Merge branch 'meshtastic:develop' into tidyups

Author: NomDeTom

.github/actions/setup-native/action.yml

@@ -11,4 +11,4 @@ runs:
     - name: Install libs needed for native build
       shell: bash
       run: |
-        sudo apt-get install -y libbluetooth-dev libgpiod-dev libyaml-cpp-dev libjsoncpp-dev openssl libssl-dev libulfius-dev liborcania-dev libusb-1.0-0-dev libi2c-dev libuv1-dev
+        sudo apt-get install -y libbluetooth-dev libgpiod-dev libyaml-cpp-dev libjsoncpp-dev openssl libssl-dev libulfius-dev liborcania-dev libusb-1.0-0-dev libi2c-dev libuv1-dev libcurl4-gnutls-dev

.github/workflows/build_windows_bin.yml

@@ -47,6 +47,7 @@ jobs:
             mingw-w64-ucrt-x86_64-libuv
             mingw-w64-ucrt-x86_64-jsoncpp
             mingw-w64-ucrt-x86_64-openssl
+            mingw-w64-ucrt-x86_64-curl
             mingw-w64-ucrt-x86_64-libusb
             mingw-w64-ucrt-x86_64-cmake
             mingw-w64-ucrt-x86_64-ninja

.github/workflows/main_matrix.yml

@@ -140,7 +140,7 @@ jobs:
     secrets: inherit
 
   MacOS:
-    if: ${{ github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
+    if: ${{ !contains(github.ref_name, 'event/') && github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
     strategy:
       fail-fast: false
       matrix:
@@ -155,7 +155,7 @@ jobs:
     # secrets: inherit
 
   Windows:
-    if: ${{ github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
+    if: ${{ !contains(github.ref_name, 'event/') && github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
     strategy:
       fail-fast: false
       matrix:
@@ -182,7 +182,7 @@ jobs:
     uses: ./.github/workflows/test_native.yml
 
   build-wasm:
-    if: ${{ github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
+    if: ${{ !contains(github.ref_name, 'event/') && github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
     # Build the WebAssembly portduino node ([env:native-wasm]) as part of normal CI,
     # like the other platforms. It's a dedicated job (not a row in the `build`
     # matrix) because its artifact is meshnode.{mjs,wasm} - not a flashable
@@ -191,7 +191,7 @@ jobs:
     uses: ./.github/workflows/build_portduino_wasm.yml
 
   docker:
-    if: ${{ github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
+    if: ${{ !contains(github.ref_name, 'event/') && github.event_name != 'schedule' && github.event.inputs.nightly != 'true' }}
     permissions: # Needed for pushing to GHCR.
       contents: read
       packages: write

.github/workflows/test_native.yml

@@ -81,6 +81,14 @@ jobs:
           lcov ${{ env.LCOV_CAPTURE_FLAGS }} --initial --output-file coverage_base.info
           sed -i -e "s#${PWD}#.#" coverage_base.info # Make paths relative.
 
+      - name: Config check tests
+        # Drives the same binary against test/fixtures/portduino-config: asserts that
+        # `--check` reports each planted fault, and that a normal run still refuses the
+        # configs it should. Runs before the simulator test because it is seconds long
+        # and a failure here explains a lot of downstream weirdness.
+        timeout-minutes: 5
+        run: ./bin/test-config-check.sh .pio/build/coverage/meshtasticd
+
       - name: Integration test
         # Cap the whole step: if the simulator ever fails to exit (e.g. the
         # exit_simulator admin path regresses again) the job must fail fast,

.trunk/trunk.yaml

@@ -4,7 +4,7 @@ cli:
 plugins:
   sources:
     - id: trunk
-      ref: v1.10.0
+      ref: v1.10.2
       uri: https://github.com/trunk-io/plugins
 lint:
   # Custom file set + formatter that rewrites Unicode em-dash (U+2014, UTF-8
@@ -69,19 +69,19 @@ lint:
   enabled:
     - ascii-dash@SYSTEM
     - too-many-defined@SYSTEM
-    - checkov@3.2.529
-    - renovate@43.150.0
-    - prettier@3.8.3
-    - trufflehog@3.95.3
+    - checkov@3.3.8
+    - renovate@44.2.3
+    - prettier@3.9.6
+    - trufflehog@3.96.0
     - yamllint@1.38.0
     - bandit@1.9.4
-    - trivy@0.70.0
+    - trivy@0.72.0
     - taplo@0.10.0
-    - ruff@0.15.13
+    - ruff@0.16.0
     - isort@8.0.1
-    - markdownlint@0.48.0
+    - markdownlint@0.49.1
     - oxipng@10.1.1
-    - svgo@4.0.1
+    - svgo@4.0.2
     - actionlint@1.7.12
     - flake8@7.3.0
     - hadolint@2.14.0
@@ -102,6 +102,14 @@ lint:
     - linters: [gitleaks]
       paths:
         - test/fixtures/nodedb/seed_v25_*.jsonl
+    # Deliberately broken YAML: these are the inputs to bin/test-config-check.sh,
+    # which asserts that `meshtasticd --check` reports each planted fault. Prettier
+    # rejects the duplicate keys and bad indentation that are the whole point of
+    # them, so the directory is exempt. The README there is normal prose and stays
+    # linted.
+    - linters: [ALL]
+      paths:
+        - test/fixtures/portduino-config/**/*.yaml
     # checkov/CKV_SECRET_6 flags the commented-out "large4cats" example,
     # which is the public default credential for the meshtastic.org MQTT
     # broker rather than a real secret. Ignore the whole file so the

Dockerfile

@@ -16,7 +16,7 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
         curl wget g++ zip git ca-certificates pkg-config \
         python3-pip python3-grpc-tools \
         libgpiod-dev libyaml-cpp-dev libjsoncpp-dev libbluetooth-dev libi2c-dev libuv1-dev \
-        libusb-1.0-0-dev libulfius-dev liborcania-dev libssl-dev \
+        libcurl4-gnutls-dev libusb-1.0-0-dev libulfius-dev liborcania-dev libssl-dev \
         libx11-dev libinput-dev libxkbcommon-x11-dev libsqlite3-dev libsdl2-dev \
     && apt-get clean && rm -rf /var/lib/apt/lists/* \
     && pip install --no-cache-dir -U platformio \
@@ -55,7 +55,7 @@ USER root
 
 RUN apt-get update && apt-get --no-install-recommends -y install \
         libc-bin libc6 libgpiod3 libyaml-cpp0.8 libjsoncpp26 libi2c0 libuv1t64 libusb-1.0-0-dev \
-        liborcania2.3 libulfius2.7t64 libssl3t64 \
+        libcurl4t64 liborcania2.3 libulfius2.7t64 libssl3t64 \
         libx11-6 libinput10 libxkbcommon-x11-0 libsdl2-2.0-0 \
     && apt-get clean && rm -rf /var/lib/apt/lists/* \
     && mkdir -p /var/lib/meshtasticd \

alpine.Dockerfile

@@ -17,7 +17,7 @@ ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN apk --no-cache add \
         bash g++ libstdc++-dev linux-headers zip git ca-certificates libbsd-dev \
         py3-pip py3-grpcio-tools \
-        libgpiod-dev yaml-cpp-dev jsoncpp-dev bluez-dev \
+        libgpiod-dev yaml-cpp-dev jsoncpp-dev bluez-dev curl-dev \
         libusb-dev i2c-tools-dev libuv-dev openssl-dev pkgconf argp-standalone \
         libx11-dev libinput-dev libxkbcommon-dev sqlite-dev sdl2-dev \
     && rm -rf /var/cache/apk/* \
@@ -50,7 +50,7 @@ USER root
 
 RUN apk --no-cache add \
         shadow libstdc++ libbsd libgpiod yaml-cpp jsoncpp libusb \
-        i2c-tools libuv libx11 libinput libxkbcommon sdl2 \
+        libcurl i2c-tools libuv libx11 libinput libxkbcommon sdl2 \
     && rm -rf /var/cache/apk/* \
     && mkdir -p /var/lib/meshtasticd \
     && mkdir -p /etc/meshtasticd/config.d \