ci(tests): Avoid the use of pull_request_target where possible (espressif#9899)

Author: lucasssvaz

.github/workflows/tests.yml

@@ -1,10 +1,29 @@
+# This file is used to run the runtime tests for the Arduino core for ESP32.
+# The tests are run on the hardware, Wokwi and QEMU emulators.
+# The QEMU tests are disabled for now as they are redundant with most of the Wokwi tests.
+# As the Wokwi tests require access to secrets, they are run in a separate workflow.
+# We need to ensure that the artifacts from previous tests in the chain are propagated for publishing the results.
+# This is the current trigger sequence for the tests:
+# tests.yml -> tests_wokwi.yml -> tests_results.yml
+# ⌙> tests_build.yml
+# ⌙> tests_hw.yml
+# ⌙> tests_qemu.yml
+
 name: Runtime Tests
 
 on:
  workflow_dispatch:
- pull_request_target:
+ pull_request:
  types: [opened, reopened, closed, synchronize, labeled, unlabeled]
  paths:
+ - '.github/workflows/tests*'
+ - '.github/scripts/*.sh'
+ - '!.github/scripts/check-cmakelists.sh'
+ - '!.github/scripts/find_*'
+ - '!.github/scripts/on-*.sh'
+ - '!.github/scripts/set_push_chunks.sh'
+ - '!.github/scripts/update-version.sh'
+ - '!.github/scripts/upload_py_tools.sh'
  - 'tests/**'
  - 'cores/**'
  - 'libraries/**'
@@ -19,14 +38,19 @@ concurrency:
  group: tests-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 
-# To avoid giving elevated permissions to the entire workflow, specify default permissions at the top level
-# and then override them for specific jobs.
-permissions: { contents: read }
-
 jobs:
+ push-event-file:
+ name: Push event file
+ runs-on: ubuntu-latest
+ steps:
+ - name: Upload
+ uses: actions/upload-artifact@v4
+ with:
+ name: event_file
+ path: ${{ github.event_path }}
+
  gen-matrix:
  name: Generate matrix
- if: github.event.action != 'closed'
  runs-on: ubuntu-latest
  outputs:
  build-types: ${{ steps.set-matrix.outputs.build-types }}
@@ -59,9 +83,8 @@ jobs:
 
  call-build-tests:
  name: Build
- uses: espressif/arduino-esp32/.github/workflows/build_tests.yml@master
+ uses: ./.github/workflows/tests_build.yml
  needs: gen-matrix
- if: github.event.action != 'closed'
  strategy:
  matrix:
  type: ${{ fromJson(needs.gen-matrix.outputs.build-types) }}
@@ -72,11 +95,11 @@ jobs:
 
  call-hardware-tests:
  name: Hardware
- uses: espressif/arduino-esp32/.github/workflows/hw.yml@master
+ uses: ./.github/workflows/tests_hw.yml
  needs: [gen-matrix, call-build-tests]
  if: |
  github.repository == 'espressif/arduino-esp32' &&
- (github.event_name != 'pull_request_target' ||
+ (github.event_name != 'pull_request' ||
  contains(github.event.pull_request.labels.*.name, 'hil_test'))
  strategy:
  fail-fast: false
@@ -87,26 +110,10 @@ jobs:
  type: ${{ matrix.type }}
  chip: ${{ matrix.chip }}
 
- call-wokwi-tests:
- name: Wokwi
- uses: espressif/arduino-esp32/.github/workflows/wokwi.yml@master
- needs: [gen-matrix, call-build-tests]
- if: github.event.action != 'closed'
- strategy:
- fail-fast: false
- matrix:
- type: ${{ fromJson(needs.gen-matrix.outputs.wokwi-types) }}
- chip: ['esp32', 'esp32s2', 'esp32s3', 'esp32c3', 'esp32c6', 'esp32h2']
- secrets:
- WOKWI_CLI_TOKEN: ${{ secrets.WOKWI_CLI_TOKEN }}
- with:
- type: ${{ matrix.type }}
- chip: ${{ matrix.chip }}
-
  # This job is disabled for now
  call-qemu-tests:
  name: QEMU
- uses: espressif/arduino-esp32/.github/workflows/qemu.yml@master
+ uses: ./.github/workflows/tests_qemu.yml
  needs: [gen-matrix, call-build-tests]
  if: false
  strategy:
@@ -118,78 +125,4 @@ jobs:
  type: ${{ matrix.type }}
  chip: ${{ matrix.chip }}
 
- unit-test-results:
- name: Unit Test Results
- needs: [call-hardware-tests, call-wokwi-tests, call-qemu-tests]
- if: always() && github.event_name == 'pull_request_target'
- runs-on: ubuntu-latest
- permissions:
- checks: write
- pull-requests: write
- steps:
- - name: Download and Extract HW Artifacts
- uses: actions/download-artifact@v4
- continue-on-error: true
- with:
- merge-multiple: true
- pattern: tests-results-hw-*
- path: ./results/hw
-
- - name: Download and Extract Wokwi Artifacts
- uses: actions/download-artifact@v4
- continue-on-error: true
- with:
- merge-multiple: true
- pattern: tests-results-wokwi-*
- path: ./results/wokwi
-
- - name: Download and Extract QEMU Artifacts
- uses: actions/download-artifact@v4
- continue-on-error: true
- with:
- merge-multiple: true
- pattern: tests-results-qemu-*
- path: ./results/qemu
-
- - name: Publish Unit Test Results
- uses: EnricoMi/publish-unit-test-result-action@v2
- with:
- commit: ${{ github.event.pull_request.head.sha || github.sha }}
- files: ./results/**/*.xml
- clean:
- name: Clean objects
- needs: unit-test-results
- if: always()
- permissions:
- actions: write
- runs-on: ubuntu-latest
- steps:
- - name: Clean up caches
- uses: actions/github-script@v7
- with:
- script: |
- const ref = '${{ github.event.pull_request.number || github.ref }}';
- const key_prefix = 'tests-' + ref + '-';
-
- if ('${{ github.event_name }}' == 'pull_request_target' && '${{ github.event.action }}' != 'closed') {
- console.log('Skipping cache cleanup for open PR');
- return;
- }
-
- await github.paginate(github.rest.actions.getActionsCacheList, {
- owner: context.repo.owner,
- repo: context.repo.repo,
- per_page: 100,
- key: key_prefix
- }).then(caches => {
- if (caches) {
- for (const cache of caches) {
- console.log(`Deleting cache: ${cache.key}`);
- github.rest.actions.deleteActionsCacheById({
- owner: context.repo.owner,
- repo: context.repo.repo,
- cache_id: cache.id
- });
- }
- }
- });
+ # Wokwi tests are run after this workflow as it needs access to secrets

.github/workflows/build_tests.yml renamed to .github/workflows/tests_build.yml

@@ -20,8 +20,8 @@ jobs:
  id: ${{ github.event.pull_request.number || github.ref }}-${{ github.event.pull_request.head.sha || github.sha }}-${{ inputs.chip }}-${{ inputs.type }}
  steps:
  - name: Check if already built
- if: ${{ github.event.pull_request.number != null }}
  id: cache-build-binaries
+ if: github.event.pull_request.number != null
  uses: actions/cache/restore@v4
  with:
  key: tests-${{ env.id }}-bin
@@ -46,21 +46,6 @@ jobs:
  - name: Checkout user repository
  if: ${{ steps.check-build.outputs.enabled == 'true' }}
  uses: actions/checkout@v4
- with:
- ref: ${{ github.event.pull_request.head.sha || github.sha }}
- persist-credentials: false
- sparse-checkout-cone-mode: false
- sparse-checkout: |
- /*
- !.github
-
- # To avoid giving unknown scripts elevated permissions, download them from the master branch
- - name: Get CI scripts from master
- if: ${{ steps.check-build.outputs.enabled == 'true' }}
- run: |
- mkdir -p .github
- cd .github
- curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github
 
  - name: Get libs cache
  uses: actions/cache@v4
@@ -83,7 +68,7 @@ jobs:
 
  - name: Upload ${{ inputs.chip }} ${{ inputs.type }} binaries as cache
  uses: actions/cache/save@v4
- if: ${{ steps.check-build.outputs.enabled == 'true' }}
+ if: steps.check-build.outputs.enabled == 'true' && github.event.pull_request.number != null
  with:
  key: tests-${{ env.id }}-bin
  path: |

.github/workflows/hw.yml renamed to .github/workflows/tests_hw.yml

@@ -22,9 +22,9 @@ jobs:
  image: python:3.10.1-bullseye
  options: --privileged
  steps:
- - name: Check if already built
- if: ${{ github.event.pull_request.number != null }}
+ - name: Check if already passed
  id: cache-results
+ if: github.event.pull_request.number != null
  uses: actions/cache/restore@v4
  with:
  key: tests-${{ env.id }}-results-hw
@@ -48,21 +48,6 @@ jobs:
  - name: Checkout user repository
  if: ${{ steps.check-tests.outputs.enabled == 'true' }}
  uses: actions/checkout@v4
- with:
- ref: ${{ github.event.pull_request.head.sha || github.sha }}
- persist-credentials: false
- sparse-checkout-cone-mode: false
- sparse-checkout: |
- /*
- !.github
-
- # To avoid giving unknown scripts elevated permissions, download them from the master branch
- - name: Get CI scripts from master
- if: ${{ steps.check-tests.outputs.enabled == 'true' }}
- run: |
- mkdir -p .github
- cd .github
- curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github
 
  # setup-python currently only works on ubuntu images
  # - uses: actions/setup-python@v5
@@ -95,7 +80,7 @@ jobs:
 
  - name: Upload ${{ inputs.chip }} ${{ inputs.type }} hardware results as cache
  uses: actions/cache/save@v4
- if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
+ if: steps.check-tests.outputs.enabled == 'true' && github.event.pull_request.number != null
  with:
  key: tests-${{ env.id }}-results-hw
  path: |

.github/workflows/qemu.yml renamed to .github/workflows/tests_qemu.yml

@@ -18,9 +18,9 @@ jobs:
  QEMU_INSTALL_PATH: "$HOME"
  runs-on: ubuntu-latest
  steps:
- - name: Check if already run
- if: ${{ github.event.pull_request.number != null }}
+ - name: Check if already passed
  id: get-cache-results
+ if: github.event.pull_request.number != null
  uses: actions/cache/restore@v4
  with:
  key: tests-${{ env.id }}-results-qemu
@@ -97,7 +97,7 @@ jobs:
  with:
  path: |
  ~/qemu
- key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/qemu.yml') }}
+ key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/tests_qemu.yml') }}
 
  - name: Download QEMU
  if: ${{ steps.cache-qemu.outputs.cache-hit != 'true' && steps.check-tests.outputs.enabled == 'true' }}
@@ -125,7 +125,7 @@ jobs:
 
  - name: Upload ${{ inputs.chip }} ${{ inputs.type }} QEMU results as cache
  uses: actions/cache/save@v4
- if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
+ if: steps.check-tests.outputs.enabled == 'true' && github.event.pull_request.number != null
  with:
  key: tests-${{ env.id }}-results-qemu
  path: |