feat(presence): add configurable GPIO presence pin #59
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: AGPL-3.0-only | |
| # Copyright (C) 2026 RS-Key contributors | |
| # Three jobs: | |
| # check — the merge gate, the same single source of truth as local work: | |
| # `nix develop -c ./scripts/check.sh` (docs/testing.md, "CI parity"). | |
| # Green locally means green here; no CI-only logic to drift. | |
| # flavors — every feature combination of the firmware (no-touch × | |
| # advertise-pqc × fips-profile), each packaged as a downloadable | |
| # firmware-<flavor>.uf2 artifact. | |
| # knobs — build smokes for the compile-time env knobs (docs/build.md): | |
| # all VIDPID presets, FW_VERSION, XOSC_DELAY_MULT, FAKE_* test | |
| # keys, and a check that the default build bakes this project's own | |
| # RS-Key identity while the opt-in Yubico flavor bakes Yubico's | |
| # (the vendor-mimicking ids are local interop only, never shipped). | |
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'flake.lock') }} | |
| restore-keys: cargo-${{ runner.os }}- | |
| - name: check.sh — fmt, clippy, host tests, fips flavor, firmware builds, audit, deny, gitleaks | |
| run: nix develop -c ./scripts/check.sh | |
| env: | |
| HOST_TARGET: x86_64-unknown-linux-gnu | |
| flavors: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: default | |
| args: "" | |
| - name: pqc | |
| args: "--features advertise-pqc" | |
| - name: fips | |
| args: "--features fips-profile" | |
| - name: fips-pqc | |
| args: "--features fips-profile,advertise-pqc" | |
| - name: no-touch | |
| args: "--features no-touch" | |
| - name: no-touch-pqc | |
| args: "--features no-touch,advertise-pqc" | |
| - name: no-touch-fips | |
| args: "--features no-touch,fips-profile" | |
| - name: no-touch-fips-pqc | |
| args: "--features no-touch,fips-profile,advertise-pqc" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'flake.lock') }} | |
| restore-keys: cargo-${{ runner.os }}- | |
| - name: build (${{ matrix.name }}) | |
| run: nix develop -c cargo build --release -p firmware ${{ matrix.args }} | |
| - name: package firmware-${{ matrix.name }}.uf2 | |
| run: | | |
| nix develop -c picotool uf2 convert \ | |
| target/thumbv8m.main-none-eabihf/release/firmware -t elf \ | |
| firmware-${{ matrix.name }}.uf2 | |
| sha256sum firmware-${{ matrix.name }}.uf2 | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: firmware-${{ matrix.name }}-${{ github.sha }} | |
| path: firmware-${{ matrix.name }}.uf2 | |
| knobs: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'flake.lock') }} | |
| restore-keys: cargo-${{ runner.os }}- | |
| - name: every VIDPID preset builds | |
| run: | | |
| for preset in RSKey Yubikey5 YubikeyNeo YubiHSM NitroHSM NitroFIDO2 NitroStart NitroPro Nitro3 Gnuk GnuPG Pico Dev; do | |
| echo "::group::VIDPID=$preset" | |
| nix develop -c env VIDPID="$preset" cargo build --release -p firmware | |
| echo "::endgroup::" | |
| done | |
| - name: default identity is RS-Key, Yubico flavor is opt-in | |
| run: | | |
| nix develop -c bash -euo pipefail -c ' | |
| o=target/thumbv8m.main-none-eabihf/release/build/firmware-*/output | |
| cargo clean -p firmware | |
| cargo build --release -p firmware >/dev/null | |
| grep -qx "cargo:rustc-env=PK_USB_VID=4617" $o | |
| grep -qx "cargo:rustc-env=PK_USB_MANUFACTURER=RS-Key" $o | |
| grep -qx "cargo:rustc-env=PK_USB_PRODUCT=RS-Key Security Key" $o | |
| env VIDPID=Yubikey5 cargo build --release -p firmware >/dev/null | |
| grep -qx "cargo:rustc-env=PK_USB_VID=4176" $o | |
| grep -qx "cargo:rustc-env=PK_USB_MANUFACTURER=Yubico" $o | |
| echo "default = RS-Key identity, Yubikey5 = Yubico identity: OK" | |
| ' | |
| - name: raw USB_VID/USB_PID override | |
| run: nix develop -c env VIDPID=Dev USB_VID=0xFEFF USB_PID=0x0001 cargo build --release -p firmware | |
| - name: FW_VERSION + masquerade preset (the docs example) | |
| run: nix develop -c env VIDPID=NitroFIDO2 FW_VERSION=1.4.0 cargo build --release -p firmware | |
| - name: hardened XOSC startup delay | |
| run: nix develop -c env XOSC_DELAY_MULT=512 cargo build --release -p firmware | |
| - name: FAKE_MKEK / FAKE_DEVK test build | |
| run: | | |
| nix develop -c env \ | |
| FAKE_MKEK=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \ | |
| FAKE_DEVK=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \ | |
| cargo build --release -p firmware |