Merge pull request #4 from imjasonh/bump-deps-and-ci

Add CI workflow, bump GHA actions, commit Cargo.lock

.github/workflows/ci.yml

@@ -0,0 +1,87 @@
+name: CI
+
+# Build verification on PRs (and pushes to main, redundantly with the
+# publish workflow but harmless and gives faster feedback).
+#
+# No publishing or signing — that's publish.yml's job. This workflow
+# just confirms the code compiles for both targets (esp32 firmware
+# and the host-side publisher tool).
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# Per-PR concurrency: a new push to a branch cancels the in-flight CI
+# for older commits on the same branch. Doesn't affect other PRs.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  firmware:
+    name: build firmware
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install cmake + ninja
+        run: sudo apt-get update && sudo apt-get install -y cmake ninja-build
+
+      - name: Setup uv (for python-shim)
+        uses: astral-sh/setup-uv@v7
+
+      - name: Setup Xtensa toolchain (espup)
+        uses: esp-rs/xtensa-toolchain@v1.7
+        with:
+          default: true
+          buildtargets: esp32
+          ldproxy: true
+
+      # Intentionally not caching .embuild here. Sharing the cache
+      # with publish.yml led to "too many levels of symbolic links"
+      # in the IDF venv (absolute symlinks baked in by one runner
+      # don't resolve cleanly on another). CI gets a slower cold
+      # build each time; the trade-off is reproducibility.
+
+      - name: Cache cargo build
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: ci-firmware
+
+      - name: Write placeholder wifi.env
+        # The firmware embeds WIFI_SSID/WIFI_PASS at compile time via
+        # env!() but doesn't validate them. CI just needs the build to
+        # succeed; runtime Wi-Fi connect with these placeholders would
+        # fail, but that's not what CI is testing.
+        run: |
+          {
+            echo 'export WIFI_SSID="ci-placeholder"'
+            echo 'export WIFI_PASS="ci-placeholder"'
+          } > wifi.env
+
+      - name: Build firmware
+        run: make build
+
+  publisher:
+    name: build publisher
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: tools/publisher
+          shared-key: ci-publisher
+
+      - name: Build publisher
+        # Explicit --target overrides the parent .cargo/config.toml's
+        # `target = "xtensa-esp32-espidf"`. Hardcoded triple is fine
+        # because we control the runner (ubuntu-latest = x86_64-linux).
+        run: cd tools/publisher && cargo build --release --target x86_64-unknown-linux-gnu

.github/workflows/publish.yml

@@ -30,16 +30,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install cmake + ninja
         run: sudo apt-get update && sudo apt-get install -y cmake ninja-build
 
       - name: Setup uv (for python-shim)
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
 
       - name: Setup Xtensa toolchain (espup)
-        uses: esp-rs/xtensa-toolchain@v1.5
+        uses: esp-rs/xtensa-toolchain@v1.7
         with:
           default: true
           buildtargets: esp32
@@ -49,10 +49,10 @@ jobs:
         run: cargo install espflash --locked
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
 
       - name: Cache .embuild (ESP-IDF + tools)
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: .embuild
           key: embuild-v5.2.2-${{ runner.os }}-${{ hashFiles('Cargo.toml', 'rust-toolchain.toml', '.cargo/config.toml') }}

.gitignore

@@ -1,7 +1,10 @@
 /target
 /.embuild
-Cargo.lock
 wifi.env
 gh.env
 sdkconfig.defaults
 tools/publisher/target
+
+# Cargo.lock IS tracked: both crates here are binaries (firmware and
+# publisher), and binary Cargo.lock files should be committed for
+# reproducible builds.

tools/publisher/rust-toolchain.toml

@@ -0,0 +1,5 @@
+# The publisher is a host-side binary; the parent rust-toolchain.toml
+# pins `esp` for the firmware build, which isn't installed on host-only
+# CI jobs. Override here so cargo uses stable.
+[toolchain]
+channel = "stable"