-
Notifications
You must be signed in to change notification settings - Fork 18
Regain control over the SDK libraries #1036
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from 8 commits
e29eccd
216cd65
fb81559
4845f9e
09860e1
cf81182
a5dd399
94b820b
0dd9032
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,92 @@ | ||||||||||||||||||||
name: Build clang runtime builtins | ||||||||||||||||||||
|
||||||||||||||||||||
on: | ||||||||||||||||||||
workflow_dispatch: | ||||||||||||||||||||
inputs: | ||||||||||||||||||||
target_sdk_branch: | ||||||||||||||||||||
type: string | ||||||||||||||||||||
required: false | ||||||||||||||||||||
default: 'master' | ||||||||||||||||||||
create_pr: | ||||||||||||||||||||
type: boolean | ||||||||||||||||||||
required: false | ||||||||||||||||||||
default: false | ||||||||||||||||||||
|
||||||||||||||||||||
# TODO: remove this next line before merging! | ||||||||||||||||||||
push: | ||||||||||||||||||||
|
||||||||||||||||||||
env: | ||||||||||||||||||||
GIT_USER_EMAIL: 'ledger@github.com' | ||||||||||||||||||||
GIT_USER_NAME: 'SDKLibsUpdaterGithub' | ||||||||||||||||||||
UPDATE_BRANCH: 'sdk_libs_update' | ||||||||||||||||||||
|
||||||||||||||||||||
jobs: | ||||||||||||||||||||
build: | ||||||||||||||||||||
runs-on: ubuntu-latest | ||||||||||||||||||||
container: | ||||||||||||||||||||
image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder-lite:latest | ||||||||||||||||||||
strategy: | ||||||||||||||||||||
fail-fast: false | ||||||||||||||||||||
matrix: | ||||||||||||||||||||
target: | ||||||||||||||||||||
- core: cortex-m3 | ||||||||||||||||||||
se: st33 | ||||||||||||||||||||
- core: cortex-m35p+nodsp | ||||||||||||||||||||
se: st33k1 | ||||||||||||||||||||
|
||||||||||||||||||||
steps: | ||||||||||||||||||||
- uses: actions/checkout@v4 | ||||||||||||||||||||
with: | ||||||||||||||||||||
# TODO: remove this next line before merging! | ||||||||||||||||||||
ref: feat/regain_control_over_libs | ||||||||||||||||||||
sparse-checkout: | | ||||||||||||||||||||
tools/build_clangrt_builtins.sh | ||||||||||||||||||||
sparse-checkout-cone-mode: false | ||||||||||||||||||||
|
||||||||||||||||||||
- run: ./tools/build_clangrt_builtins.sh -t ${{ matrix.target.core }} -o artifact/arch/${{ matrix.target.se }}/lib | ||||||||||||||||||||
|
||||||||||||||||||||
- uses: actions/upload-artifact@v4 | ||||||||||||||||||||
with: | ||||||||||||||||||||
name: arch-${{ matrix.target.se }} | ||||||||||||||||||||
path: artifact/ | ||||||||||||||||||||
|
||||||||||||||||||||
merge: | ||||||||||||||||||||
needs: build | ||||||||||||||||||||
runs-on: ubuntu-latest | ||||||||||||||||||||
steps: | ||||||||||||||||||||
- uses: actions/upload-artifact/merge@v4 | ||||||||||||||||||||
with: | ||||||||||||||||||||
name: arch | ||||||||||||||||||||
pattern: arch-* | ||||||||||||||||||||
delete-merged: true | ||||||||||||||||||||
|
||||||||||||||||||||
pr_create: | ||||||||||||||||||||
Comment on lines
+54
to
+63
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
Copilot AutofixAI 17 days ago To fix the issue, we will add a
We will add the
Suggested changeset
1
.github/workflows/build_clangrt_builtins.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Positive FeedbackNegative Feedback
Refresh and try again.
|
||||||||||||||||||||
needs: merge | ||||||||||||||||||||
runs-on: ubuntu-latest | ||||||||||||||||||||
if: ${{ success() && inputs.create_pr }} | ||||||||||||||||||||
continue-on-error: true | ||||||||||||||||||||
steps: | ||||||||||||||||||||
- name: Clone repository | ||||||||||||||||||||
uses: actions/checkout@v4 | ||||||||||||||||||||
with: | ||||||||||||||||||||
# by default the action uses fetch-depth = 1, which creates | ||||||||||||||||||||
# shallow repositories from which we can't push | ||||||||||||||||||||
fetch-depth: 0 | ||||||||||||||||||||
ref: ${{ inputs.target_sdk_branch }} | ||||||||||||||||||||
|
||||||||||||||||||||
- name: Download Binaries artifact | ||||||||||||||||||||
uses: actions/download-artifact@v4 | ||||||||||||||||||||
with: | ||||||||||||||||||||
name: arch | ||||||||||||||||||||
|
||||||||||||||||||||
- name: PR creation | ||||||||||||||||||||
env: | ||||||||||||||||||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||||||||||||||||||||
run: | | ||||||||||||||||||||
git config --global user.email ${{ env.GIT_USER_EMAIL }} | ||||||||||||||||||||
git config --global user.name ${{ env.GIT_USER_NAME }} | ||||||||||||||||||||
git switch --create ${{ env.UPDATE_BRANCH }} | ||||||||||||||||||||
git add -A . | ||||||||||||||||||||
git commit -m 'Updating static SDK libraries' | ||||||||||||||||||||
git push -u origin ${{ env.UPDATE_BRANCH }} | ||||||||||||||||||||
gh pr create -B ${{ inputs.target_sdk_branch }} --title '[SDK_LIBS_UPDATE] Updating static SDK libraries' --body 'Created by Github workflow "${{ github.workflow }}", job "${{ github.job }}", run "${{ github.run_id }}".' | ||||||||||||||||||||
Comment on lines
+64
to
+92
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Copilot AutofixAI 17 days ago To fix the issue, we will add a The
Suggested changeset
1
.github/workflows/build_clangrt_builtins.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Positive FeedbackNegative Feedback
Refresh and try again.
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,95 @@ | ||
#!/usr/bin/env bash | ||
|
||
set -e | ||
|
||
TARGET_CPU="" | ||
OUTPUT_DIR="" | ||
|
||
while getopts "t:o:" opt | ||
do | ||
case "$opt" in | ||
t) | ||
TARGET_CPU="$OPTARG" | ||
;; | ||
o) | ||
OUTPUT_DIR="$OPTARG" | ||
;; | ||
?) | ||
exit 1 | ||
;; | ||
esac | ||
done | ||
shift "$((OPTIND - 1))" | ||
|
||
if [ -z "$TARGET_CPU" ] || [ -z "$OUTPUT_DIR" ] | ||
then | ||
echo "Usage: $0 -t TARGET_CPU -o OUTPUT_FILE" >&2 | ||
exit 1 | ||
fi | ||
|
||
mkdir -p "$OUTPUT_DIR" | ||
OUTPUT_DIR=$(realpath "$OUTPUT_DIR") | ||
|
||
# enable source repository | ||
sed -i 's/^\(Types: deb\)$/\1 deb-src/g' /etc/apt/sources.list.d/debian.sources | ||
|
||
apt update | ||
|
||
apt install -y --no-install-recommends \ | ||
dpkg-dev \ | ||
llvm-dev | ||
|
||
LLVM_VERSION=$(clang --version | head -n1 | rev | cut -d" " -f1 | rev) | ||
LLVM_MAJOR_VERSION=$(echo "$LLVM_VERSION" | cut -d. -f1) | ||
|
||
cd /tmp | ||
|
||
LLVM_DIR="llvm-toolchain-$LLVM_MAJOR_VERSION-$LLVM_VERSION" | ||
if [ ! -d "$LLVM_DIR" ] | ||
then | ||
# install Debian source package | ||
apt source "llvm-toolchain-$LLVM_MAJOR_VERSION" | ||
fi | ||
|
||
cd "$LLVM_DIR" | ||
rm -rf build | ||
mkdir build | ||
cd build | ||
|
||
TARGET=arm-none-eabi | ||
SYSROOT=/usr/lib/arm-none-eabi | ||
|
||
cmake ../compiler-rt \ | ||
-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY \ | ||
-DCOMPILER_RT_OS_DIR="baremetal" \ | ||
-DCOMPILER_RT_BUILD_BUILTINS=ON \ | ||
-DCOMPILER_RT_BUILD_CRT=OFF \ | ||
-DCOMPILER_RT_BUILD_SANITIZERS=OFF \ | ||
-DCOMPILER_RT_BUILD_XRAY=OFF \ | ||
-DCOMPILER_RT_BUILD_LIBFUZZER=OFF \ | ||
-DCOMPILER_RT_BUILD_PROFILE=OFF \ | ||
-DCOMPILER_RT_BUILD_MEMPROF=OFF \ | ||
-DCOMPILER_RT_BUILD_ORC=OFF \ | ||
-DCMAKE_C_COMPILER="$(which clang)" \ | ||
-DCMAKE_C_COMPILER_TARGET="${TARGET}" \ | ||
-DCMAKE_ASM_COMPILER_TARGET="${TARGET}" \ | ||
-DCMAKE_AR="$(which llvm-ar)" \ | ||
-DCMAKE_NM="$(which llvm-nm)" \ | ||
-DCMAKE_RANLIB="$(which llvm-ranlib)" \ | ||
-DCOMPILER_RT_BAREMETAL_BUILD=ON \ | ||
-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON \ | ||
-DLLVM_CONFIG_PATH="$(which llvm-config)" \ | ||
-DCOMPILER_RT_HAS_FPIC_FLAG=OFF \ | ||
-DCMAKE_C_FLAGS="-mcpu=${TARGET_CPU} -mlittle-endian -mthumb -Oz -g0 -fropi -frwpi" \ | ||
-DCMAKE_ASM_FLAGS="-mcpu=${TARGET_CPU} -mlittle-endian -mthumb" \ | ||
-DCMAKE_SYSROOT="$SYSROOT" | ||
make -j | ||
|
||
# Removing duplicated symbols that are also present in picolibc | ||
ar d lib/baremetal/libclang_rt.builtins-arm.a aeabi_memset.S.o | ||
ar d lib/baremetal/libclang_rt.builtins-arm.a aeabi_memmove.S.o | ||
ar d lib/baremetal/libclang_rt.builtins-arm.a aeabi_memcpy.S.o | ||
|
||
# Output | ||
mkdir -p "$OUTPUT_DIR" | ||
cp lib/baremetal/libclang_rt.builtins-arm.a "$OUTPUT_DIR/libclang_rt.builtins.a" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 17 days ago
To fix the issue, we need to add a
permissions
block to the workflow. This block should specify the least privileges required for each job. For example:build
job only needscontents: read
to check out the repository.merge
job may needcontents: read
andactions: write
for artifact handling.pr_create
job requirescontents: read
andpull-requests: write
to create pull requests.The
permissions
block can be added at the root level of the workflow to apply to all jobs or individually for each job. In this case, we will add permissions for each job to ensure granular control.