gmentci: add PR stack usage report via puncover

Add scripts and a CI workflow step that compare static stack usage
between a PR and its merge base. On each PR, the workflow rebuilds
with `CONFIG_STACK_USAGE=y`, runs puncover via `stack_threads.py`,
and posts a sticky comment with a per-thread table showing configured
size, max static depth, delta vs base, and remaining margin.

Thread entry points are discovered from `K_THREAD_DEFINE` in app
sources; Zephyr/NCS subsystem stacks are resolved via `rg` in the
west tree with a small fallback map. Work queues list configured
size only since puncover can't attribute depth per queue.

Signed-off-by: Simen S. Røstad <simen.rostad@nordicsemi.no>

Author: simensrostad

.github/workflows/build.yml

@@ -280,6 +280,30 @@ jobs:
           header: app-size-report
           path: ${{ github.workspace }}/size-comment.md
 
+      - name: Install puncover
+        if: github.event_name == 'pull_request'
+        run: pip install puncover --break-system-packages
+
+      - name: Generate PR stack usage comment for thingy91x image
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          BOARD: thingy91x/nrf9151/ns
+          PR_APP_DIR: ${{ github.workspace }}/asset-tracker-template/app
+          STACK_COMMENT_PATH: ${{ github.workspace }}/stack-comment.md
+          CI_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          SDK_BIN=$(ls -d /opt/toolchains/zephyr-sdk-*/arm-zephyr-eabi/bin 2>/dev/null | head -1)
+          [ -n "$SDK_BIN" ] && export PATH="$SDK_BIN:$PATH"
+          bash asset-tracker-template/scripts/ci/pr-stack-usage.sh
+
+      - name: Post PR stack usage sticky comment for thingy91x image
+        if: github.event_name == 'pull_request'
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        with:
+          header: stack-usage-report
+          path: ${{ github.workspace }}/stack-comment.md
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:

scripts/ci/pr-stack-usage.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Generate a sticky-comment-ready markdown body with puncover static stack usage
+# for ATT module threads (PR vs merge base).
+#
+# Required env vars:
+#   BASE_SHA, BOARD, STACK_COMMENT_PATH
+#   PR_APP_DIR     path to app/ in this checkout (default: <repo>/app)
+#   PR_BUILD_DIR   existing west build dir for PR head (default: PR_APP_DIR/build)
+# Optional:
+#   CI_RUN_URL
+
+set -euo pipefail
+: "${BASE_SHA:?}" "${BOARD:?}" "${STACK_COMMENT_PATH:?}"
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+WORKSPACE_DIR="$(cd "$REPO_ROOT/.." && pwd)"
+PR_APP_DIR="${PR_APP_DIR:-$REPO_ROOT/app}"
+# Separate from the release build dir so we do not disturb CI firmware artifacts.
+PR_STACK_BUILD_DIR="${PR_STACK_BUILD_DIR:-$PR_APP_DIR/build-stack-analysis}"
+BASELINE_STACK_BUILD_DIR="${BASELINE_STACK_BUILD_DIR:-$PR_APP_DIR/build-baseline-stack}"
+STACK_DIR="${STACK_DIR:-$(dirname "$STACK_COMMENT_PATH")/stack}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+mkdir -p "$STACK_DIR" "$(dirname "$STACK_COMMENT_PATH")"
+PR_SHA=$(git -C "$REPO_ROOT" rev-parse HEAD)
+
+write_failure_comment() {
+  echo "Stack usage report failed. See [CI run](${CI_RUN_URL:-}) for logs." >"$STACK_COMMENT_PATH"
+}
+
+stack_build() {
+  local build_dir="$1"
+  rm -rf "$build_dir"
+  (cd "$PR_APP_DIR" && west build -p --sysbuild -b "$BOARD" -d "$build_dir" -- \
+    -DCONFIG_STACK_USAGE=y 2>&1)
+}
+
+run_report() {
+  local elf="$1" build_dir="$2" config="$3" out="$4"
+  bash "$SCRIPT_DIR/run-puncover-stack-report.sh" \
+    "$elf" "$build_dir/app" "$config" "$out" "$PR_APP_DIR"
+}
+
+(
+  # Rebuild with CONFIG_STACK_USAGE=y so GCC emits .su files for puncover.
+  stack_build "$PR_STACK_BUILD_DIR" | tee "$STACK_DIR/pr_stack_build.log"
+  run_report \
+    "$PR_STACK_BUILD_DIR/app/zephyr/zephyr.elf" \
+    "$PR_STACK_BUILD_DIR" \
+    "$PR_STACK_BUILD_DIR/app/zephyr/.config" \
+    "$STACK_DIR/pr_stack.json"
+
+  git -C "$REPO_ROOT" fetch --depth=1 origin "$BASE_SHA"
+  git -C "$REPO_ROOT" checkout --detach "$BASE_SHA"
+  (cd "$WORKSPACE_DIR" && west update -o=--depth=1 -n)
+  stack_build "$BASELINE_STACK_BUILD_DIR" | tee "$STACK_DIR/baseline_stack_build.log"
+  run_report \
+    "$BASELINE_STACK_BUILD_DIR/app/zephyr/zephyr.elf" \
+    "$BASELINE_STACK_BUILD_DIR" \
+    "$BASELINE_STACK_BUILD_DIR/app/zephyr/.config" \
+    "$STACK_DIR/baseline_stack.json"
+  git -C "$REPO_ROOT" checkout --detach "$PR_SHA"
+
+  python3 "$SCRIPT_DIR/stack_threads.py" format-comment \
+    "$STACK_DIR/pr_stack.json" \
+    "$STACK_DIR/baseline_stack.json" \
+    "$PR_APP_DIR" \
+    --config "$PR_STACK_BUILD_DIR/app/zephyr/.config" \
+    --west "$WORKSPACE_DIR" \
+    --ci-url "${CI_RUN_URL:-}" \
+    >"$STACK_COMMENT_PATH"
+) || write_failure_comment

scripts/ci/run-puncover-stack-report.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Run puncover static stack analysis (threads discovered from app sources).
+#
+# Usage: run-puncover-stack-report.sh <elf> <build_dir> <zephyr.config> <output.json> <app_dir>
+
+set -euo pipefail
+
+ELF="${1:?elf}"
+BUILD_DIR="${2:?build_dir}"
+CONFIG_FILE="${3:?config}"
+OUTPUT_JSON="${4:?output.json}"
+APP_DIR="${5:?app_dir}"
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+if ! command -v puncover >/dev/null 2>&1; then
+  echo "puncover not found on PATH" >&2
+  exit 1
+fi
+
+WEST_DIR="${WEST_DIR:-$(cd "$APP_DIR/../.." && pwd)}"
+
+python3 "$SCRIPT_DIR/stack_threads.py" report \
+  "$ELF" "$BUILD_DIR" "$CONFIG_FILE" "$OUTPUT_JSON" "$APP_DIR" \
+  --west "$WEST_DIR"