Main

.github/actions/ui-comment/action.yml

@@ -4,7 +4,7 @@ runs:
   using: composite
   steps:
     - name: Find Comment
-      uses: peter-evans/find-comment@v2
+      uses: peter-evans/find-comment@v3
       id: fc
       if: github.event_name == 'pull_request'
       with:
@@ -13,7 +13,7 @@ runs:
         body-includes: ui-comment-${{ github.workflow }}
 
     - name: Create or update comment
-      uses: peter-evans/create-or-update-comment@v3
+      uses: peter-evans/create-or-update-comment@v4
       if: github.event_name == 'pull_request'
       with:
         comment-id: ${{ steps.fc.outputs.comment-id }}

.github/actions/ui-report/action.yml

@@ -38,12 +38,12 @@ runs:
       shell: sh
     - name: Upload report
       run: |
-        aws s3 sync ${{ github.run_id }} s3://data.trezor.io/dev/firmware/ui_report/${{ github.run_id }}
+        aws s3 sync --no-progress ${{ github.run_id }} s3://data.trezor.io/dev/firmware/ui_report/${{ github.run_id }}
         echo "[UI test report](https://data.trezor.io/dev/firmware/ui_report/${{ github.run_id }}/${{ inputs.model }}-${{ inputs.lang }}-${{ github.job }}/index.html)" >> $GITHUB_STEP_SUMMARY
       shell: sh
     - name: Upload test screen recording
       run: |
-        aws s3 sync ci/ui_test_records s3://data.trezor.io/dev/firmware/ui_tests
+        aws s3 sync --no-progress ci/ui_test_records s3://data.trezor.io/dev/firmware/ui_tests
         # TODO: generate directory listing / autoindex
       shell: sh
     - uses: actions/upload-artifact@v4

.github/workflows/bot-common-sync.yml

@@ -0,0 +1,43 @@
+name: "[Bot] sync to trezor-common repository"
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sync-common:
+    runs-on: ubuntu-latest
+    env:
+      BOT_TOKEN: ${{ secrets.BOT_TOKEN_COMMON_FINE }}
+      BOT_USERNAME: ${{ secrets.TREZOR_BOT_USERNAME }}
+      BOT_EMAIL: ${{ secrets.TREZOR_BOT_EMAIL }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Copy git-filter and script to temporary directory
+        run: |
+          cp ./ci/common_sync/common_repo_sync.sh ${{runner.temp}}/common_repo_sync.sh
+          cp ./ci/common_sync/git-filter-repo ${{runner.temp}}/git-filter-repo
+
+      - name: Confiugre git user
+        run: |
+          git config --global user.name "${BOT_USERNAME}"
+          git config --global user.email "${BOT_EMAIL}"
+
+      - name: Add git-filter-repo to PATH
+        run: |
+          echo "Adding git-filter-repo to PATH"
+          echo '${{runner.temp}}' >> $GITHUB_PATH
+
+      - name: Sync trezor-common repository
+        run: |
+          echo "Synchronizing common with the trezor-common repository"
+          git config --unset-all http.https://github.com/.extraheader
+          ${{ runner.temp }}/common_repo_sync.sh

.github/workflows/common.yml

@@ -1,6 +1,10 @@
 name: Common
 
-on: [pull_request]
+on:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '14 23 * * *'  # every day @ 23:14
 
 jobs:
   crypto_build:

.github/workflows/legacy.yml

@@ -74,6 +74,34 @@ jobs:
             legacy/firmware/trezor-emu-legacy*
           retention-days: 7
 
+  legacy_emu_arm:
+    if: github.event_name == 'schedule'
+    name: Emulator arm
+    runs-on: ubuntu-latest-arm64
+    strategy:
+      matrix:
+        coins: [universal]
+        type: [debuglink]
+        asan: ${{ fromJSON(github.event_name == 'schedule' && '["noasan", "asan"]' || '["noasan"]') }}
+    env:
+      EMULATOR: 1
+      BITCOIN_ONLY: ${{ matrix.coins == 'universal' && '0' || '1' }}
+      DEBUG_LINK: ${{ matrix.type == 'debuglink' && '1' || '0' }}
+      ADDRESS_SANITIZER: ${{ matrix.asan == 'asan' && '1' || '0' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - uses: ./.github/actions/environment
+      - run: nix-shell --run "poetry run legacy/script/cibuild"
+      - run: mv legacy/firmware/trezor.elf legacy/firmware/trezor-emu-arm-legacy-T1B1-${{ matrix.coins }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: legacy-emu-arm-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
+          path: |
+            legacy/firmware/trezor-emu-arm-legacy*
+          retention-days: 7
+
   legacy_device_test:
     name: Device test
     runs-on: ubuntu-latest
@@ -183,7 +211,7 @@ jobs:
           fi
       - name: Upload main branch diff
         run: |
-          aws s3 sync master_diff s3://data.trezor.io/dev/firmware/master_diff/${{ github.run_id }}
+          aws s3 sync --no-progress master_diff s3://data.trezor.io/dev/firmware/master_diff/${{ github.run_id }}
         continue-on-error: true
 
   legacy_ui_comment:
@@ -199,13 +227,16 @@ jobs:
           git diff --quiet origin/main...HEAD -- tests/ui_tests/fixtures.json || echo "FIXTURES_CHANGED=$?" >> $GITHUB_OUTPUT
         id: check-fixtures-changed
       - uses: ./.github/actions/ui-comment
+        # TODO: always run if comment already exists
         if: ${{ steps.check-fixtures-changed.outputs.FIXTURES_CHANGED == '1' }}
 
-  core_upload_emu:
+  legacy_upload_emu:
     name: Upload emulator binaries
     if: github.event_name == 'schedule'
     runs-on: ubuntu-latest
-    needs: legacy_emu
+    needs:
+      - legacy_emu
+      - legacy_emu_arm
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -219,5 +250,5 @@ jobs:
         continue-on-error: true
       - run: |
           mkdir emulators
-          cp trezor-emu-legacy* emulators
-          aws s3 sync emulators s3://data.trezor.io/dev/firmware/emu-nightly
+          cp trezor-emu-* emulators
+          aws s3 sync --no-progress emulators s3://data.trezor.io/dev/firmware/emu-nightly

.github/workflows/prebuild.yml

@@ -1,10 +1,15 @@
 name: "Prebuild checks"
 
-on: [pull_request]
+on:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '13 23 * * *'  # every day @ 23:13
 
 jobs:
   block-fixup:
     name: Block fixup
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -54,7 +59,7 @@ jobs:
   # or contain `[no changelog]` in the commit message.
   changelog_check:
     name: Changelog check
-    if: ${{ github.ref != 'main' }}
+    if: ${{ github.ref != 'main' && github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.pylintrc

@@ -35,3 +35,4 @@ enable=
     useless-else-on-loop,
     useless-object-inheritance,
     async-awaitable-return,
+    internal-model-tuple-comparison,

Makefile

@@ -143,11 +143,17 @@ docs_summary_check: ## check if there are unlinked documentation files
 	python3 tools/check_docs_summary.py
 
 vendorheader: ## generate vendor header
-	./core/embed/vendorheader/generate.sh --quiet
+	./core/tools/generate_vendorheader.sh --quiet
 
 vendorheader_check: ## check that vendor header is up to date
-	./core/embed/vendorheader/generate.sh --quiet --check
+	./core/tools/generate_vendorheader.sh --quiet --check
 
-gen:  templates mocks icons protobuf ci_docs vendorheader solana_templates ## regenerate auto-generated files from sources
+bootloader_hashes: ## generate bootloader hashes
+	./core/tools/bootloader_hashes.py
 
-gen_check: templates_check mocks_check icons_check protobuf_check ci_docs_check vendorheader_check solana_templates_check ## check validity of auto-generated files
+bootloader_hashes_check: ## check generated bootloader hashes
+	./core/tools/bootloader_hashes.py --check
+
+gen:  templates mocks icons protobuf ci_docs vendorheader solana_templates bootloader_hashes ## regenerate auto-generated files from sources
+
+gen_check: templates_check mocks_check icons_check protobuf_check ci_docs_check vendorheader_check solana_templates_check bootloader_hashes_check ## check validity of auto-generated files

build-docker.sh

@@ -69,7 +69,7 @@ OPT_BUILD_LEGACY=1
 OPT_BUILD_NORMAL=1
 OPT_BUILD_BITCOINONLY=1
 INIT=1
-MODELS=(R T)
+MODELS=(R T T3T1)
 CORE_TARGETS=(boardloader bootloader firmware)
 
 REPOSITORY="/local"

ci/build.yml

@@ -197,6 +197,8 @@ core unix regular build:
   stage: build
   <<: *gitlab_caching
   needs: []
+  variables:
+    THP: "1"
   script:
     - $NIX_SHELL --run "poetry run make -C core build_unix"
   artifacts:

ci/common_sync/common_repo_sync.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 
-GH_USER="$GH_TREZOR_BOT"
-GH_TOKEN="$GH_TOKEN_COMMON_SYNC"
+COMMON_REPO_TOKEN="$BOT_TOKEN"
+COMMON_REPO_USER="$BOT_USERNAME"
 
 # checkout to temporary branch
 git checkout -B tmp
 
 # setup trezor-common remote
-git remote add sync-common https://$GH_USER:$GH_TOKEN@github.com/trezor/trezor-common.git 2>/dev/null
+git remote add sync-common https://$COMMON_REPO_USER:$COMMON_REPO_TOKEN@github.com/trezor/trezor-common.git 2>/dev/null
 
 # top commit in HEAD before monorepo was introduced
 TOP_COMMIT_IN_COMMON=893fd219d4a01bcffa0cd9cfa631856371ec5aa9

ci/deploy.yml

@@ -324,20 +324,3 @@ sync emulators to aws:
     - branches  # run for tags only
   tags:
     - deploy
-
-# common sync to trezor-common
-
-common sync:
-  stage: deploy
-  variables:
-    GIT_SUBMODULE_STRATEGY: "none"
-    GIT_STRATEGY: clone  # clone entire repo instead of reusing workspace
-    GIT_DEPTH: 0  # avoid shallow clone
-  only:
-    - schedules
-  interruptible: false
-  needs: []
-  before_script: []  # no poetry
-  script:
-    - echo "Synchronizing common with the trezor-common repository"
-    - ./ci/common_sync/common_repo_sync.sh

ci/pyright/node-composition.nix

@@ -1,12 +1,12 @@
-# This file has been generated by node2nix 1.9.0. Do not edit!
+# This file has been generated by node2nix 1.11.1. Do not edit!
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_14"}:
 
 let
   nodeEnv = import ./node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
   };