DP7417 C++ Implementation of Secure MAVLink proxy on device-side

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/checks.yml

@@ -43,7 +43,7 @@ jobs:
       run: make ${{matrix.check}}
     - name: upload coverage
       if: contains(matrix.check, 'coverage')
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@v3
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: unittests

.github/workflows/compile_linux.yml

@@ -32,7 +32,7 @@ jobs:
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
         message("::set-output name=timestamp::${current_date}")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.ccache
         key: ${{matrix.config}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}

.github/workflows/compile_linux_arm64.yml

@@ -29,7 +29,7 @@ jobs:
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
         message("::set-output name=timestamp::${current_date}")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.ccache
         key: ${{matrix.config}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}

.github/workflows/compile_macos.yml

@@ -33,7 +33,7 @@ jobs:
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
         message("::set-output name=timestamp::${current_date}")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.ccache
         key: macos_${{matrix.config}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}

.github/workflows/compile_nuttx.yml

@@ -84,7 +84,7 @@ jobs:
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
         message("::set-output name=timestamp::${current_date}")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.ccache
         key: ${{matrix.config}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}
@@ -121,7 +121,7 @@ jobs:
       run: ccache -s
 
     - name: Upload px4 package
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: px4_package_${{matrix.config}}
         path: |

.github/workflows/ekf_update_change_indicator.yml

@@ -19,7 +19,7 @@ jobs:
       run: echo "CHANGE_INDICATED=$(git diff --exit-code --output=/dev/null || echo $?)" >> $GITHUB_ENV
       working-directory: src/modules/ekf2/test/change_indication
     - name: auto-commit any changes to change indication
-      uses: stefanzweifel/git-auto-commit-action@v4
+      uses: stefanzweifel/git-auto-commit-action@v5
       with:
         commit_message: '[AUTO COMMIT] update change indication'
         commit_user_name: ${GIT_COMMITTER_NAME}

.github/workflows/mavros_mission_tests.yml

@@ -39,7 +39,7 @@ jobs:
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
         message("::set-output name=timestamp::${current_date}")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.ccache
         key: sitl_tests-${{matrix.config.build_type}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}
@@ -86,7 +86,7 @@ jobs:
       run: gdb build/px4_sitl_default/bin/px4 px4.core -ex "thread apply all bt" -ex "quit"
     - name: Upload px4 coredump
       if: failure()
-      uses: actions/upload-artifact@v2-preview
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: coredump
         path: px4.core
@@ -101,21 +101,21 @@ jobs:
 
     - name: Upload px4 binary
       if: failure()
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: binary
         path: build/px4_sitl_default/bin/px4
 
     - name: Store PX4 log
       if: failure()
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: px4_log
         path: ~/.ros/log/*/*.ulg
 
     - name: Store ROS log
       if: failure()
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: ros_log
         path: ~/.ros/**/rostest-*.log
@@ -132,7 +132,7 @@ jobs:
           lcov --directory build/px4_sitl_default --base-directory build/px4_sitl_default --gcov-tool gcov --capture -o coverage/lcov.info
     - name: Upload coverage information to Codecov
       if: contains(matrix.config.build_type, 'Coverage')
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@v3
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: mavros_mission

.github/workflows/mavros_offboard_tests.yml

@@ -34,7 +34,7 @@ jobs:
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
         message("::set-output name=timestamp::${current_date}")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.ccache
         key: sitl_tests-${{matrix.config.build_type}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}
@@ -81,7 +81,7 @@ jobs:
       run: gdb build/px4_sitl_default/bin/px4 px4.core -ex "thread apply all bt" -ex "quit"
     - name: Upload px4 coredump
       if: failure()
-      uses: actions/upload-artifact@v2-preview
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: coredump
         path: px4.core
@@ -96,21 +96,21 @@ jobs:
 
     - name: Upload px4 binary
       if: failure()
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: binary
         path: build/px4_sitl_default/bin/px4
 
     - name: Store PX4 log
       if: failure()
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: px4_log
         path: ~/.ros/log/*/*.ulg
 
     - name: Store ROS log
       if: failure()
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: ros_log
         path: ~/.ros/**/rostest-*.log
@@ -127,7 +127,7 @@ jobs:
           lcov --directory build/px4_sitl_default --base-directory build/px4_sitl_default --gcov-tool gcov --capture -o coverage/lcov.info
     - name: Upload coverage information to Codecov
       if: contains(matrix.config.build_type, 'Coverage')
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@v3
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: mavros_offboard

.github/workflows/sitl_tests.yml

@@ -40,7 +40,7 @@ jobs:
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
         message("::set-output name=timestamp::${current_date}")
     - name: ccache cache files
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.ccache
         key: sitl_tests-${{matrix.config.build_type}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}
@@ -104,14 +104,14 @@ jobs:
       run: gdb build/px4_sitl_default/bin/px4 px4.core -ex "thread apply all bt" -ex "quit"
     - name: Upload px4 coredump
       if: failure()
-      uses: actions/upload-artifact@v2-preview
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: coredump
         path: px4.core
 
     - name: Upload px4 binary
       if: failure()
-      uses: actions/upload-artifact@v2-preview
+      uses: actions/upload-artifact@v3.1.3
       with:
         name: binary
         path: build/px4_sitl_default/bin/px4
@@ -128,7 +128,7 @@ jobs:
           lcov --directory build/px4_sitl_default --base-directory build/px4_sitl_default --gcov-tool gcov --capture -o coverage/lcov.info
     - name: Upload coverage information to Codecov
       if: contains(matrix.config.build_type, 'Coverage')
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@v3
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: mavsdk

.github/workflows/tiiuae-builder-images.yaml

@@ -0,0 +1,42 @@
+name: tiiuae-builder-images
+
+on:
+  # Run only manually
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  hw-builder-image:
+    name: create docker builder base image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout px4-firmware
+        uses: actions/checkout@v4
+        with:
+          path: px4-firmware
+          fetch-depth: 0
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/tiiuae/px4-firmware-builder-base
+          tags: |
+            type=raw,value=latest
+            type=sha
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build builder base image and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./px4-firmware/packaging/Dockerfile.build_env_pre
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/tiiuae-check-format.yml

@@ -0,0 +1,18 @@
+# Make check_format before PULLREQUEST.
+
+
+name: check_format
+
+on: [pull_request]
+
+jobs:
+  main:
+    name: Validate testfile
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Lint
+      run:  |
+            sudo apt update -y && sudo apt install -y --no-install-recommends make astyle
+            make check_format

.github/workflows/tiiuae-coverity-scan-image.yaml

@@ -0,0 +1,47 @@
+name: tiiuae-coverity-scan-image
+
+on:
+  # Run only manually
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  coverity-scan-image:
+    name: create coverity scan image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout px4-firmware
+        uses: actions/checkout@v3
+        with:
+          path: px4-firmware
+          fetch-depth: 0
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/tiiuae/px4-coverity-scan-image
+          tags: |
+            type=raw,value=latest
+            type=sha
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push coverity scan image
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./px4-firmware/packaging/Dockerfile.coverity
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            "COVERITY_DOCKER_REGISTRY_USERNAME=${{ secrets.COVERITY_DOCKER_REGISTRY_USERNAME }}"
+            "COVERITY_DOCKER_REGISTRY_ACCESS_TOKEN=${{ secrets.COVERITY_DOCKER_REGISTRY_ACCESS_TOKEN }}"
+            "COVERITY_LICENSE_DAT_B64=${{ secrets.COVERITY_LICENSE_DAT_B64 }}"
+            "COVERITY_ACCESS_TOKEN_B64=${{ secrets.COVERITY_ACCESS_TOKEN_B64 }}"

.github/workflows/tiiuae-coverity-scan.yaml

@@ -0,0 +1,36 @@
+name: tiiuae-px4-coverity-scan
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [ main ]
+jobs:
+  coverity:
+    runs-on: px4-self-hosted-coverity
+    steps:
+      - name: Checkout px4-firmware
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.GH_REPO_TOKEN }}
+          submodules: 'recursive'
+          fetch-depth: 0
+      - name: Fetch submodule tags
+        run: |
+          git submodule foreach --recursive git fetch --tags
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run coverity scan
+        run:
+          docker run --rm -v "$(pwd):/main_ws" ghcr.io/tiiuae/px4-coverity-scan-image:latest
+      - name: Update summary
+        run:
+          cat cov-analyze-result.txt >> $GITHUB_STEP_SUMMARY
+      - name: Upload coverity scan results
+        uses: actions/[email protected]
+        with:
+          name: coverity-html-report-${{ github.event.repository.name }}
+          path: coverity-output