[rdlauer]

Summary

Fixes a CI bug that hid failures and tightens the Python workflow. Also adds compile checks for the two Arduino samples, which had no CI before.

We looked at moving this repo to Namespace runners and decided not to. The repo is public, so GitHub-hosted runners are free. Jobs take 9–17 s, and CI runs about once a month, which is too rarely for Namespace's caching to help. It would also be the first public Blues repo on Namespace. Everything here stays on GitHub-hosted runners.

Changes

Python CI (note-samples-python-ci.yml)

• Bug fix: job-level continue-on-error: true reported failed jobs as a passing run. On 2026-05-19, 3 jobs in one run failed and the run still showed green. Replaced with fail-fast: false, so every sample still reports but failures now fail the run.
• Triggers: pushes to main plus pull_request. It used to run on every branch push and never on PRs from forks.
• concurrency (same pattern as blues.dev): cancels superseded runs, except on main.
• timeout-minutes: 10. Passing jobs take ≤17 s; a hung python-dfu test once ran 5m41s, and GitHub's default limit is 6 h.
• permissions: contents: read. The repo's default workflow token has write access.
• ubuntu-latest → ubuntu-24.04. checkout v5 → v7, setup-python v6 → v7. Neither major's breaking changes affect this workflow.
• Python 3.10 (end-of-life Oct 2026) → matrix 3.11 + 3.13, matching Raspberry Pi OS Bookworm and Trixie. Verified locally on 3.10–3.14.
• python-large-file-upload and python-softap-fix are now linted. pytest is skipped for samples that have no test files.

Arduino CI (new note-samples-arduino-ci.yml, runs only when the Arduino samples or the workflow change)

• esp32-dfu: arduino/compile-sketches for esp32:esp32:featheresp32, with the latest esp32 core and Notecard library.
• arduino-note-array: pio run with the latest PlatformIO.

Other

• .github/dependabot.yml keeps action versions current, with minor and patch updates grouped into one PR.
• Two requirements.txt files re-encoded from UTF-16/CRLF to UTF-8. The content is unchanged.
• Bug fix (found by the new Arduino CI): arduino-note-array included <notecard.h>, but the library ships Notecard.h. The sample built on macOS, which ignores filename case, and failed on Linux. Fixed the include.

Dependency security fixes (172 open Dependabot alerts → 0 once merged)

• python-remote-commands-attn-rpi/requirements.txt was a 2019 pip freeze of an entire Raspberry Pi system: 131 packages, responsible for 170 of the 172 alerts. None of the vulnerable packages are used by the sample, and the file no longer installs on Python 3.11 or 3.13. Replaced it with the four packages the sample imports, at their latest versions: note-python==2.5.1, pyserial==3.5, python-periphery==2.4.3, RPi.GPIO==0.7.1. (RPi.GPIO 0.7.0 doesn't build with GCC 10+ or on Python 3.13.)
• python-softap-fix: requests 2.32.3 → 2.34.2, which fixes CVE-2024-47081 and CVE-2026-25645.
• Both samples now require Python 3.10+ (because of note-python 2.x and requests 2.33+); their READMEs say so. Python 3.8 and 3.9 are both end-of-life.

Testing

• actionlint passes on both workflows.
• Locally: all 4 tested samples pass flake8 and pytest (311 tests) on Python 3.10–3.14. Both new lint-only samples pass the blocking flake8 check. esp32-dfu compiles for the Feather ESP32 and arduino-note-array builds with PlatformIO.
• On this PR: Python CI passed all 12 jobs in about 25 s, with pytest running for the 4 samples that have tests and skipped for the 2 lint-only ones. Arduino CI passed: esp32-dfu in about 1.5 min and arduino-note-array in about 1 min, built against Notecard library 1.8.5.
• Dependency changes, tested in Debian Bookworm/Python 3.11 and Trixie/Python 3.13 containers on arm64 (the same OS releases and architecture as Raspberry Pi OS): both new requirements files install cleanly, while the old attn-rpi freeze fails on both. attn-rpi's 51 tests pass. A smoke test drove the sample's attn.py (Initialize/Arm/Disarm/QueryTriggerSource) through note-python 2.5.1's OpenSerial + Transaction over a pyserial loopback port. softap-fix downloaded and extracted all 7 SoftAP assets with requests 2.34.2. The OpenI2C/OpenSerial/Transaction signatures and the python-periphery I2C path match between note-python 1.4.4 and 2.5.1. No test was run on real Notecard hardware.

🤖 Generated with Claude Code