Merge remote-tracking branch 'armbian/build:main' into ti-main

* main: (403 commits)
  Improve proxy handling for builds
  nanopi-r76s: fix SD boot and storage stability on eMMC-less units (armbian#9908)
  nanopi-m5: drop GMAC rx_delay to fix gigabit RX (armbian#9901)
  meson64-6.18: rewrite kernel patches against 6.18.33
  meson64-7.0: rewrite kernel patches against 7.0.10
  rockchip64-7.0: rewrite kernel patches against 7.0.10
  rockchip64-6.18: rewrite kernel patches against 6.18.33
  sunxi-7.0: rewrite kernel patches against 7.0.10
  sunxi-6.18: rewrite kernel patches against 6.18.33
  ch13726a: Remove MIPI_DSI_MODE_VIDEO_BURST
  rockchip64-bleedingedge: re-enable rtl8723ds wifi driver
  rtl8723ds: remove guard against  *bleedingedge* and update target commit
  kernel: add 7.1 as edge kernel
  boards: add mba93xxla-mini
  boards: add tq-smarc2-tqma8mpxs
  tqma8m: cleanup patch and board configs
  u-boot-tqma: update and prepare new boards
  uwe5622: add patch header briefly explaining the changes
  uwe5622: add >=7.1 compat patch
  drivers_network.sh: remove *bleedingedge* BRANCH condition for uwe5622 driver
  rockchip64-bleedingedge: re-add uwe562x wifi driver to kernel config
  move Qidi X-6 to mainline u-boot
  This PR adds official Armbian support for two EasePi IoT gateway/NAS devices (armbian#9880)
  fix(kernel-debs): allow 'dwarves' as alternative for 'pahole' in headers Depends
  fix(ci/shellcheck): pass --shell=bash for per-file lint of board configs
  Automatic: kernel config rewrite
  build(deps): bump github/codeql-action from 4.35.5 to 4.36.0
  build(deps): bump plbstl/first-contribution from 4.3.0 to 4.3.1
  `Automatic` board configs status synchronise
  Rockchip: youyeetoo yy3568: enable pci-e NVMe ssd
  ci: least-privilege GITHUB_TOKEN in maintenance-lint-scripts-post
  fix(sm8550-7.0): drop merged & broken SD/DSI patches
  fix(sm8550-6.18): drop broken sm8x50 UHS-I/xo-clock mbox patch
  Add wifi to Radxa Cubie A5E (kernel7.0) (armbian#9879)
  Update odroidxu4-current to 6.6.141
  fix(sunxi-6.18): drop r-spi backport from series.conf
  fix(sunxi-6.18): drop r-spi backport now merged in linux-6.18.y stable
  fix(sm8250): drop duplicate cpu7_opp21 label on Xiaoxin Pad Pro overclock OPP
  build(deps): bump step-security/harden-runner from 2.19.3 to 2.19.4
  `Automatic` board configs status synchronise
  Update radxa-cubie-a5e.csc with current kernel for build (armbian#9874)
  youyeetoo-yy3588: promote from CSC to standard support (armbian#9873)
  ci: ShellCheck PR comments & auto-fix suggestions workflow
  tools(shellcheck): SHELLCHECK_INSTALL_ONLY env to skip lint passes
  fix(tools/shellfmt): include .eos and .wip board configs in formatting scope
  feat(tools/shellfmt): accept positional file args for scoped format
  fix(ccache): pass dir-size diff to numfmt past '--' to allow negatives
  feat(ccache-remote): parse password from DNS-SD TXT for redis backend
  build(deps): bump tspascoal/get-user-teams-membership
  interactive: substring filter for the board picker
  interactive: cache board list across dialog redraws, drop per-file subshells
  interactive: shfmt whole-file format pass
  nanopi-r76s: bump mainline u-boot to v2026.04 and drop vendor-branch gates (armbian#9869)
  Update for Radxa Cubie A5E (armbian#9626)
  Update odroidxu4-current to 6.6.140
  ci: skip build-artifacts gating job on forks
  `Automatic` board configs status synchronise
  rock-5-itx: link upstream kernel commit in pcie3 refclk u-boot patch (armbian#9861)
  rock-5-itx: switch to mainline u-boot v2026.04 (armbian#9848)
  Automatic: kernel config rewrite
  `Automatic` board configs status synchronise
  firmware-sof-signed: move from cli/amd64 baseline to UEFI common
  build(deps): bump github/codeql-action from 4.35.4 to 4.35.5
  build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0
  build(deps): bump actions/checkout from 4.3.1 to 6.0.2
  uefi-x86: enable Intel IPU7 + OV02C10/OV02E10 sensors for LNL ThinkPads
  uefi-x86: enable SND_SOC_DMIC for SOF DMIC array mic
  uefi-x86: add CS42L43 MFD/pinctrl/SPI sub-drivers
  uefi-x86: complete SOF SoundWire chain for LNL ThinkPads
  uefi-x86: enable iwlwifi MLD + Intel SOF (MTL/LNL/PTL) audio
  rockchip64-6.18: rebase rk3399 dwc3 phy-reset-quirk patch for 6.18.32 (armbian#9847)
  rk3528-10-phy-rockchip-inno-usb2: split IS_ERR(rphy->grf) per-branch
  rk3528-10-phy-rockchip-inno-usb2: fix usbgrf regmap split (6.18 + 7.0 + 7.1)
  Automatic: kernel config rewrite
  config: sm8550: Set edge to kernel 7.0
  config: kernel: Update sm8550 kernel edge config
  sm8550: Added kernel 7.0 patches
  nanopi-m5: pin DRD0 dwc3 to host mode to expose the second USB3 port (armbian#9844)
  drivers_network: bump rtl8852bs commit ref to 35d3e266 (May 17)
  mekotronics-r58x-pro: mainline u-boot (and LCD support) also for vendor branch
  linux-rk35xx-vendor.config: enable `CONFIG_LCD_VK2C21` as module
  [StepSecurity] Apply security best practices
  Potential fix for code scanning alert no. 2: Code injection
  rtl8852bs: re-enable for bleedingedge
  tools: Bump `ORAS_VERSION` from 1.3.1 to 1.3.2
  SpacemiT: Update BPI-F3 DTS
  SpacemiT: U-Boot: Fixup circular deps
  SpacemiT: OpenSBI: Fix bool definition
  Update odroidxu4-current to 6.6.139
  [StepSecurity] Apply security best practices
  rockchip64-6.18: rewrite kernel patches against 6.18.30
  rockchip64-7.0: rewrite kernel patches against 7.0.7
  sunxi-7.0: rewrite kernel patches against 7.0.7
  sunxi-6.18: rewrite patches against 6.18.30
  patch/sunxi-6.12: drop dangling series.* references to the same patches
  patch/sunxi-6.12: drop two Rockchip SPI patches (not applicable to sunxi)
  rockchip64-edge: add opt-in helios64 CPU stability overlay
  rockchip64-current: add opt-in helios64 CPU stability overlay
  NORCO EMB-3531: Switch to rkbin ddr blob to support both DDR3 and LPDDR4X variants
  NORCO EMB-3531: Enable 4x USB3 Type-A port on LPDDR4X variants
  ...

Author: jonaswood01

.github/CODEOWNERS

@@ -18,7 +18,7 @@
 - all:
   - changed-files:
     - any-glob-to-any-file: ['patch/**/*','config/**/*']
-    - all-globs-to-all-files: ['!config/cli/**/*','!config/desktop/**/*','!config/distributions/**/*']
+    - all-globs-to-all-files: ['!config/cli/**/*','!config/distributions/**/*']
 
 "Framework":
 - all:
@@ -41,11 +41,6 @@
     - any-glob-to-any-file: ['.github/**/*']
     - all-globs-to-any-file: ['!.github/workflows/**/*']
 
-"Desktop":
-- all:
-  - changed-files:
-    - any-glob-to-any-file: ['config/desktop/**/*']
-
 "Patches":
 - all:
   - changed-files:

.github/labeler.yml

@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Sync
-        uses: igorpecovnik/github-action-issue-to-jira@master
+        uses: igorpecovnik/github-action-issue-to-jira@05d67c604cf13fc3c6c07d655d03439b0351747d # master
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/data-jira-ticket.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Repository Dispatch
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.ACCESS_TOKEN }}
           repository: armbian/armbian.github.io

.github/workflows/data-sync-board-list.yml

@@ -27,10 +27,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@v6
+        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           yaml-file: .github/labels.yml

.github/workflows/data-sync-labels.yml

@@ -20,15 +20,15 @@ jobs:
     steps:
 
       - name: "Checkout build repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: armbian/build
           ref:  main
           fetch-depth: 0
           clean: false
 
       - name: "Install SSH key for storage"
-        uses: shimataro/ssh-key-action@v2
+        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
         with:
           key: ${{ secrets.KEY_UPLOAD }}
           known_hosts: ${{ secrets.KNOWN_HOSTS_ARMBIAN_UPLOAD }}
@@ -94,7 +94,7 @@ jobs:
 
       - name: Create Pull Request
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: '`Automatic` board configs status synchronise'

.github/workflows/data-sync-maintainers.yml

@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Get current ${{ matrix.tool.PROJECT_NAME }} version
         id: get-version-current
@@ -89,7 +89,7 @@ jobs:
           sed -i "s/${{ matrix.tool.VERSION_VAR}}=\${${{ matrix.tool.VERSION_VAR}}:-[0-9.]*}/${{ matrix.tool.VERSION_VAR}}=\${${{ matrix.tool.VERSION_VAR}}:-$version_latest}/g" ${{ matrix.tool.VAR_FILE }}
 
       - name: Create Pull Request to update ${{ matrix.tool.VERSION_VAR}} for ${{ matrix.tool.PROJECT_NAME }}
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "tools: Bump `${{ matrix.tool.VERSION_VAR}}` from ${{ steps.get-version-current.outputs.version_current }} to ${{ steps.get-version-latest.outputs.version_latest }}"

.github/workflows/data-sync-tools.yml

@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/dependency-review.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
       - name: Dispatch event on forked repository
         if: ${{ env.DISPATCH_SECRET != '' }}  # Check that the secret has been set, if not, exit
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ env.DISPATCH_SECRET }}
           repository: ${{ github.repository }}

.github/workflows/infrastructure-dispatch-to-fork.yml

@@ -23,12 +23,12 @@ jobs:
 
     steps:
       - name: Checkout full history
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Mirror to Codeberg
-        uses: pixta-dev/repository-mirroring-action@v1
+        uses: pixta-dev/repository-mirroring-action@674e65a7d483ca28dafaacba0d07351bdcc8bd75 # v1.1.1
         with:
           target_repo_url: git@codeberg.org:armbian/build.git
           ssh_private_key: ${{ secrets.GHA_SSH_KEY }}