Sync csa branch with main

.github/.wordlist.txt

@@ -284,10 +284,12 @@ COAP
 codeaurora
 codebase
 codec
+Codecov
 codegen
 CodeGenerator
 CodeLab
 codelabs
+CodeQL
 ColorControl
 Combinators
 Comcast
@@ -1633,6 +1635,7 @@ TXD
 txt
 uargument
 UART
+UBSan
 UDC
 udcport
 udhcpc

.github/actions/bootstrap/action.yaml

@@ -103,7 +103,7 @@ runs:
             build_overrides/pigweed_environment.gni
 
     - name: Upload bootstrap logs
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: ${{ always() && !env.ACT && fromJSON(steps.restore.outputs.outputs).cache-hit != 'true' }}
       with:
         name: ${{ inputs.bootstrap-log-name }}

.github/actions/upload-size-reports/action.yaml

@@ -9,7 +9,7 @@ runs:
   using: "composite"
   steps:
     - name: Uploading Size Reports
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: ${{ !env.ACT }}
       with:
         name: Size,${{ inputs.platform-name }}-Examples,${{ env.GH_EVENT_PR }},${{ env.GH_EVENT_HASH }},${{ env.GH_EVENT_PARENT }},${{ github.event_name }}

.github/workflows/build.yaml

@@ -69,10 +69,11 @@ jobs:
             - name: Checkout submodules & Bootstrap
               uses: ./.github/actions/checkout-submodules-and-bootstrap
               with:
-                platform: linux
+                # unit_tests pulls the submodules that chip_build_all_platform_tests needs
+                platform: linux unit_tests
             - name: Initialize CodeQL
               if: ${{ inputs.run-codeql  }}
-              uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+              uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
               with:
                   languages: "cpp"
                   queries: security-extended, security-and-quality
@@ -81,9 +82,10 @@ jobs:
                   # codeql.yml runs nightly on master only, so re-enable this if
                   # the push/pull_request triggers are ever restored.
                   trap-caching: false
+            # chip_build_all_platform_tests adds host-buildable platform unit tests (e.g. silabs)
             - name: Setup Build
               if: github.event.pull_request.number == null
-              run: scripts/build/gn_gen.sh --args="chip_config_memory_debug_checks=true chip_config_memory_debug_dmalloc=false"
+              run: scripts/build/gn_gen.sh --args="chip_config_memory_debug_checks=true chip_config_memory_debug_dmalloc=false chip_build_all_platform_tests=true"
             - name: Run Build
               if: github.event.pull_request.number == null
               run: scripts/run_in_build_env.sh "ninja -C ./out"
@@ -122,12 +124,16 @@ jobs:
             - name: Clean out build output
               if: inputs.run-codeql != true && github.event.pull_request.number == null
               run: rm -rf ./out
+            # PR-only: master pushes build and test the memory-debug-checks configuration above.
             - name: Set up Build Without Logging
-              if: inputs.run-codeql != true
-              run: scripts/build/gn_gen.sh --args="chip_logging=false"
+              if: inputs.run-codeql != true && github.event.pull_request.number != null
+              run: scripts/build/gn_gen.sh --args="chip_logging=false chip_build_all_platform_tests=true"
             - name: Run Build Without Logging
-              if: inputs.run-codeql != true
+              if: inputs.run-codeql != true && github.event.pull_request.number != null
               run: scripts/run_in_build_env.sh "ninja -C ./out"
+            - name: Run Tests Without Logging
+              if: inputs.run-codeql != true && github.event.pull_request.number != null
+              run: scripts/tests/gn_tests.sh
             - name: Uploading core files
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               if: ${{ failure() && !env.ACT }}
@@ -141,7 +147,7 @@ jobs:
             # scope, letting the pins bump together and stay consistent (see lint.yml check).
             - name: Perform CodeQL Analysis
               if: ${{ inputs.run-codeql }}
-              uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+              uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
               with:
                   category: "/language:cpp"
                   upload: False
@@ -161,7 +167,7 @@ jobs:
                   output: "sarif-results/cpp.sarif"
             - name: Upload SARIF
               if: ${{ inputs.run-codeql }}
-              uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+              uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
               with:
                   sarif_file: "sarif-results/cpp.sarif"
             - name: Upload loc as a Build Artifact
@@ -231,7 +237,7 @@ jobs:
             # deactivate until a better workaround is found
             # - name: Initialize CodeQL
             #   if: ${{ inputs.run-codeql  }}
-            #   uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+            #   uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
             #   with:
             #       languages: "cpp"
             - name: Setup and Build Simulated Device
@@ -269,7 +275,6 @@ jobs:
                   for BUILD_TYPE in asan tsan ubsan; do
                       case $BUILD_TYPE in
                           "asan") GN_ARGS='is_clang=true is_asan=true';;
-                          "msan") GN_ARGS='is_clang=true is_msan=true';;
                           "tsan") GN_ARGS='is_clang=true is_tsan=true chip_enable_wifi=false';;
                           "ubsan") GN_ARGS='is_clang=true is_ubsan=true';;
                       esac
@@ -511,7 +516,7 @@ jobs:
             #  Build on Darwin + CodeQL often takes 6 hours (which is more than the maximum allowed by GitHub Runners), Deactivate it until we can investigate this
             # - name: Initialize CodeQL
             #   if: ${{ inputs.run-codeql  }}
-            #   uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+            #   uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
             #   with:
             #       languages: "cpp"
 

.github/workflows/lint.yml

@@ -59,6 +59,11 @@ jobs:
                   fi
                   echo "codeql-action pinned consistently: ${shas:-<none>}"
 
+            - name: Check unit-test steps snapshot is up to date
+              if: always()
+              # Keeps docs/ci-cd/host_unit_tests.md reviewed when workflows change which unit tests run.
+              run: scripts/tools/list_unit_test_steps.py --check
+
             - name: Check for orphaned gn files
               if: always()
               # We should enforce that ALL new files are referenced in our build scripts.

.github/workflows/nightly.yaml

@@ -330,6 +330,7 @@
               with:
                 slack-webhook: ${{ secrets.SWTT_SLACK_WEBHOOK }}
 
+    # See docs/ci-cd/host_unit_tests.md for which crypto backends run on PRs, pushes and nightly.
     nightly_asan_crypto_backends:
         name: Nightly ASAN Testing across Crypto Backends
         if: github.actor != 'restyled-io[bot]'
@@ -356,7 +357,6 @@
                   ./scripts/run_in_build_env.sh \
                     "./scripts/build/build_examples.py --target linux-x64-tests-mbedtls-asan-clang build" \
                     && rm -rf out/linux-x64-tests-mbedtls-asan-clang
-            # PSA also runs in unit_integration_test.yaml, but only when crypto/credentials/pigweed paths change.
             - name: ASAN unit tests - PSA
               run: |
                   ./scripts/run_in_build_env.sh \
@@ -494,3 +494,43 @@
               uses: ./.github/actions/notify-slack-failure
               with:
                 slack-webhook: ${{ secrets.SWTT_SLACK_WEBHOOK }}
+
+    # See docs/ci-cd/host_unit_tests.md for which unit-test configurations run on PRs, pushes and nightly.
+    nightly_unit_tests_various_features:
+        name: Nightly Unit Tests - Linux (various features)
+        if: github.actor != 'restyled-io[bot]'
+        timeout-minutes: 120
+
+        runs-on: ubuntu-latest
+
+        env:
+            BUILD_TYPE: various_features
+
+        container:
+            image: ghcr.io/project-chip/chip-build:215
+            volumes:
+                - "/:/runner-root-volume"
+                - "/tmp/log_output:/tmp/test_logs"
+            options: --privileged --sysctl "net.ipv6.conf.all.disable_ipv6=0 net.ipv4.conf.all.forwarding=1 net.ipv6.conf.all.forwarding=1"
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+            - name: Checkout submodules & Bootstrap
+              uses: ./.github/actions/checkout-submodules-and-bootstrap
+              with:
+                  platform: linux unit_tests
+                  bootstrap-log-name: bootstrap-logs-unittest-various-features
+            - name: Setup Build
+              # Bundles ICD, ARL and rotating-device-id (with clang/asan/boringssl) into one build
+              run: |
+                  scripts/build/gn_gen.sh --args='is_clang=true is_asan=true chip_crypto="boringssl" chip_enable_rotating_device_id=true chip_enable_icd_server=true chip_enable_icd_lit=true chip_enable_access_restrictions=true chip_build_all_platform_tests=true'
+            - name: Run Build
+              run: scripts/run_in_build_env.sh "ninja -C out/$BUILD_TYPE"
+            - name: Run Tests
+              run: scripts/tests/gn_tests.sh
+            - name: Notify Slack on Failure
+              if: failure()
+              uses: ./.github/actions/notify-slack-failure
+              with:
+                slack-webhook: ${{ secrets.SWTT_SLACK_WEBHOOK }}

.github/workflows/scorecard.yml

@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -72,6 +72,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif

.github/workflows/unit_integration_test.yaml

@@ -27,115 +27,58 @@
     cancel-in-progress: true
 
 jobs:
-    unit_tests:
-        name: Unit / Integration Tests
-        if: github.actor != 'restyled-io[bot]'
-
-        strategy:
-            matrix:
-                type: [main, mbedtls, all_features]
-        env:
-            BUILD_TYPE: ${{ matrix.type }}
-
-        runs-on: ubuntu-latest
-
-        container:
-            image: ghcr.io/project-chip/chip-build:215
-            volumes:
-                - "/:/runner-root-volume"
-                - "/tmp/log_output:/tmp/test_logs"
-            options: --privileged --sysctl "net.ipv6.conf.all.disable_ipv6=0 net.ipv4.conf.all.forwarding=1 net.ipv6.conf.all.forwarding=1"
-
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v7
-            - name: Checkout submodules & Bootstrap
-              uses: ./.github/actions/checkout-submodules-and-bootstrap
-              with:
-                platform: linux unit_tests
-                bootstrap-log-name: bootstrap-logs-unittest-${{ matrix.type }}
-            - name: Artifact suffix
-              id: outsuffix
-              uses: haya14busa/action-cond@v1
-              if: ${{ !env.ACT }}
-              with:
-                  cond: ${{ github.event.pull_request.number == '' }}
-                  if_true: "${{ github.sha }}"
-                  if_false: "pull-${{ github.event.pull_request.number }}"
-            - name: Setup Build
-              # all_features bundles ICD, ARL and rotating-device-id (with clang/asan/boringssl) into one matrix row
-              run: |
-                  case $BUILD_TYPE in
-                     "main") GN_ARGS='chip_build_all_platform_tests=true';;
-                     "mbedtls") GN_ARGS='chip_crypto="mbedtls" chip_build_all_platform_tests=true';;
-                     "all_features") GN_ARGS='is_clang=true is_asan=true chip_crypto="boringssl" chip_enable_rotating_device_id=true chip_enable_icd_server=true chip_enable_icd_lit=true chip_enable_access_restrictions=true chip_build_all_platform_tests=true';;
-                     *) ;;
-                  esac
-
-                  scripts/build/gn_gen.sh --args="$GN_ARGS"
-            - name: Run Build
-              run: scripts/run_in_build_env.sh "ninja -C out/$BUILD_TYPE"
-            - name: Run Tests
-              run: scripts/tests/gn_tests.sh
-            # TODO Log Upload https://github.com/project-chip/connectedhomeip/issues/2227
-            # TODO https://github.com/project-chip/connectedhomeip/issues/1512
-            # - name: Run Code Coverage
-            #   if: ${{ contains('main', env.BUILD_TYPE) }}
-            #   run: scripts/tools/codecoverage.sh
-            # - name: Upload Code Coverage
-            #   if: ${{ contains('main', env.BUILD_TYPE) }}
-            #   run: bash <(curl -s https://codecov.io/bash)
-            - name: Notify Slack on Failure
-              if: failure()
-              uses: ./.github/actions/notify-slack-failure
-              with:
-                slack-webhook: ${{ secrets.SWTT_SLACK_WEBHOOK }}
-
-    # Builds and runs the host unit-test suite with the PSA crypto backend.
-    psa_crypto_unit_tests:
-        name: PSA Crypto Unit Tests
+    # Builds and runs the host unit-test suite with the PSA and mbedTLS crypto backends.
+    # See docs/ci-cd/host_unit_tests.md for which crypto backends run on PRs, pushes and nightly.
+    crypto_backend_unit_tests:
+        name: Crypto Backend Unit Tests (PSA, mbedTLS)
         if: github.actor != 'restyled-io[bot]'
 
         runs-on: ubuntu-latest
 
         container:
             image: ghcr.io/project-chip/chip-build:215
             volumes:
                 - "/:/runner-root-volume"
                 - "/tmp/log_output:/tmp/test_logs"
             options: --privileged --sysctl "net.ipv6.conf.all.disable_ipv6=0 net.ipv4.conf.all.forwarding=1 net.ipv6.conf.all.forwarding=1"
 
         steps:
             - name: Checkout
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-            - name: Checkout submodules & Bootstrap
-              uses: ./.github/actions/checkout-submodules-and-bootstrap
-              with:
-                platform: linux unit_tests
-                bootstrap-log-name: bootstrap-logs-unittest-psa
+            # Runs before bootstrap so runs that do not match the filter skip the whole job body.
             - name: Detect changed paths
               uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
               id: changed_paths
               with:
                   filters: |
-                      credentials:
-                        - 'src/credentials/**'
+                      # PSA on Linux is provided by the mbedTLS library, so both backends share one filter.
                       crypto:
+                        - 'src/credentials/**'
                         - 'src/crypto/**'
-                      pigweed:
                         - 'src/pw_backends/**'
                         - 'third_party/pigweed/**'
+                        - 'third_party/mbedtls/**'
+                        - '.github/workflows/unit_integration_test.yaml'
+            - name: Checkout submodules & Bootstrap
+              if: steps.changed_paths.outputs.crypto == 'true'
+              uses: ./.github/actions/checkout-submodules-and-bootstrap
+              with:
+                platform: linux
+                bootstrap-log-name: bootstrap-logs-unittest-crypto-backends
             - name: Build and run PSA unit tests (ASan)
-              if: >
-                github.event_name == 'push' ||
-                steps.changed_paths.outputs.credentials == 'true' ||
-                steps.changed_paths.outputs.crypto == 'true' ||
-                steps.changed_paths.outputs.pigweed == 'true' 
+              if: steps.changed_paths.outputs.crypto == 'true'
+              run: |
+                  ./scripts/run_in_build_env.sh \
+                    "./scripts/build/build_examples.py --target linux-x64-tests-psa-asan-clang build" \
+                    && rm -rf out/linux-x64-tests-psa-asan-clang
+            - name: Build and run mbedTLS unit tests (ASan)
+              if: steps.changed_paths.outputs.crypto == 'true'
               run: |
                   ./scripts/run_in_build_env.sh \
-                    "./scripts/build/build_examples.py --target linux-x64-tests-psa-asan-clang build"
+                    "./scripts/build/build_examples.py --target linux-x64-tests-mbedtls-asan-clang build" \
+                    && rm -rf out/linux-x64-tests-mbedtls-asan-clang
             - name: Notify Slack on Failure
               if: failure()
               uses: ./.github/actions/notify-slack-failure
               with:
                 slack-webhook: ${{ secrets.SWTT_SLACK_WEBHOOK }}