-
Notifications
You must be signed in to change notification settings - Fork 52
Port CT002/CT003 emulator to ESPHome as external component #385
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
5d1ccb9
4c828e4
e24a959
4783438
0e4614e
173faf3
bd32fc1
ecdc82c
fdbb0b9
a5e4945
e4071ac
e051ba0
d7ea1d3
af21fd9
25831ca
2cdbd8e
5178b72
95f1ad9
374c8e9
83c37a4
50a341d
a9dbd00
e7d15cc
99f0c9a
fbaa66c
38a673f
c0d0e8c
adeb2cd
8dd629a
4405d8e
b9597b5
d5fa928
ca9a4d7
f214091
f824450
149a322
94c166a
f3867e2
6427639
fa9cc39
d641d82
a24b898
e7efa61
e473b41
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,6 +43,112 @@ jobs: | |
| - name: Mypy | ||
| run: uv run mypy src/ | ||
|
|
||
| ct002-host-protocol: | ||
| needs: [ lint ] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v5 | ||
| with: | ||
| enable-cache: true | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.13" | ||
|
|
||
| - name: Install build tooling | ||
| run: sudo apt-get update -qq && sudo apt-get install -y -qq cmake g++ | ||
|
|
||
| - name: Install dependencies | ||
| run: uv sync --frozen --extra dev | ||
|
|
||
| - name: Run host-gcc protocol + wrappers + balancer parity tests | ||
| run: uv run pytest tests/components/ct002/test_host_protocol.py -v | ||
|
|
||
| # Discover the ct002 compile targets dynamically so adding a | ||
| # tests/components/ct002/test.*.yaml file is automatically compiled in CI | ||
| # without editing this workflow. | ||
| ct002-esphome-yaml: | ||
| needs: [ lint ] | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| matrix: ${{ steps.find.outputs.matrix }} | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Collect test YAML files | ||
| id: find | ||
| run: | | ||
| matrix=$(ls tests/components/ct002/test.*.yaml | jq -R -s -c 'split("\n")[:-1]') | ||
| echo "matrix=$matrix" >> "$GITHUB_OUTPUT" | ||
|
Comment on lines
+87
to
+88
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Confirm direct matrix interpolation into shell execution points
rg -n 'esphome compile \${{\s*matrix\.yaml\s*}}' .github/workflows/ci.ymlRepository: tomquist/AstraMeter Length of output: 205 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Show the referenced lines for exact context
nl -ba .github/workflows/ci.yml | sed -n '70,130p'
# Find how matrix.yaml is used in esphome compile invocations
rg -n "matrix\.yaml" .github/workflows/ci.yml
rg -n "esphome compile" .github/workflows/ci.yml
rg -n "compile \\$\\{\\{\\s*matrix\\.yaml\\s*\\}\\}" .github/workflows/ci.yml || trueRepository: tomquist/AstraMeter Length of output: 106 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Print the referenced region with line numbers via awk
awk 'NR>=70 && NR<=130 {printf "%d:%s\n", NR, $0}' .github/workflows/ci.yml
# Find all occurrences of matrix.yaml and esphome compile usage
rg -n "matrix\.yaml" .github/workflows/ci.yml
rg -n "esphome compile" .github/workflows/ci.yml
rg -n "esphome compile.*\\$\\{\\{\\s*matrix\\.yaml\\s*\\}\\}" .github/workflows/ci.yml || trueRepository: tomquist/AstraMeter Length of output: 2290 🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n "\\$\\{\\{\\s*matrix\\." .github/workflows/ci.yml || true
rg -n "esphome compile" .github/workflows/ci.ymlRepository: tomquist/AstraMeter Length of output: 792 Quote and pass
🔒 Safer compile invocation- - name: Compile ${{ matrix.yaml }}
- run: esphome compile ${{ matrix.yaml }}
+ - name: Compile ${{ matrix.yaml }}
+ run: |
+ set -euo pipefail
+ esphome compile -- "${{ matrix.yaml }}"🤖 Prompt for AI Agents |
||
|
|
||
| ct002-esphome-compile: | ||
| needs: [ ct002-esphome-yaml ] | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| yaml: ${{ fromJSON(needs.ct002-esphome-yaml.outputs.matrix) }} | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.13" | ||
|
|
||
| - name: Install ESPHome | ||
| run: pip install esphome | ||
|
|
||
| - name: Compile ${{ matrix.yaml }} | ||
| run: esphome compile ${{ matrix.yaml }} | ||
|
|
||
| ct002-host-e2e: | ||
| needs: [ lint ] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v5 | ||
| with: | ||
| enable-cache: true | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.13" | ||
|
|
||
| - name: Install dependencies (astrameter + esphome) | ||
| run: | | ||
| uv sync --frozen --extra dev | ||
| uv tool install esphome | ||
|
|
||
| # Build both host binaries in their own steps so a compile failure | ||
| # shows up here (with full gcc output) rather than as an opaque pytest | ||
| # timeout inside the module fixtures. The fixtures find the binaries | ||
| # already built and skip recompiling. | ||
| - name: Build ct002 host binary | ||
| run: esphome compile tests/components/ct002/test.host.yaml | ||
|
|
||
| - name: Build ct002 test-hooks (e2e control) binary | ||
| run: esphome compile tests/components/ct002/test.e2e.host.yaml | ||
|
|
||
| # All cross-backend suites are tagged `@pytest.mark.esphome_e2e` | ||
| # (see pyproject.toml). Selecting by marker means new suites are | ||
| # picked up automatically without editing this workflow. Their | ||
| # `python` params also run in the `validate` job; the `esphome` | ||
| # params only run where the esphome CLI + test-hooks binary exist. | ||
| - name: Run host-platform E2E (cross-backend esphome suites) | ||
| run: uv run pytest -m esphome_e2e -v | ||
|
|
||
| validate: | ||
| needs: [ lint ] | ||
| runs-on: ubuntu-latest | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: tomquist/AstraMeter
Length of output: 1416
🏁 Script executed:
Repository: tomquist/AstraMeter
Length of output: 2347
🏁 Script executed:
Repository: tomquist/AstraMeter
Length of output: 2101
🏁 Script executed:
Repository: tomquist/AstraMeter
Length of output: 10937
🌐 Web query:
actions/checkout v4 persist-credentials default value💡 Result:
The default value for the persist-credentials input in actions/checkout@v4 is true [1][2]. When set to true (the default), the action automatically configures the local git repository with the authentication token or SSH key used to perform the checkout [1][2]. This allows subsequent steps in the workflow to execute authenticated git commands directly [1][2]. For security-sensitive environments, it is often recommended to set persist-credentials: false to prevent the credentials from being stored in the local git configuration, which could otherwise be accessible to other steps or accidentally included in artifacts [3][4]. Example usage to disable this behavior: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
persist-credentialsor change the default tofalseactions/checkout#485🏁 Script executed:
Repository: tomquist/AstraMeter
Length of output: 1416
🏁 Script executed:
Repository: tomquist/AstraMeter
Length of output: 1416
🏁 Script executed:
Repository: tomquist/AstraMeter
Length of output: 2056
Pin third-party actions to commit SHAs and disable checkout credential persistence in CI.
.github/workflows/ci.ymluses tag-only action refs (actions/checkout@v4,astral-sh/setup-uv@v5,actions/setup-python@v5,actions/upload-artifact@v4) and everyactions/checkout@v4step omitswith: persist-credentials: false(default istrue, so the checkout token is persisted in the runner git config). Also hardenct002-esphome-compile:run: esphome compile ${{ matrix.yaml }}should quote the value.🔧 Suggested hardening pattern
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 50-51: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 51-51: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 54-54: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 59-59: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 54-54: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): this step
(cache-poisoning)
🤖 Prompt for AI Agents