Implementing stable package lock for CI builds by sabollim-silabs · Pull Request #1148 · SiliconLabsSoftware/matter_extension

sabollim-silabs · 2026-10-08T20:42:12Z

Issue Link:

Description of Problem/Feature:

Package CI currently resolves Conan/SLT dependencies from floating ranges. Newly published prereleases can change the resolve without any Matter code change, so PR validation is not reproducible and can fail or pass for reasons unrelated to the PR.

Description of Fix/Solution:
Introduce CI-only dependency locking under .github/pkg-manifest/:

Treat pkg.lock as the source of truth; derive conan.lock and conanfile.txt via slc/script/pkg_lock_to_conan_lock.py.
Add .github/actions/install-pkg-manifest so PR CI restores the Matter package cache, installs third-party deps from the Conan lock, installs the PR matter_app, and exports CI_PKG_LOCK.
Extend packages/build_app.sh with --pkg-lock / CI_PKG_LOCK and --check-updates so app builds pin third-party packages while using the PR Matter version.
Wire package builder workflows and matter-packages-validation for locked PR mode (use_lockfile=true) vs unlocked
nightly mode (use_lockfile=false).
On successful nightly (on release_2.10-1.6.1), refresh locks and open/update an automation PR with the new pin set.
Point Conan at the public prerelease remote; fix Series 3 bootloader path handling in build_app.sh;

Testing Done:
PR package validation with use_lockfile=true (locked install + app builds)
Nightly / unlocked path with use_lockfile=false completes and opens/updates the lock refresh PR when appropriate
Confirm .github/pkg-manifest/{pkg.lock,conan.lock,conanfile.txt} stay in sync after conversion
Series 3 bootloader / solution builds via packages/build_app.sh

github-actions · 2026-10-08T20:42:25Z

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. For privacy information, see our Privacy Notice. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: example@example.com

or

I have read the CLA Document and I hereby sign the CLA behalf of my company, e-mail: example@example.com

Signature is valid for 6 months.

_{This bot will be retriggered when the Contributor License Agreement comment has been provided.}_{Posted by the CLA Assistant Lite bot.}

sabollim-silabs · 2026-10-08T20:42:31Z

bugbot review

cursor · 2026-10-08T20:42:36Z

PR Summary

Medium Risk
Touches the full package CI dependency path and nightly auto-PR lock refresh; wrong lock or mode selection could break or silently shift builds across many platforms.

Overview
Adds CI-only dependency pinning so Matter package validation no longer floats Silabs Conan/SLT versions on every PR. Committed locks live under .github/pkg-manifest/ (pkg.lock as source of truth, plus derived conan.lock and conanfile.txt), with slc/script/pkg_lock_to_conan_lock.py to regenerate the Conan artifacts.

A new composite action .github/actions/install-pkg-manifest replaces the prior Matter-cache restore step: it can run conan install --lockfile, export CI_PKG_LOCK, install the PR matter_app, and toggle slt --check-updates via use-lockfile. packages/build_app.sh gains --check-updates, --pkg-lock / CI_PKG_LOCK, and logic to copy the CI lock into the app dir while rewriting matter / matter_app to the build version.

Package builder workflows and matter-packages-validation thread a use-lockfile input (default locked). resolve-deps-mode unlocks only on release_2.10-1.6.1 push or dispatch with use_lockfile=false; successful unlocked runs trigger update-ci-lockfile, which refreshes the manifest and opens a bot PR. The daily trigger always dispatches with use_lockfile=false and drops the prior 24-hour commit gate.

^{Reviewed by Cursor Bugbot for commit 59ff923. Configure here.}

cursor

Stale Bugbot comment from a previous run.

sabollim-silabs · 2026-10-19T07:39:49Z

I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: [sabollim@silabs.com]

sabollim-silabs · 2026-10-19T07:59:43Z

bugbot review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 59ff923. Configure here.}

Michael Duggan (miduggan24) · 2026-10-20T12:50:49Z

+
+### Important: two lock formats
+
+| | `pkg.lock` | `conan.lock` |


I understand the role of these two files, but can you clarify the need for conanfile.txt?

this provides the recipe for conan install

is that not what conan.lock does?

No recipe → Conan doesn’t know what install you are doing.
Recipe + no lock → Conan resolves versions (can float / change over time).
Recipe + lock → Conan installs that same graph, pinned exactly

Michael Duggan (miduggan24) · 2026-10-20T12:58:31Z

+If nightly fails, the previous committed locks are left unchanged, so PRs keep
+using the last green pin set.
+
+## Manual update (local)


is there a use case for manual updates at all? I would assume that if we want to update package versions, we should do so by running full CI and allowing automation to update only if CI passes with new packages to ensure dependency bumps don't break anything.

this is drafted for any corner case if needed. even if we do the changes manually, they can be only merged after running the CI. only the update part instead done by nightly can be done by maintaner.
like example Nightly is down due to some infra issue and we know the particular build is stable etc. just for a rare corner case

Michael Duggan (miduggan24) · 2026-10-20T13:06:45Z

+        if [[ "${{ inputs.use-lockfile }}" == "true" ]]; then
+          CHECK_UPDATES="false"
+        fi
+        slt install "matter_app/${{ inputs.package-version }}@silabs" -e conan \


for my understanding why do we conan install all other packages, and slt install only matter_app package? can we perhaps consolidate on slt install <package> -e conan for everything for consistency?

sure let me give it a try

Michael Duggan (miduggan24) · 2026-10-20T13:12:51Z

+          if [[ "$ref" == "release_2.10-1.6.1" && "$event" == "push" ]]; then
+            echo "use-lockfile=false" >> "$GITHUB_OUTPUT"
+          elif [[ "$ref" == "release_2.10-1.6.1" && "$event" == "workflow_dispatch" && "${{ inputs.use_lockfile }}" == "false" ]]; then
+            echo "use-lockfile=false" >> "$GITHUB_OUTPUT"


should we update packages for automation builds only? (ie schedule event). each push seems like overkill with nightly automation.

Michael Duggan (miduggan24) · 2026-10-20T13:17:29Z

-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ matrix.branch }}
-          fetch-depth: 0
-
-      - name: Check for recent changes
-        id: check_changes
-        env:
-          BRANCH: ${{ matrix.branch }}
-        run: |
-          commit_count=$(git rev-list --count --since="24 hours ago" HEAD 2>/dev/null || echo "0")
-
-          echo "Commits in last 24 hours: $commit_count"
-          echo "has_changes=$([ "$commit_count" -gt 0 ] && echo "true" || echo "false")" >> $GITHUB_OUTPUT
-
-          if [ "$commit_count" -gt 0 ]; then
-            echo "Found $commit_count commit(s) in the last 24 hours. Will trigger build."
-            echo "Recent commits:"
-            git log --since="24 hours ago" --oneline | head -10
-          else
-            echo "No commits found in the last 24 hours. Skipping build trigger."
-          fi
-


why are we removing this? we want to check for recent commits so we don't have unnecessary runs.

as in package world , changes are not only form our repo any package change can cause issue. so checking no new commit on our repo is no longer a valid criteria, as our dependencies an change and cuase us issues

Michael Duggan (miduggan24) · 2026-10-20T13:20:17Z

could use stacked PRs feature in github for this that way flow can be merge #1048, then this will rebase and can merge into release_2.10 as a follow up afterward. if this merges directly into Phase 2 PR would be large and difficult to review.

Co-authored-by: Michael Duggan <miduggan@silabs.com>

sabollim-silabs changed the base branch from feature/package_manager_implementation_phase_2 to main October 8, 2026 20:46

sabollim-silabs changed the base branch from main to release_2.10-1.6.1 October 8, 2026 20:47

cursor Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread .github/actions/install-pkg-manifest/action.yaml Outdated

Comment thread .github/workflows/matter-packages-validation.yaml Outdated

Comment thread .github/actions/install-pkg-manifest/action.yaml Outdated

sabollim-silabs force-pushed the feature/package_manager_implementation_phase_2_lock branch from 77610cb to ef237fe Compare October 9, 2026 12:02

sabollim-silabs changed the base branch from release_2.10-1.6.1 to feature/package_manager_implementation_phase_2 October 9, 2026 13:41

sabollim-silabs force-pushed the feature/package_manager_implementation_phase_2_lock branch 5 times, most recently from 87a34fb to 2e565aa Compare October 13, 2026 14:20

Arghya Dutta (silabs-ArghyaD) force-pushed the feature/package_manager_implementation_phase_2_lock branch from 2e565aa to 6c6e097 Compare October 14, 2026 11:09

sabollim-silabs and others added 4 commits October 14, 2026 23:02

change conan url to public

f89d731

Lock file implementation

787e7ae

Fix build issue for series 3 bootloader

fd2b47e

Create lock PR in nightly

59ff923

sabollim-silabs force-pushed the feature/package_manager_implementation_phase_2_lock branch from aeb1831 to 59ff923 Compare October 15, 2026 03:20

sabollim-silabs changed the title ~~[Test PR]~~ Implementing stable package lock for CI builds Oct 19, 2026

cursor Bot reviewed Oct 19, 2026

View reviewed changes

Michael Duggan (miduggan24) reviewed Oct 20, 2026

View reviewed changes

sabollim-silabs added this pull request to stack #1172 October 21, 2026 14:18

Apply batched suggestions from code review

22f5e1a

Co-authored-by: Michael Duggan <miduggan@silabs.com>


		### Important: two lock formats

		\| \| `pkg.lock` \| `conan.lock` \|

Conversation

sabollim-silabs commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sabollim-silabs commented Oct 8, 2026

Uh oh!

cursor Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sabollim-silabs commented Oct 19, 2026

Uh oh!

sabollim-silabs commented Oct 19, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Michael Duggan (miduggan24) commented Oct 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sabollim-silabs commented Oct 8, 2026 •

edited

Loading

github-actions Bot commented Oct 8, 2026 •

edited

Loading

cursor Bot commented Oct 8, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading