mellowflyc5 emac1 uboot

.gitattributes

@@ -0,0 +1,3 @@
+.gitattributes text eol=lf
+config/boards/pocketbeagle2.conf text eol=lf
+packages/bsp/pocketbeagle2-usb-gadget/* text eol=lf

.github/generate_CODEOWNERS.sh

@@ -2,6 +2,15 @@
 
 SRC="$(realpath "${BASH_SOURCE%/*}/../")"
 
+# Maintainers flagged inactive (one GitHub username per line) are dropped from
+# CODEOWNERS so they aren't review-requested on PRs touching "their" code — they
+# stay listed in each board's BOARD_MAINTAINER. The sync workflow writes this file
+# from the contacts DB's Days_since_last_activity; absent/unset => no filtering.
+declare -A INACTIVE
+if [[ -n "${INACTIVE_MAINTAINERS_FILE:-}" && -f "${INACTIVE_MAINTAINERS_FILE}" ]]; then
+	while read -r _u; do _u="${_u#@}"; [[ -n "$_u" ]] && INACTIVE["$_u"]=1; done < "${INACTIVE_MAINTAINERS_FILE}"
+fi
+
 # Dummy function for successful source
 function display_alert() { :; }
 function enable_extension() { :; }
@@ -24,7 +33,15 @@ function generate_for_board() {
 		LINUXFAMILY="${BOARDFAMILY}"
 
 		[[ -n "${BOARD_MAINTAINER}" ]] || return
-		maintainers="$(echo "${BOARD_MAINTAINER}" | xargs -n1 | sed -E 's|^.+$|@\0|' | tr '\n' ' ')"
+		# CODEOWNERS owners = ACTIVE maintainers only — drop any flagged inactive so
+		# they aren't pinged (BOARD_MAINTAINER above keeps the full list untouched).
+		local _m maintainers=""
+		for _m in ${BOARD_MAINTAINER}; do
+			[[ -n "${INACTIVE[$_m]:-}" ]] || maintainers+="@${_m} "
+		done
+		maintainers="${maintainers% }"
+		# all maintainers inactive -> emit no entry (the path simply gets no owner)
+		[[ -n "${maintainers}" ]] || return
 
 		while read -r BRANCH; do
 			(
@@ -98,20 +115,6 @@ cat <<-EOF >"${SRC}/.github/CODEOWNERS"
 	# PLEASE DON'T EDIT THIS FILE
 	# Auto generated by ".github/generate_CODEOWNERS.sh"
 
-	# Default code owner
-	*			@igorpecovnik
-
-	# the last matching pattern takes the most
-
-	*.md			@EvilOlaf @littlecxm @TheLinuxBug @TRSx80 @igorpecovnik
-
-	.github/		@igorpecovnik @rpardini @hzyitc
-
-	lib/			@armbian/build-scripts
-	packages/		@armbian/build-scripts
-	packages/bsp/jethub/	@armbian/build-scripts @adeepn
-	tools/			@iav @neheb @hzyitc @mhoffrog
-
 	# The following contents are generated by board configs
 	$(generate_for_all_board | merge)
 EOF

.github/labeler.yml

@@ -18,7 +18,7 @@
 - all:
   - changed-files:
     - any-glob-to-any-file: ['patch/**/*','config/**/*']
-    - all-globs-to-all-files: ['!config/cli/**/*','!config/desktop/**/*','!config/distributions/**/*']
+    - all-globs-to-all-files: ['!config/cli/**/*','!config/distributions/**/*']
 
 "Framework":
 - all:
@@ -41,11 +41,6 @@
     - any-glob-to-any-file: ['.github/**/*']
     - all-globs-to-any-file: ['!.github/workflows/**/*']
 
-"Desktop":
-- all:
-  - changed-files:
-    - any-glob-to-any-file: ['config/desktop/**/*']
-
 "Patches":
 - all:
   - changed-files:

.github/workflows/data-jira-ticket.yml

@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Sync
-        uses: igorpecovnik/github-action-issue-to-jira@master
+        uses: igorpecovnik/github-action-issue-to-jira@05d67c604cf13fc3c6c07d655d03439b0351747d # master
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/data-sync-board-list.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Repository Dispatch
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.ACCESS_TOKEN }}
           repository: armbian/armbian.github.io

.github/workflows/data-sync-labels.yml

@@ -27,10 +27,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@v6
+        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           yaml-file: .github/labels.yml

.github/workflows/data-sync-maintainers.yml

@@ -17,18 +17,25 @@ jobs:
     name: "Maintainers sync"
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'armbian' }}
+    env:
+      MAINTAINER_INACTIVE_DAYS: "365"   # maintainers idle >= this many days are dropped from CODEOWNERS (kept as BOARD_MAINTAINER)
     steps:
 
       - name: "Checkout build repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: armbian/build
-          ref:  main
+          # Follow the dispatched ref: the scheduled run is on main (so this is
+          # 'main' there), but a manual workflow_dispatch from a branch checks out
+          # THAT branch — so changes to generate_CODEOWNERS.sh / configs can be
+          # tested end-to-end before merge (was hardcoded 'main', which always ran
+          # main's files regardless of where you dispatched from).
+          ref: ${{ github.ref_name }}
           fetch-depth: 0
           clean: false
 
       - name: "Install SSH key for storage"
-        uses: shimataro/ssh-key-action@v2
+        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
         with:
           key: ${{ secrets.KEY_UPLOAD }}
           known_hosts: ${{ secrets.KNOWN_HOSTS_ARMBIAN_UPLOAD }}
@@ -44,27 +51,42 @@ jobs:
         run: |
 
           # reset all maintainers so we generate from scratch
-          sed -i "s/BOARD_MAINTAINER.*/BOARD_MAINTAINER=\"\"/" config/boards/*.{conf,wip,eos,tvb}
+          sed -i "s/BOARD_MAINTAINER.*/BOARD_MAINTAINER=\"\"/" config/boards/*.{conf,wip,csc,eos,tvb}
 
           # extract values fron JSON
           declare -A MAINTAINERS
+          INACTIVE_DAYS="${MAINTAINER_INACTIVE_DAYS:-365}"
+          : > /tmp/inactive_maintainers.txt   # GitHub usernames idle >= INACTIVE_DAYS (for CODEOWNERS)
           {
             # By default, bash run the pipe command in subshells
             # which make variable can't be assigned to.
             # And yes, lastpipe can solve it
             # But this is better.
-            while read -r i; do
-              NAME="$(echo "$i" | jq --raw-output '.First_Name')"
-              BOARD="$(echo "$i" | jq --raw-output '.Maintaining')"
-              MAINTAINER_GITHUB="$(echo "$i" | jq --raw-output '.Github' | cut -d"/" -f4)"
-              if [[ "$BOARD" != null && "$MAINTAINER_GITHUB" != null ]]; then
-                echo "- [$NAME](https://github.com/${MAINTAINER_GITHUB})"
-                while read -r i; do
-                  echo -e "  - $i"
-                  MAINTAINERS["$i"]+="$MAINTAINER_GITHUB "
-                done < <( echo "$BOARD" | sed "s/,/\n/g" | sort -u )
+            # One jq pass -> a row per maintainer: name, boards, github-username,
+            # idle-days, joined by US (0x1f). A non-whitespace separator is required:
+            # IFS=$'\t' read collapses consecutive tabs, so an empty field (e.g. a null
+            # Maintaining) would shift the columns. Replaces ~4 jq forks per record and
+            # the inner board loop's var that used to shadow the record var.
+            while IFS=$'\x1f' read -r NAME BOARD MAINTAINER_GITHUB DAYS; do
+              # long-inactive: kept in BOARD_MAINTAINER below, recorded for CODEOWNERS drop
+              if [[ -n "$MAINTAINER_GITHUB" && -n "$DAYS" ]] && (( DAYS >= INACTIVE_DAYS )); then
+                echo "$MAINTAINER_GITHUB" >> /tmp/inactive_maintainers.txt
+                echo "  ⚠ inactive ${DAYS}d: @${MAINTAINER_GITHUB} (dropped from CODEOWNERS)"
               fi
-            done < <(jq -c '.[]' /tmp/armbian_maintainers.json)
+              [[ -n "$BOARD" && -n "$MAINTAINER_GITHUB" ]] || continue
+              echo "- [$NAME](https://github.com/${MAINTAINER_GITHUB})"
+              while read -r board; do
+                [[ -n "$board" ]] || continue
+                echo -e "  - $board"
+                MAINTAINERS["$board"]+="$MAINTAINER_GITHUB "
+              done < <(echo "$BOARD" | tr ',' '\n' | sort -u)
+            done < <(jq -r '
+              .[] | [ (.First_Name // ""), (.Maintaining // ""),
+                      (.Github | split("/") | .[3] // ""),
+                      (if (.Days_since_last_activity | type) == "number"
+                       then (.Days_since_last_activity | floor | tostring) else "" end) ]
+                   | join("\u001f")
+            ' /tmp/armbian_maintainers.json)
 
             for cfg in config/boards/*.{conf,wip,csc,eos,tvb}; do
               board_name="$(echo "${cfg##*/}" | sed -E 's/\..*//')"
@@ -88,13 +110,53 @@ jobs:
             done
 
       - name: "Re-generate CODEOWNERS"
+        env:
+          INACTIVE_MAINTAINERS_FILE: /tmp/inactive_maintainers.txt
         run: |
 
           ./.github/generate_CODEOWNERS.sh
 
+      - name: "Flag CODEOWNERS users without write access"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -uo pipefail
+
+          # Individuals referenced in the generated CODEOWNERS (drop any @org/team refs).
+          mapfile -t users < <(grep -oE '@[A-Za-z0-9_/-]+' .github/CODEOWNERS \
+            | sed 's/^@//' | grep -v '/' | tr 'A-Z' 'a-z' | sort -u)
+
+          # Collaborators that actually have push (write) access. A CODEOWNERS entry
+          # for anyone WITHOUT write access is silently ignored by GitHub — never
+          # review-requested — so surface them for the maintainers to fix.
+          collabs="$(gh api --paginate "repos/${GITHUB_REPOSITORY}/collaborators" \
+            --jq '.[] | select(.permissions.push) | .login' 2>/dev/null || true)"
+          have_push="$(tr 'A-Z' 'a-z' <<<"$collabs" | sort -u)"
+
+          {
+            echo ""
+            echo "### CODEOWNERS users without write access"
+            echo ""
+            if [[ -z "$have_push" ]]; then
+              echo "_Could not read repository collaborators (token lacks access) — check skipped._"
+            else
+              missing=()
+              for u in "${users[@]}"; do
+                grep -qxF "$u" <<<"$have_push" || missing+=("$u")
+              done
+              if (( ${#missing[@]} )); then
+                echo "These ${#missing[@]} CODEOWNERS entries are ignored by GitHub until granted write access:"
+                echo ""
+                printf -- '- @%s\n' "${missing[@]}"
+              else
+                echo "_All ${#users[@]} CODEOWNERS users have write access._"
+              fi
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
       - name: Create Pull Request
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: '`Automatic` board configs status synchronise'

.github/workflows/data-sync-tools.yml

@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Get current ${{ matrix.tool.PROJECT_NAME }} version
         id: get-version-current
@@ -89,7 +89,7 @@ jobs:
           sed -i "s/${{ matrix.tool.VERSION_VAR}}=\${${{ matrix.tool.VERSION_VAR}}:-[0-9.]*}/${{ matrix.tool.VERSION_VAR}}=\${${{ matrix.tool.VERSION_VAR}}:-$version_latest}/g" ${{ matrix.tool.VAR_FILE }}
 
       - name: Create Pull Request to update ${{ matrix.tool.VERSION_VAR}} for ${{ matrix.tool.PROJECT_NAME }}
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "tools: Bump `${{ matrix.tool.VERSION_VAR}}` from ${{ steps.get-version-current.outputs.version_current }} to ${{ steps.get-version-latest.outputs.version_latest }}"

.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/infrastructure-dispatch-to-fork.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
       - name: Dispatch event on forked repository
         if: ${{ env.DISPATCH_SECRET != '' }}  # Check that the secret has been set, if not, exit
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ env.DISPATCH_SECRET }}
           repository: ${{ github.repository }}

.github/workflows/infrastructure-mirror-to-codeberg.yml

@@ -23,12 +23,12 @@ jobs:
 
     steps:
       - name: Checkout full history
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Mirror to Codeberg
-        uses: pixta-dev/repository-mirroring-action@v1
+        uses: pixta-dev/repository-mirroring-action@674e65a7d483ca28dafaacba0d07351bdcc8bd75 # v1.1.1
         with:
           target_repo_url: git@codeberg.org:armbian/build.git
           ssh_private_key: ${{ secrets.GHA_SSH_KEY }}

.github/workflows/maintenance-announce-merge.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Get repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Send push to Discord

.github/workflows/maintenance-announce-pr.yml

@@ -17,7 +17,7 @@ jobs:
     if: ${{ github.repository == 'armbian/build' && github.event.label.id == '6210849975' }}
     steps:
       - name: Get repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Discord webhook

.github/workflows/maintenance-auto-label.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout the pull request
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for label using GH CLI
         id: check
@@ -35,7 +35,7 @@ jobs:
 
       - name: Remove "Ready to merge" label
         if: steps.check.outputs.has_label == 'true'
-        uses: PauMAVA/add-remove-label-action@v1.0.3
+        uses: PauMAVA/add-remove-label-action@d1dae9b1a6c5b44b7740a3e7f64723fe7c9619d3 # v1.0.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           add: ""
@@ -48,10 +48,10 @@ jobs:
 
     steps:
       # Checks out the repository to read files for matching with labeler config
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Applies labels based on the .github/labeler.yml config
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
 
@@ -63,7 +63,7 @@ jobs:
     steps:
       # Automatically adds size labels based on total changed lines
       - name: Label by size
-        uses: pascalgn/size-label-action@v0.5.7
+        uses: pascalgn/size-label-action@56b489b027932ec0cf60438a1a5f1a19c8fc71ff # v0.5.7
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         with:
@@ -107,7 +107,7 @@ jobs:
 
       # Adds the quarter label to the PR
       - name: Add quarter label
-        uses: PauMAVA/add-remove-label-action@v1.0.3
+        uses: PauMAVA/add-remove-label-action@d1dae9b1a6c5b44b7740a3e7f64723fe7c9619d3 # v1.0.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           add: "${{ env.LABEL }}"