chore(deps): bump docker/build-push-action from 6 to 7

.github/workflows/check-format.yml

@@ -48,7 +48,7 @@ jobs:
 
       - name: Build picolibc container
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/amd64
           file: .github/Dockerfile-check-format

.github/workflows/license-check.yml

@@ -0,0 +1,73 @@
+name: License Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  scancode:
+    name: Scancode License Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install scancode-toolkit
+        run: pip install 'scancode-toolkit==32.3.0'
+
+      - name: Scan licenses
+        run: |
+          scancode \
+            --license \
+            --license-policy license-policy.yml \
+            --only-findings \
+            --processes "$(nproc)" \
+            --json-pp scancode-results.json \
+            --ignore ".git/*" \
+            --ignore ".github/*" \
+            --ignore "scripts/import-upstream.sh" \
+            --ignore "COPYLEFT_EXCLUSIONS" \
+            --ignore "COPYING.picolibc" \
+            --ignore "find-copyright" \
+            --ignore "README.md" \
+            --ignore "README.upstream.md" \
+            .
+
+      - name: Check for forbidden licenses
+        run: |
+          jq -r '
+            [.files[] | select(.license_policy[]?.policy == "forbidden")]
+            | if length > 0 then
+                "Forbidden licenses found:",
+                (.[] | "  \(.path): \(.detected_license_expression_spdx)"),
+                halt_error(1)
+              else
+                "No forbidden licenses found."
+              end
+          ' scancode-results.json
+
+      - name: Upload scancode results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: scancode-results
+          path: scancode-results.json
+
+  exclusions-check:
+    name: COPYLEFT_EXCLUSIONS Consistency
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Verify excluded paths do not exist
+        run: |
+          awk '!/^#/ && NF { if (system("test ! -e " $0)) { print "ERROR: Excluded file found: " $0; exit 1 } }' COPYLEFT_EXCLUSIONS
+          echo "All excluded paths are absent from the tree."

.github/workflows/linux.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Build picolibc container
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/amd64
           file: .github/Dockerfile

.github/workflows/native.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Build picolibc container
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/amd64
           file: .github/Dockerfile

.github/workflows/tag-release.yml

@@ -0,0 +1,27 @@
+name: Tag Release
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    name: Create version tag
+    if: github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'update-upstream-')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Create tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          version="${GITHUB_HEAD_REF#update-upstream-}"
+          tag="${version}-bsd"
+          echo "Creating tag: $tag"
+          gh release create "$tag" --title "picolibc ${version} (BSD)" --notes "Based on upstream picolibc ${version}"

.github/workflows/update-upstream.yml

@@ -0,0 +1,86 @@
+name: Update from Upstream
+
+on:
+  workflow_dispatch:
+    inputs:
+      to_ref:
+        description: "Upstream version tag to import up to, e.g., 1.9.0"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update:
+    name: Import Upstream Commits
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Import upstream commits
+        id: import
+        run: |
+          # Auto-detect from_ref: find latest *-bsd tag, strip suffix to get upstream ref
+          from=$(git tag -l '*-bsd' --sort=-v:refname | head -1 | sed 's/-bsd$//')
+          if [ -z "$from" ]; then
+            echo "No *-bsd tags found. Tag the initial import first (e.g., git tag 1.8.11-bsd)." >&2
+            exit 1
+          fi
+          target="${{ inputs.to_ref }}"
+
+          branch="update-upstream-${target}"
+          git branch -D "$branch" 2>/dev/null || true
+          git push origin --delete "$branch" 2>/dev/null || true
+          git checkout -b "$branch"
+
+          scripts/import-upstream.sh "$from" "$target" 2>&1 | tee import-log.txt
+
+          imported=$(grep -oP 'Imported: \K[0-9]+' import-log.txt || echo "0")
+          echo "imported=$imported" >> "$GITHUB_OUTPUT"
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+          echo "from=$from" >> "$GITHUB_OUTPUT"
+
+      - name: Create or update PR
+        if: steps.import.outputs.imported != '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TARGET: ${{ inputs.to_ref }}
+          BRANCH: ${{ steps.import.outputs.branch }}
+          FROM: ${{ steps.import.outputs.from }}
+        run: |
+          git push origin "$BRANCH"
+
+          # Generate PR body
+          cat > pr-body.md <<EOF
+          ## Upstream Update: picolibc ${TARGET}
+
+          **Upstream compare**: [${FROM:0:12}...${TARGET}](https://github.com/picolibc/picolibc/compare/${FROM:0:12}...${TARGET})
+
+          ### Imported commits
+          $(git log --oneline main..HEAD | head -50)
+
+          ### Checklist
+          - [ ] Review imported commits
+          - [ ] Verify license scan passes
+          - [ ] Update version table in README.md
+          - [ ] Merge with **rebase** to preserve commit history
+          - [ ] After merge, tag will be created automatically
+          EOF
+
+          existing_pr=$(gh pr list --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || true)
+          if [[ -n "$existing_pr" ]]; then
+            gh pr edit "$existing_pr" --title "Update from upstream picolibc ${TARGET}" --body-file pr-body.md
+          else
+            gh pr create --base main --head "$BRANCH" --title "Update from upstream picolibc ${TARGET}" --body-file pr-body.md
+          fi

.github/workflows/zephyr.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Build picolibc container
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/amd64
           file: .github/Dockerfile-zephyr

COPYLEFT_EXCLUSIONS

@@ -0,0 +1,15 @@
+# Copyleft Exclusions
+#
+# Files excluded from this fork because they are under copyleft licenses.
+# Used by scripts/import-upstream.sh and CI license checks.
+# One path per line. Lines starting with # are comments.
+
+# GPL-2.0-or-later: Printf test suite by Bart Massey
+test/test-stdio/test-printf.c
+test/test-stdio/test-printf-testcases.h
+
+# AGPL-3.0-or-later: Meson cross-file generator script
+scripts/GeneratePicolibcCrossFile.sh
+
+# GPL-2.0-only: GPL license text file
+COPYING.GPL2