Merge branch 'master' into matter-python

Author: arkq

.github/.wordlist.txt

@@ -369,6 +369,7 @@ decrypt
 decrypted
 DEDEDEDE
 deepnote
+deepwiki
 DefaultOTAProviders
 DefaultOTARequestor
 DefaultOTARequestorDriver
@@ -755,10 +756,12 @@ itsfoss
 IW
 JDK
 jinja
+JCM
 JLink
 JLinkExe
 JLinkRTTClient
 JN
+jf
 jni
 jpg
 jre

.github/actions/add-ipv6/action.yaml

@@ -0,0 +1,18 @@
+name: Set up an IPV6 environment
+description: Creates a socket pair with a "peer" network namespace that supports IPV6
+runs:
+  using: "composite"
+  steps:
+    - name: Set up IPV6
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      run: |
+         ip netns add peer
+
+         ip link add name veth0 type veth peer name veth0-peer
+         ip -6 addr add fd00:0:1:1::1/64 dev veth0
+         ip link set dev veth0 up
+
+         ip link set veth0-peer netns peer
+         ip netns exec peer ip -6 addr add fd00:0:1:1::2/64 dev veth0-peer
+         ip netns exec peer ip link set dev veth0-peer up

.github/actions/bootstrap-cache/action.yaml

@@ -11,7 +11,7 @@ runs:
         attempt_limit: 3
         attempt_delay: 2000
         with: |
-          key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'scripts/py_matter_idl/*', 'third_party/pigweed/**', '/etc/lsb-release') }}
+          key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'scripts/tests/requirements.txt', 'scripts/py_matter_idl/*', 'third_party/pigweed/**', '/etc/lsb-release') }}
           path: |
               .environment
               build_overrides/pigweed_environment.gni

.github/actions/bootstrap/action.yaml

@@ -25,7 +25,7 @@ runs:
         # In addition to the various setup files, the work directory matters as well,
         # because the bootstrapped Pigweed environment contains absolute paths.
         echo "Calculating bootstrap cache key for '$PWD'"
-        FILES_HASH="${{ hashFiles('scripts/setup/*', 'scripts/py_matter_idl/*', 'third_party/pigweed/**') }}"
+        FILES_HASH="${{ hashFiles('scripts/setup/*', 'scripts/tests/requirements.txt', 'scripts/py_matter_idl/*', 'third_party/pigweed/**') }}"
         case "$RUNNER_OS" in
           macOS) OS_HASH="$(sw_vers | shasum -a 256 | cut -d' ' -f1)";;
           *)     OS_HASH="$(shasum -a 256 /etc/lsb-release | cut -d' ' -f1)";;

.github/actions/perform-codeql-analysis/action.yaml

@@ -8,22 +8,26 @@ runs:
   using: "composite"
   steps:
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{ inputs.language }}"
         upload: False
         output: sarif-results
     - name: filter-sarif
       uses: advanced-security/filter-sarif@v1
       with:
+        # We also disable checks that are not too important and that result in many hundreds of alerts with generated code, such as the check "Empty branch of conditional"
         patterns: |
           -**/third_party/**
           -**/scripts/**
+          -**/tests/**
+          -**/*.cpp:cpp/trivial-switch
+          -**/*.cpp:cpp/empty-block
         input: "sarif-results/${{ inputs.language }}.sarif"
         output: "sarif-results/${{ inputs.language }}.sarif"
 
     - name: Upload SARIF
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
       with:
         sarif_file: "sarif-results/${{ inputs.language }}.sarif"
     - name: Upload loc as a Build Artifact

.github/workflows/bloat_check.yaml

@@ -34,7 +34,7 @@ jobs:
         runs-on: ubuntu-latest
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
 
         steps:
             - name: Checkout

.github/workflows/build.yaml

@@ -43,7 +43,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
             volumes:
                 - "/:/runner-root-volume"
                 - "/tmp/log_output:/tmp/test_logs"
@@ -75,27 +75,49 @@ jobs:
               uses: github/codeql-action/init@v3
               with:
                   languages: "cpp"
+                  queries: security-extended, security-and-quality
             - name: Setup Build
               run: scripts/build/gn_gen.sh --args="chip_config_memory_debug_checks=true chip_config_memory_debug_dmalloc=false"
             - name: Run Build
               run: scripts/run_in_build_env.sh "ninja -C ./out"
             - name: Run Tests
               run: scripts/tests/gn_tests.sh
+            - name: Clean out build output
+              run: rm -rf ./out
+
+            # Do not run below steps with CodeQL since we are getting "Out of runner space issues" with CodeQL and their added coverage is limited
             - name: Set up Build Without Detail Logging
+              if: inputs.run-codeql != true
               run: scripts/build/gn_gen.sh --args="chip_detail_logging=false"
             - name: Run Build Without Detail Logging
+              if: inputs.run-codeql != true
               run: scripts/run_in_build_env.sh "ninja -C ./out"
+            - name: Cleanout build output
+              if: inputs.run-codeql != true
+              run: rm -rf ./out
             - name: Set up Build Without Progress Logging
+              if: inputs.run-codeql != true
               run: scripts/build/gn_gen.sh --args="chip_detail_logging=false chip_progress_logging=false"
             - name: Run Build Without Progress Logging
+              if: inputs.run-codeql != true
               run: scripts/run_in_build_env.sh "ninja -C ./out"
+            - name: Clean out build output
+              if: inputs.run-codeql != true
+              run: rm -rf ./out
             - name: Set up Build Without Error Logging
+              if: inputs.run-codeql != true
               run: scripts/build/gn_gen.sh --args="chip_detail_logging=false chip_progress_logging=false chip_error_logging=false"
             - name: Run Build Without Error Logging
+              if: inputs.run-codeql != true
               run: scripts/run_in_build_env.sh "ninja -C ./out"
+            - name: Clean out build output
+              if: inputs.run-codeql != true
+              run: rm -rf ./out
             - name: Set up Build Without Logging
+              if: inputs.run-codeql != true
               run: scripts/build/gn_gen.sh --args="chip_logging=false"
             - name: Run Build Without Logging
+              if: inputs.run-codeql != true
               run: scripts/run_in_build_env.sh "ninja -C ./out"
             - name: Uploading core files
               uses: actions/upload-artifact@v4
@@ -128,10 +150,10 @@ jobs:
         name: Build on Linux (fake, gcc_release, clang, simulated)
 
         runs-on: ubuntu-latest
-        if: github.actor != 'restyled-io[bot]'
+        if: github.actor != 'restyled-io[bot]' && inputs.run-codeql != true
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
             volumes:
                 - "/:/runner-root-volume"
                 - "/tmp/log_output:/tmp/test_logs"
@@ -161,11 +183,13 @@ jobs:
               uses: ./.github/actions/checkout-submodules-and-bootstrap
               with:
                 platform: linux
-            - name: Initialize CodeQL
-              if: ${{ inputs.run-codeql  }}
-              uses: github/codeql-action/init@v3
-              with:
-                  languages: "cpp"
+            # CodeQL + this job is consistently failing (in the step "Run Tests with sanitizers")
+            # deactivate until a better workaround is found
+            # - name: Initialize CodeQL
+            #   if: ${{ inputs.run-codeql  }}
+            #   uses: github/codeql-action/init@v3
+            #   with:
+            #       languages: "cpp"
             - name: Setup and Build Simulated Device
               run: |
                   BUILD_TYPE=simulated
@@ -270,11 +294,13 @@ jobs:
               run: |
                   ./scripts/run_in_build_env.sh \
                     "./scripts/build/build_examples.py --target linux-fake-tests build"
-            - name: Perform CodeQL Analysis
-              if: ${{ inputs.run-codeql  }}
-              uses: ./.github/actions/perform-codeql-analysis
-              with:
-                language: cpp
+            # CodeQL + this job is consistently failing (in the step "Run Tests with sanitizers")
+            # deactivate until a better solution is found
+            # - name: Perform CodeQL Analysis
+            #   if: ${{ inputs.run-codeql  }}
+            #   uses: ./.github/actions/perform-codeql-analysis
+            #   with:
+            #     language: cpp
 
             - name: Uploading core files
               uses: actions/upload-artifact@v4
@@ -302,10 +328,10 @@ jobs:
         name: Build on Linux (python_lib)
 
         runs-on: ubuntu-latest
-        if: github.actor != 'restyled-io[bot]'
+        if: github.actor != 'restyled-io[bot]' && inputs.run-codeql != true
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
             volumes:
                 - "/:/runner-root-volume"
                 - "/tmp/log_output:/tmp/test_logs"
@@ -367,10 +393,10 @@ jobs:
         name: Build on Linux (python lighting-app)
 
         runs-on: ubuntu-latest
-        if: github.actor != 'restyled-io[bot]'
+        if: github.actor != 'restyled-io[bot]' && inputs.run-codeql != true
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
             volumes:
                 - "/:/runner-root-volume"
                 - "/tmp/log_output:/tmp/test_logs"
@@ -400,7 +426,7 @@ jobs:
     build_darwin:
         name: Build on Darwin (clang, simulated)
         runs-on: macos-13
-        if: github.actor != 'restyled-io[bot]'
+        if: github.actor != 'restyled-io[bot]'  && inputs.run-codeql != true
 
         steps:
             - name: Checkout
@@ -415,11 +441,12 @@ jobs:
             - name: Try to ensure the directory for diagnostic log collection exists
               run: |
                   mkdir -p ~/Library/Logs/DiagnosticReports || true
-            - name: Initialize CodeQL
-              if: ${{ inputs.run-codeql  }}
-              uses: github/codeql-action/init@v3
-              with:
-                  languages: "cpp"
+            #  Build on Darwin + CodeQL often takes 6 hours (which is more than the maximum allowed by GitHub Runners), Deactivate it until we can investigate this
+            # - name: Initialize CodeQL
+            #   if: ${{ inputs.run-codeql  }}
+            #   uses: github/codeql-action/init@v3
+            #   with:
+            #       languages: "cpp"
 
             - name: Setup and Build Simulated Device
               run: |
@@ -473,11 +500,12 @@ jobs:
                   name: crash-log-darwin
                   path: ~/Library/Logs/DiagnosticReports/
 
-            - name: Perform CodeQL Analysis
-              if: ${{ inputs.run-codeql  }}
-              uses: ./.github/actions/perform-codeql-analysis
-              with:
-                language: cpp
+            #  Build on Darwin + CodeQL often takes 6 hours (which is more than the maximum allowed by GitHub Runners), Deactivate it until we can investigate this
+            # - name: Perform CodeQL Analysis
+            #   if: ${{ inputs.run-codeql  }}
+            #   uses: ./.github/actions/perform-codeql-analysis
+            #   with:
+            #     language: cpp
 
             # TODO Log Upload https://github.com/project-chip/connectedhomeip/issues/2227
             # TODO https://github.com/project-chip/connectedhomeip/issues/1512
@@ -488,11 +516,11 @@ jobs:
         env:
             TSAN_OPTIONS: "halt_on_error=1 suppressions=scripts/tests/chiptest/tsan-linux-suppressions.txt"
 
-        if: github.actor != 'restyled-io[bot]'
+        if: github.actor != 'restyled-io[bot]' && inputs.run-codeql != true
         runs-on: ubuntu-latest
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
             options: --privileged --sysctl "net.ipv6.conf.all.disable_ipv6=0
                 net.ipv4.conf.all.forwarding=0 net.ipv6.conf.all.forwarding=0"
 

.github/workflows/chef.yaml

@@ -36,7 +36,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
             options: --user root
 
         steps:
@@ -58,7 +58,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build:125
+            image: ghcr.io/project-chip/chip-build:129
             options: --user root
 
         steps:
@@ -79,7 +79,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build-esp32:125
+            image: ghcr.io/project-chip/chip-build-esp32:129
             options: --user root
 
         steps:
@@ -100,7 +100,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build-nrf-platform:125
+            image: ghcr.io/project-chip/chip-build-nrf-platform:129
             options: --user root
 
         steps:
@@ -121,7 +121,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build-telink:125
+            image: ghcr.io/project-chip/chip-build-telink:129
             options: --user root
 
         steps:
@@ -133,7 +133,7 @@ jobs:
                 platform: telink
             # - name: Update Zephyr to specific revision (for developers purpose)
             #   shell: bash
-            #   run: scripts/run_in_build_env.sh "python3 scripts/tools/telink/update_zephyr.py 46b82695b9390d74bcfa4b01a14a009c01b96895"
+            #   run: scripts/run_in_build_env.sh "python3 scripts/tools/telink/update_zephyr.py ed037d7de7c23eb14c908453d2d481cdf782796a"
             - name: CI Examples Telink
               shell: bash
               run: |

.github/workflows/darwin.yaml

@@ -96,15 +96,6 @@ jobs:
                   platform: darwin
                   bootstrap-log-name:
                       bootstrap-logs-framework-${{ matrix.options.flavor }}
-            - name: Build example All Clusters Server
-              run: |
-                  scripts/examples/gn_build_example.sh examples/all-clusters-app/linux out/debug/all-clusters-app chip_config_network_layer_ble=false
-            - name: Build example OTA Provider
-              run: |
-                  scripts/examples/gn_build_example.sh examples/ota-provider-app/linux out/debug/ota-provider-app chip_config_network_layer_ble=false
-            - name: Build example OTA Requestor
-              run: |
-                  scripts/examples/gn_build_example.sh examples/ota-requestor-app/linux out/debug/ota-requestor-app chip_config_network_layer_ble=false non_spec_compliant_ota_action_delay_floor=0
             - name: Run Framework Tests
               # We want to ensure that our log upload runs on timeout, so use a timeout here shorter
               # than the 6-hour overall job timeout.  4.5 hours should be plenty.

.github/workflows/doxygen.yaml

@@ -84,7 +84,7 @@ jobs:
 
         runs-on: ubuntu-latest
         container:
-            image: ghcr.io/project-chip/chip-build-doxygen:125
+            image: ghcr.io/project-chip/chip-build-doxygen:129
 
         if: github.actor != 'restyled-io[bot]'
 

.github/workflows/examples-ameba.yaml

@@ -39,7 +39,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build-ameba:125
+            image: ghcr.io/project-chip/chip-build-ameba:129
             options: --user root
 
         steps:

.github/workflows/examples-asr.yaml

@@ -37,7 +37,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build-asr:125
+            image: ghcr.io/project-chip/chip-build-asr:129
             options: --user root
 
         steps:

.github/workflows/examples-bouffalolab.yaml

@@ -38,7 +38,7 @@ jobs:
     if: github.actor != 'restyled-io[bot]'
 
     container:
-      image: ghcr.io/project-chip/chip-build-bouffalolab:125
+      image: ghcr.io/project-chip/chip-build-bouffalolab:129
       volumes:
         - "/tmp/bloat_reports:/tmp/bloat_reports"
     steps: