Merge branch 'master' into test_ci

Author: lucasssvaz

.github/workflows/build_py_tools.yml

@@ -1,82 +1,70 @@
-name: Build Python Tools
+name: Build Tools
 
 on:
-  pull_request:
-    paths:
-    - 'tools/get.py'
-    - 'tools/espota.py'
-    - 'tools/gen_esp32part.py'
-    - 'tools/gen_insights_package.py'
+  workflow_call:
+    inputs:
+      os:
+        type: string
+        description: 'Operating system to build tools for'
+        required: true
+      container:
+        type: string
+        description: 'Container to use for building'
+        required: false
+      target:
+        type: string
+        description: 'Target to build tools for'
+        required: true
+      exten:
+        type: string
+        description: 'Extension of the binary'
+        required: false
+      separator:
+        type: string
+        description: 'Separator for the binary'
+        required: true
+      changed_files:
+        type: string
+        description: 'Changed files'
+        required: true
+    secrets:
+      APP_ID:
+        description: 'Push tools App ID'
+        required: true
+      APP_TOKEN:
+        description: 'Push tools App Token'
+        required: true
+      CERTIFICATE:
+        description: 'Certificate for signing'
+        required: true
+      CERTIFICATE_PASSWORD:
+        description: 'Certificate password'
+        required: false
 
-jobs:
-  find-changed-tools:
-    name: Check if tools have been changed
-    runs-on: ubuntu-20.04
-    outputs:
-      any_changed: ${{ steps.verify-changed-files.outputs.any_changed }}
-      all_changed_files: ${{ steps.verify-changed-files.outputs.all_changed_files }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-          ref: ${{ github.event.pull_request.head.ref }}
-      - name: Verify Python Tools Changed
-        uses: tj-actions/changed-files@v41
-        id: verify-changed-files
-        with:
-          fetch_depth: '2'
-          since_last_remote_commit: 'true'
-          files: |
-            tools/get.py
-            tools/espota.py
-            tools/gen_esp32part.py
-            tools/gen_insights_package.py
-      - name: List all changed files
-        shell: bash
-        run: |
-          for file in ${{ steps.verify-changed-files.outputs.all_changed_files }}; do
-            echo "$file was changed"
-          done
+concurrency:
+  group: pytools-${{ github.event.pull_request.number || github.ref }}-${{ inputs.os }}
+  cancel-in-progress: true
 
+jobs:
   build-pytools-binaries:
-    name: Build python tools binaries for ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    needs: find-changed-tools
-    if: needs.find-changed-tools.outputs.any_changed == 'true'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [windows-latest, macos-latest, ubuntu-20.04, ARM, ARM64]
-        include:
-        - os: windows-latest
-          TARGET: win64
-          EXTEN: .exe
-          SEPARATOR: ';'
-        - os: macos-latest
-          TARGET: macos
-          SEPARATOR: ':'
-        - os: ubuntu-20.04
-          TARGET: linux-amd64
-          SEPARATOR: ':'
-        - os: ARM
-          CONTAINER: python:3.8-bullseye
-          TARGET: arm
-          SEPARATOR: ':'
-        - os: ARM64
-          CONTAINER: python:3.8-bullseye
-          TARGET: arm64
-          SEPARATOR: ':'
-    container: ${{ matrix.CONTAINER }} # use python container on ARM
+    name: Build python tools binaries for ${{ inputs.os }}
+    runs-on: ${{ inputs.os }}
+    container: ${{ inputs.container }} # use python container on ARM
     env:
-      DISTPATH: pytools-${{ matrix.TARGET }}
+      DISTPATH: pytools-${{ inputs.target }}
       PIP_EXTRA_INDEX_URL: "https://dl.espressif.com/pypi"
     steps:
+      - id: create_token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: "${{ secrets.TOOLS_UPLOAD_APP_ID }}"
+          private_key: "${{ secrets.TOOLS_UPLOAD_APP_TOKEN }}"
+
       - name: List changed tools
         shell: bash
         run: |
           CHANGED_FILES=()
-          for file in ${{ needs.find-changed-tools.outputs.all_changed_files }}; do
+          for file in ${{ inputs.changed_files }}; do
               file="${file#*\/}"
               file="${file%\.*}"
               CHANGED_FILES+=("$file")
@@ -89,12 +77,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.TOOLS_UPLOAD_PAT }}
-          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ steps.create_token.outputs.token }}
       - name: Set up Python 3.8
         # Skip setting python on ARM because of missing compatibility: https://github.com/actions/setup-python/issues/108
-        if: matrix.os != 'ARM' && matrix.os != 'ARM64'
-        uses: actions/setup-python@master
+        if: inputs.os != 'ARM' && inputs.os != 'ARM64'
+        uses: actions/setup-python@v5
         with:
           python-version: 3.8
       - name: Install dependencies
@@ -108,7 +95,7 @@ jobs:
             pyinstaller --distpath ./${{ env.DISTPATH }} -F --icon=.github/pytools/espressif.ico tools/$tool.py
           done
       - name: Sign binaries
-        if: matrix.os == 'windows-latest' && env.CERTIFICATE != '' && env.CERTIFICATE_PASSWORD != ''
+        if: inputs.os == 'windows-latest' && env.CERTIFICATE != ''
         env:
           CERTIFICATE: ${{ secrets.CERTIFICATE }}
           CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
@@ -123,10 +110,10 @@ jobs:
         shell: bash
         run: |
           for tool in ${{ env.CHANGED_TOOLS }}; do
-            ./${{ env.DISTPATH }}/$tool${{ matrix.EXTEN }} -h
+            ./${{ env.DISTPATH }}/$tool${{ inputs.EXTEN }} -h
           done
       - name: Push binary to tools
-        if: matrix.os == 'windows-latest'
+        if: inputs.os == 'windows-latest'
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
         shell: bash

.github/workflows/pytools.yml

@@ -0,0 +1,85 @@
+name: Python Tools
+
+on:
+  pull_request_target:
+    paths:
+    - 'tools/get.py'
+    - 'tools/espota.py'
+    - 'tools/gen_esp32part.py'
+    - 'tools/gen_insights_package.py'
+
+permissions: { contents: read }
+
+jobs:
+  find-changed-tools:
+    name: Check if tools have been changed
+    runs-on: ubuntu-20.04
+    outputs:
+      any_changed: ${{ steps.verify-changed-files.outputs.any_changed }}
+      all_changed_files: ${{ steps.verify-changed-files.outputs.all_changed_files }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+      - name: Verify Python Tools Changed
+        uses: tj-actions/changed-files@v42
+        id: verify-changed-files
+        with:
+          since_last_remote_commit: 'true'
+          files: |
+            tools/get.py
+            tools/espota.py
+            tools/gen_esp32part.py
+            tools/gen_insights_package.py
+      - name: List all changed files
+        shell: bash
+        run: |
+          for file in ${{ steps.verify-changed-files.outputs.all_changed_files }}; do
+            echo "$file was changed"
+          done
+
+  call-build:
+    name: Build
+    uses: ./.github/workflows/build_py_tools.yml
+    needs: find-changed-tools
+    if: needs.find-changed-tools.outputs.any_changed == 'true'
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest, ubuntu-20.04, ARM, ARM64]
+        include:
+        - os: windows-latest
+          TARGET: win64
+          EXTEN: .exe
+          SEPARATOR: ';'
+        - os: macos-latest
+          TARGET: macos
+          SEPARATOR: ':'
+        - os: ubuntu-20.04
+          TARGET: linux-amd64
+          SEPARATOR: ':'
+        - os: ARM
+          CONTAINER: python:3.8-bullseye
+          TARGET: arm
+          SEPARATOR: ':'
+        - os: ARM64
+          CONTAINER: python:3.8-bullseye
+          TARGET: arm64
+          SEPARATOR: ':'
+    secrets:
+      TOOLS_UPLOAD_APP_ID: ${{ secrets.TOOLS_UPLOAD_APP_ID }}
+      TOOLS_UPLOAD_APP_TOKEN: ${{ secrets.TOOLS_UPLOAD_APP_TOKEN }}
+      CERTIFICATE: ${{ secrets.CERTIFICATE }}
+      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
+    with:
+      os: ${{ matrix.os }}
+      container: ${{ matrix.CONTAINER }}
+      target: ${{ matrix.TARGET }}
+      exten: ${{ matrix.EXTEN }}
+      separator: ${{ matrix.SEPARATOR }}
+      changed_files: ${{ needs.find-changed-tools.outputs.all_changed_files }}
+