Build panda in release mode
         run: ${{ env.RUN }} "CERT=certs/debug RELEASE=1 scons -j4"
 
-  unit_tests:
-    name: unit tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v2
-      - name: Build Docker image
-        run: eval "$BUILD"
-      - name: Build panda
-        run: $RUN "scons -j4"
-      - name: Test communication protocols
-        run: $RUN "cd tests/usbprotocol && ./test.sh"
-
-  safety:
-    name: safety
-    runs-on: ubuntu-latest
+  test:
+    name: ./test.sh
+    runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
-        flags: ['', '--ubsan']
-    timeout-minutes: 20
+        os: ['macos-latest', 'ubuntu-latest']
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - name: Build Docker image
-        run: eval "$BUILD"
-      - name: Run safety tests
-        timeout-minutes: 5
-        run: |
-          ${{ env.RUN }} "scons -c -j$(nproc) && \
-                          scons -j$(nproc) ${{ matrix.flags }} && \
-                          tests/safety/test.sh"
+      - uses: actions/checkout@v4
+      - run: ./test.sh
 
   misra_linter:
     name: MISRA C:2012 Linter
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - uses: actions/checkout@v4
+      - name: Cache cppcheck
+        id: cppcheck-cache
+        uses: actions/cache@v4
+        with:
+          path: tests/misra/cppcheck
+          key: cppcheck-${{ hashFiles('tests/misra/*') }}
+      - run: ./setup.sh
       - name: Build FW
         run: ${{ env.RUN }} "scons -j$(nproc)"
       - name: Run MISRA C:2012 analysis
-        timeout-minutes: 2
         run: ${{ env.RUN }} "cd tests/misra && ./test_misra.sh"
 
   misra_mutation:
     name: MISRA C:2012 Mutation
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - uses: actions/checkout@v4
+      - name: Cache cppcheck
+        id: cppcheck-cache
+        uses: actions/cache@v4
+        with:
+          path: tests/misra/cppcheck
+          key: cppcheck-${{ hashFiles('tests/misra/*') }}
+      - run: ./setup.sh
       - name: Build FW
         run: ${{ env.RUN }} "scons -j$(nproc)"
+      - name: tests/misra/install.sh
+        run: ${{ env.RUN }} "cd tests/misra && ./install.sh"
       - name: MISRA mutation tests
-        timeout-minutes: 5
-        run: ${{ env.RUN }} "cd tests/misra && pytest -n8 test_mutation.py"
-
-  mutation:
-    name: Mutation tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          fetch-depth: 0 # need master to get diff
-      - name: Build Docker image
-        run: eval "$BUILD"
-      - name: Mutation tests
-        timeout-minutes: 5
-        run: ${{ env.RUN }} "GIT_REF=${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && github.event.before || 'origin/master' }} cd tests/safety && ./mutation.sh"
-
-  static_analysis:
-    name: static analysis
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v2
-      - name: Build Docker image
-        run: eval "$BUILD"
-      - name: Run static analysis
-        timeout-minutes: 3
-        run: ${{ env.RUN }} "pre-commit run --all"
+        run: ${{ env.RUN }} "cd tests/misra && pytest test_mutation.py"

.github/workflows/update-cppcheck.yml

@@ -0,0 +1,37 @@
+name: Update cppcheck
+
+on:
+  #push:
+  schedule:
+    - cron: "0 14 * * 1" # every Monday at 2am UTC (6am PST)
+  workflow_dispatch:
+
+jobs:
+  update-cppcheck:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get latest cppcheck version
+        id: version
+        run: |
+          LATEST=$(curl -fsSL https://api.github.com/repos/danmar/cppcheck/releases/latest | jq -r .tag_name)
+          echo "vers=$LATEST" >> "$GITHUB_OUTPUT"
+      - name: Update VERS in install.sh
+        run: |
+          sed -i "s/^VERS=\".*\"/VERS=\"${{ steps.version.outputs.vers }}\"/" tests/misra/install.sh
+          grep VERS tests/misra/install.sh
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83
+        with:
+          author: Vehicle Researcher <user@comma.ai>
+          token: ${{ secrets.ACTIONS_CREATE_PR_PAT }}
+          commit-message: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
+          title: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
+          body: "See all cppcheck releases: https://github.com/danmar/cppcheck/releases"
+          branch: "update-cppcheck"
+          base: "master"
+          delete-branch: true
+          labels: bot

.gitignore

@@ -1,3 +1,4 @@
+.venv
 *.tmp
 *.pyc
 .*.swp
@@ -20,12 +21,14 @@ examples/output.csv
 nosetests.xml
 .mypy_cache/
 .sconsign.dblite
+uv.lock
+compile_commands.json
 venv/
-.venv/
 .python-version
 
 # CTU info files generated by Cppcheck
 *.*.ctu-info
+cppcheck-addon-ctu-file-list
 
 # safety coverage-related files
 *.gcda

Dockerfile

@@ -1,51 +1,19 @@
 FROM ubuntu:24.04
 
+ENV WORKDIR=/tmp/panda/
 ENV PYTHONUNBUFFERED=1
-ENV PYTHONPATH=/tmp/pythonpath
+ENV PATH="$WORKDIR/.venv/bin:$PATH"
 
-ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    make \
-    g++ \
-    gcc-arm-none-eabi libnewlib-arm-none-eabi \
-    git \
-    libffi-dev \
-    libusb-1.0-0 \
-    python3 \
-    python3-dev \
-    python3-pip \
- && rm -rf /var/lib/apt/lists/* && \
-    apt clean && \
-    cd /usr/lib/gcc/arm-none-eabi/* && \
-    rm -rf arm/ && \
-    rm -rf thumb/nofp thumb/v6* thumb/v8* thumb/v7+fp thumb/v7-r+fp.sp && \
-    apt-get update && apt-get install -y clang-17 && \
-    ln -s $(which clang-17) /usr/bin/clang
+WORKDIR $WORKDIR
 
-RUN apt-get update && apt-get install -y curl && \
-    curl -1sLf 'https://dl.cloudsmith.io/public/mull-project/mull-stable/setup.deb.sh' | bash && \
-    apt-get update && apt-get install -y mull-17
+# deps install
+COPY pyproject.toml __init__.py setup.sh $WORKDIR
+RUN mkdir -p $WORKDIR/python/ && touch $WORKDIR/__init__.py
+RUN apt-get update && apt-get install -y --no-install-recommends sudo && DEBIAN_FRONTEND=noninteractive $WORKDIR/setup.sh
 
-ENV CPPCHECK_DIR=/tmp/cppcheck
-COPY tests/misra/install.sh /tmp/
-RUN /tmp/install.sh && rm -rf $CPPCHECK_DIR/.git/
-ENV SKIP_CPPCHECK_INSTALL=1
+# second pass for the opendbc moving tag
+ARG CACHEBUST=1
+RUN DEBIAN_FRONTEND=noninteractive $WORKDIR/setup.sh
 
-COPY setup.py __init__.py $PYTHONPATH/panda/
-COPY python/__init__.py $PYTHONPATH/panda/python/
-RUN pip3 install --break-system-packages --no-cache-dir $PYTHONPATH/panda/[dev]
-
-# TODO: this should be a "pip install" or not even in this repo at all
-RUN git config --global --add safe.directory $PYTHONPATH/panda
-ENV OPENDBC_REF="7af6f3885dc43be8ecf331df1f0914cf3338de50"
-RUN cd /tmp/ && \
-    git clone --depth 1 https://github.com/commaai/opendbc opendbc_repo && \
-    cd opendbc_repo && git fetch origin $OPENDBC_REF && git checkout FETCH_HEAD && rm -rf .git/ && \
-    pip3 install --break-system-packages --no-cache-dir Cython numpy  && \
-    ln -s $PWD/opendbc $PYTHONPATH/opendbc && \
-    scons -j8 --minimal opendbc/
-
-# for Jenkins
-COPY README.md panda.tar.* /tmp/
-RUN mkdir -p /tmp/pythonpath/panda && \
-    tar -xvf /tmp/panda.tar.gz -C /tmp/pythonpath/panda/ || true
+RUN git config --global --add safe.directory $WORKDIR/panda
+COPY . $WORKDIR