From d2606c0de2393a5e007b37600d9dc3ab642483b1 Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Tue, 20 Oct 2026 12:36:28 -0500 Subject: [PATCH 1/7] Fix masked failures and harden the Python CI workflow - Replace job-level continue-on-error (which reported failed matrix jobs as a green run) with fail-fast: false - Run on pushes to main and on pull requests, with superseded non-main runs cancelled - Add a 10-minute job timeout and a read-only token - Pin ubuntu-24.04 and bump checkout/setup-python to v7 - Test on Python 3.11 and 3.13 (3.10 is end-of-life) - Lint python-large-file-upload and python-softap-fix; pytest only runs for samples that contain tests Co-Authored-By: Claude Opus 5.5 --- .github/workflows/note-samples-python-ci.yml | 26 +++++++++++++++----- 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/.github/workflows/note-samples-python-ci.yml b/.github/workflows/note-samples-python-ci.yml index 7132766..6caa28a 100644 --- a/.github/workflows/note-samples-python-ci.yml +++ b/.github/workflows/note-samples-python-ci.yml @@ -1,24 +1,37 @@ name: note-samples-python-ci -on: [push] +on: + push: + branches: [main] + pull_request: + +concurrency: + group: ci-${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/main' && format('-{0}', github.sha) || '' }} + cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} + +permissions: + contents: read jobs: build: - runs-on: ubuntu-latest - continue-on-error: true + runs-on: ubuntu-24.04 + timeout-minutes: 10 strategy: + fail-fast: false matrix: - python-version: ["3.10"] # ["3.7", "3.8", "3.9", "3.10"] + python-version: ["3.11", "3.13"] sample: - "python-dfu" - "python-remote-commands-attn-rpi" - "python-route-endpoint" - "python-ota-request-manager" + - "python-large-file-upload" + - "python-softap-fix" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} - name: Install dependencies @@ -35,6 +48,7 @@ jobs: # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics - name: Test with pytest + if: hashFiles(format('{0}/**/test_*.py', matrix.sample), format('{0}/**/*_test.py', matrix.sample)) != '' run: | cd ${{ matrix.sample }} pytest From a3b11187a42ddfb5bdbe32f7b5fcdb101cde9c21 Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Tue, 20 Oct 2026 12:36:28 -0500 Subject: [PATCH 2/7] Add compile checks for the Arduino samples Compiles esp32-dfu for the Adafruit Feather ESP32 with arduino-cli and builds arduino-note-array (Swan) with PlatformIO, against the latest cores and Notecard library. Runs only when those samples or the workflow change. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/note-samples-arduino-ci.yml | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .github/workflows/note-samples-arduino-ci.yml diff --git a/.github/workflows/note-samples-arduino-ci.yml b/.github/workflows/note-samples-arduino-ci.yml new file mode 100644 index 0000000..d2a1fc8 --- /dev/null +++ b/.github/workflows/note-samples-arduino-ci.yml @@ -0,0 +1,53 @@ +name: note-samples-arduino-ci + +on: + push: + branches: [main] + paths: + - "arduino-note-array/**" + - "esp32-dfu/**" + - ".github/workflows/note-samples-arduino-ci.yml" + pull_request: + paths: + - "arduino-note-array/**" + - "esp32-dfu/**" + - ".github/workflows/note-samples-arduino-ci.yml" + +concurrency: + group: ci-${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/main' && format('-{0}', github.sha) || '' }} + cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} + +permissions: + contents: read + +jobs: + esp32-dfu: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - uses: actions/checkout@v7 + - name: Compile esp32-dfu + uses: arduino/compile-sketches@v1 + with: + fqbn: esp32:esp32:featheresp32 + platforms: | + - name: esp32:esp32 + source-url: https://espressif.github.io/arduino-esp32/package_esp32_index.json + libraries: | + - name: Blues Wireless Notecard + sketch-paths: | + - esp32-dfu + + arduino-note-array: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - uses: actions/checkout@v7 + - name: Set up Python + uses: actions/setup-python@v7 + with: + python-version: "3.13" + - name: Install PlatformIO + run: pip install platformio + - name: Build arduino-note-array + run: pio run -d arduino-note-array/arduino-note-array From 8e8796aab72dd1b6ad895de0528c84d6b6be69d2 Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Tue, 20 Oct 2026 12:36:28 -0500 Subject: [PATCH 3/7] Add Dependabot for GitHub Actions versions Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..0a30165 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 + +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + commit-message: + prefix: "chore(actions)" + groups: + actions-minor-patch: + update-types: + - "minor" + - "patch" From 629c0de920acacb737a27ee2ab13de42cc8285c8 Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Tue, 20 Oct 2026 12:36:28 -0500 Subject: [PATCH 4/7] Re-encode two requirements files from UTF-16 to UTF-8 Content is unchanged; GitHub and most tools treated the UTF-16/CRLF files as binary. Co-Authored-By: Claude Opus 5.5 --- python-large-file-upload/requirements.txt | Bin 114 -> 53 bytes python-ota-request-manager/requirements.txt | Bin 64 -> 29 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/python-large-file-upload/requirements.txt b/python-large-file-upload/requirements.txt index 2869cc35f76fbcc4e109f6f43c43a4cecb0aa5b2..e7b09353e4d67152a3ffb7b2ff49997d43042fdd 100644 GIT binary patch literal 53 zcmZ?H&r8cpcPvT|NGvK&wY4?WGu1QZO3Tbi&B;&BwzW0ZGc?jO;3}vrPA$qz%mE3Q GasdF-oDf$4 literal 114 zcmW-ZK?;B{5Ci8d_!Y619zBR3@C!v$#G+D9eqN2svdJNnyid=;&dka}N0tsm`Nc%5 lb5sPqr=&10DM@OLY({vcjz(G=b8=fdYcq=cSAHf~`T^8r5_ Date: Tue, 20 Oct 2026 12:38:58 -0500 Subject: [PATCH 5/7] Fix Notecard header case in arduino-note-array The library ships Notecard.h; including notecard.h only worked on case-insensitive filesystems and failed to build on Linux. Co-Authored-By: Claude Opus 5.5 --- arduino-note-array/arduino-note-array/src/main.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arduino-note-array/arduino-note-array/src/main.cpp b/arduino-note-array/arduino-note-array/src/main.cpp index 7511b46..52ea2ad 100644 --- a/arduino-note-array/arduino-note-array/src/main.cpp +++ b/arduino-note-array/arduino-note-array/src/main.cpp @@ -14,7 +14,7 @@ #include -#include +#include // Note that both of these definitions are optional; just prefix either line // with `//` to remove it. From 7d8c9d5b1f11fd8b14b1b9367b4d426cbb0d1be3 Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Tue, 20 Oct 2026 12:49:29 -0500 Subject: [PATCH 6/7] Replace attn-rpi requirements with the sample's real dependencies requirements.txt was a 2019 pip freeze of a whole Raspberry Pi system (135 packages). It no longer installs on Python 3.11 or 3.13 and accounted for 170 open Dependabot alerts, none of them in packages the sample uses. List only what it imports, at current versions: note-python 2.5.1, pyserial 3.5, python-periphery 2.4.3 and RPi.GPIO 0.7.1 (0.7.0 no longer builds with GCC 10+ or Python 3.13). note-python 2.x requires Python 3.10 or later; README updated. Co-Authored-By: Claude Opus 5.5 --- python-remote-commands-attn-rpi/README.md | 2 +- .../requirements.txt | 135 +----------------- 2 files changed, 5 insertions(+), 132 deletions(-) diff --git a/python-remote-commands-attn-rpi/README.md b/python-remote-commands-attn-rpi/README.md index a0ea9ef..e2f3310 100644 --- a/python-remote-commands-attn-rpi/README.md +++ b/python-remote-commands-attn-rpi/README.md @@ -18,7 +18,7 @@ General workflow follows: ## Setup Hardware -Notecard connected to a Raspberry Pi with Python 3 installed +Notecard connected to a Raspberry Pi with Python 3.10 or later installed The Notecard ATTN Pin is wired to a GPIO pin on the Rasberry Pi diff --git a/python-remote-commands-attn-rpi/requirements.txt b/python-remote-commands-attn-rpi/requirements.txt index a666fe4..73d9cbb 100644 --- a/python-remote-commands-attn-rpi/requirements.txt +++ b/python-remote-commands-attn-rpi/requirements.txt @@ -1,131 +1,4 @@ -appdirs==1.4.3 -asn1crypto==0.24.0 -astroid==2.1.0 -asttokens==1.1.13 -automationhat==0.2.0 -beautifulsoup4==4.7.1 -blinker==1.4 -blinkt==0.1.2 -buttonshim==0.0.2 -Cap1xxx==0.1.3 -certifi==2018.8.24 -chardet==3.0.4 -Click==7.0 -colorama==0.3.7 -colorzero==1.1 -cookies==2.2.1 -cryptography==2.6.1 -cupshelpers==1.0 -cycler==0.10.0 -decorator==4.3.0 -docutils==0.14 -drumhat==0.1.0 -entrypoints==0.3 -envirophat==1.0.0 -ExplorerHAT==0.4.2 -filelock==3.3.2 -Flask==1.0.2 -fourletterphat==0.1.0 -gpiozero==1.5.1 -guizero==0.6.0 -html5lib==1.0.1 -idna==2.6 -ipykernel==4.9.0 -ipython==5.8.0 -ipython-genutils==0.2.0 -isort==4.3.4 -itsdangerous==0.24 -jedi==0.13.2 -Jinja2==2.10 -jupyter-client==5.2.3 -jupyter-core==4.4.0 -keyring==17.1.1 -keyrings.alt==3.1.1 -kiwisolver==1.0.1 -lazy-object-proxy==1.3.1 -logilab-common==1.4.2 -lxml==4.3.2 -MarkupSafe==1.1.0 -matplotlib==3.0.2 -mccabe==0.6.1 -microdotphat==0.2.1 -mote==0.0.4 -motephat==0.0.3 -mypy==0.670 -mypy-extensions==0.4.1 -note-python==1.4.4 -nudatus==0.0.4 -numpy==1.16.2 -oauthlib==2.1.0 -olefile==0.46 -pantilthat==0.0.7 -parso==0.3.1 -pexpect==4.6.0 -pgzero==1.2 -phatbeat==0.1.1 -pianohat==0.1.0 -picamera==1.13 -pickleshare==0.7.5 -picraft==1.0 -piglow==1.2.5 -pigpio==1.44 -Pillow==5.4.1 -prompt-toolkit==1.0.15 -psutil==5.5.1 -pycairo==1.16.2 -pycodestyle==2.4.0 -pycrypto==2.6.1 -pycups==1.9.73 -pyflakes==2.0.0 -pygame==1.9.4.post1 -Pygments==2.3.1 -PyGObject==3.30.4 -pyinotify==0.9.6 -PyJWT==1.7.0 -pylint==2.2.2 -pyOpenSSL==19.0.0 -pyparsing==2.2.0 -pyserial==3.4 -pysmbc==1.0.15.6 -python-apt==1.8.4.3 -python-dateutil==2.7.3 -python-periphery==2.3.0 -pyxdg==0.25 -pyzmq==17.1.2 -qtconsole==4.3.1 -rainbowhat==0.1.0 -reportlab==3.5.13 -requests==2.21.0 -requests-oauthlib==1.0.0 -responses==0.9.0 -roman==2.0.0 -RPi.GPIO==0.7.0 -RTIMULib==7.2.1 -scrollphat==0.0.7 -scrollphathd==1.2.1 -SecretStorage==2.3.1 -semver==2.0.1 -Send2Trash==1.5.0 -sense-emu==1.1 -sense-hat==2.2.0 -simplegeneric==0.8.1 -simplejson==3.16.0 -six==1.12.0 -skywriter==0.0.7 -sn3218==1.2.7 -soupsieve==1.8 -spidev==3.4 -ssh-import-id==5.7 -thonny==3.3.0 -tornado==5.1.1 -touchphat==0.0.1 -traitlets==4.3.2 -twython==3.7.0 -typed-ast==1.3.1 -uflash==1.2.4 -unicornhathd==0.0.4 -urllib3==1.24.1 -wcwidth==0.1.7 -webencodings==0.5.1 -Werkzeug==0.14.1 -wrapt==1.10.11 +note-python==2.5.1 +pyserial==3.5 +python-periphery==2.4.3 +RPi.GPIO==0.7.1 From 432a9a033f2cd0a4e701c0c3143a2c8a09acde89 Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Tue, 20 Oct 2026 12:49:29 -0500 Subject: [PATCH 7/7] Bump requests to 2.34.2 in python-softap-fix Fixes CVE-2024-47081 and CVE-2026-25645. requests 2.33+ requires Python 3.10 or later; README updated. Co-Authored-By: Claude Opus 5.5 --- python-softap-fix/README.md | 2 +- python-softap-fix/requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/python-softap-fix/README.md b/python-softap-fix/README.md index 88c4d8c..694fce3 100644 --- a/python-softap-fix/README.md +++ b/python-softap-fix/README.md @@ -6,7 +6,7 @@ ESP32-based Wi-Fi Notecards and not Cell+WiFi or legacy Notecards. ## Requirements -- Python 3 +- Python 3.10 or later ## Usage diff --git a/python-softap-fix/requirements.txt b/python-softap-fix/requirements.txt index 5e707db..cf60fe6 100644 --- a/python-softap-fix/requirements.txt +++ b/python-softap-fix/requirements.txt @@ -2,4 +2,4 @@ note-python==1.5.0 packaging==24.2 python-periphery==2.3.0 pyserial==3.5 -requests==2.32.3 \ No newline at end of file +requests==2.34.2 \ No newline at end of file