ci(tests): Avoid the use of pull_request_target where possible (#9899)

.github/workflows/tests.yml

@@ -1,10 +1,29 @@
+# This file is used to run the runtime tests for the Arduino core for ESP32.
+# The tests are run on the hardware, Wokwi and QEMU emulators.
+# The QEMU tests are disabled for now as they are redundant with most of the Wokwi tests.
+# As the Wokwi tests require access to secrets, they are run in a separate workflow.
+# We need to ensure that the artifacts from previous tests in the chain are propagated for publishing the results.
+# This is the current trigger sequence for the tests:
+#  tests.yml -> tests_wokwi.yml -> tests_results.yml
+#   ⌙> tests_build.yml
+#   ⌙> tests_hw.yml
+#   ⌙> tests_qemu.yml
+
 name: Runtime Tests
 
 on:
   workflow_dispatch:
-  pull_request_target:
+  pull_request:
     types: [opened, reopened, closed, synchronize, labeled, unlabeled]
     paths:
+      - '.github/workflows/tests*'
+      - '.github/scripts/*.sh'
+      - '!.github/scripts/check-cmakelists.sh'
+      - '!.github/scripts/find_*'
+      - '!.github/scripts/on-*.sh'
+      - '!.github/scripts/set_push_chunks.sh'
+      - '!.github/scripts/update-version.sh'
+      - '!.github/scripts/upload_py_tools.sh'
       - 'tests/**'
       - 'cores/**'
       - 'libraries/**'
@@ -19,14 +38,19 @@ concurrency:
   group: tests-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-# To avoid giving elevated permissions to the entire workflow, specify default permissions at the top level
-# and then override them for specific jobs.
-permissions: { contents: read }
-
 jobs:
+  push-event-file:
+    name: Push event file
+    runs-on: ubuntu-latest
+    steps:
+      - name: Upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: event_file
+          path: ${{ github.event_path }}
+
   gen-matrix:
     name: Generate matrix
-    if: github.event.action != 'closed'
     runs-on: ubuntu-latest
     outputs:
       build-types: ${{ steps.set-matrix.outputs.build-types }}
@@ -59,9 +83,8 @@ jobs:
 
   call-build-tests:
     name: Build
-    uses: espressif/arduino-esp32/.github/workflows/build_tests.yml@master
+    uses: ./.github/workflows/tests_build.yml
     needs: gen-matrix
-    if: github.event.action != 'closed'
     strategy:
       matrix:
         type: ${{ fromJson(needs.gen-matrix.outputs.build-types) }}
@@ -72,11 +95,11 @@ jobs:
 
   call-hardware-tests:
     name: Hardware
-    uses: espressif/arduino-esp32/.github/workflows/hw.yml@master
+    uses: ./.github/workflows/tests_hw.yml
     needs: [gen-matrix, call-build-tests]
     if: |
       github.repository == 'espressif/arduino-esp32' &&
-      (github.event_name != 'pull_request_target' ||
+      (github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'hil_test'))
     strategy:
       fail-fast: false
@@ -87,26 +110,10 @@ jobs:
       type: ${{ matrix.type }}
       chip: ${{ matrix.chip }}
 
-  call-wokwi-tests:
-    name: Wokwi
-    uses: espressif/arduino-esp32/.github/workflows/wokwi.yml@master
-    needs: [gen-matrix, call-build-tests]
-    if: github.event.action != 'closed'
-    strategy:
-      fail-fast: false
-      matrix:
-        type: ${{ fromJson(needs.gen-matrix.outputs.wokwi-types) }}
-        chip: ['esp32', 'esp32s2', 'esp32s3', 'esp32c3', 'esp32c6', 'esp32h2']
-    secrets:
-      WOKWI_CLI_TOKEN: ${{ secrets.WOKWI_CLI_TOKEN }}
-    with:
-      type: ${{ matrix.type }}
-      chip: ${{ matrix.chip }}
-
   # This job is disabled for now
   call-qemu-tests:
     name: QEMU
-    uses: espressif/arduino-esp32/.github/workflows/qemu.yml@master
+    uses: ./.github/workflows/tests_qemu.yml
     needs: [gen-matrix, call-build-tests]
     if: false
     strategy:
@@ -118,78 +125,4 @@ jobs:
       type: ${{ matrix.type }}
       chip: ${{ matrix.chip }}
 
-  unit-test-results:
-    name: Unit Test Results
-    needs: [call-hardware-tests, call-wokwi-tests, call-qemu-tests]
-    if: always() && github.event_name == 'pull_request_target'
-    runs-on: ubuntu-latest
-    permissions:
-        checks: write
-        pull-requests: write
-    steps:
-      - name: Download and Extract HW Artifacts
-        uses: actions/download-artifact@v4
-        continue-on-error: true
-        with:
-          merge-multiple: true
-          pattern: tests-results-hw-*
-          path: ./results/hw
-
-      - name: Download and Extract Wokwi Artifacts
-        uses: actions/download-artifact@v4
-        continue-on-error: true
-        with:
-          merge-multiple: true
-          pattern: tests-results-wokwi-*
-          path: ./results/wokwi
-
-      - name: Download and Extract QEMU Artifacts
-        uses: actions/download-artifact@v4
-        continue-on-error: true
-        with:
-          merge-multiple: true
-          pattern: tests-results-qemu-*
-          path: ./results/qemu
-
-      - name: Publish Unit Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2
-        with:
-          commit: ${{ github.event.pull_request.head.sha || github.sha }}
-          files: ./results/**/*.xml
-  clean:
-    name: Clean objects
-    needs: unit-test-results
-    if: always()
-    permissions:
-      actions: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Clean up caches
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const ref = '${{ github.event.pull_request.number || github.ref }}';
-            const key_prefix = 'tests-' + ref + '-';
-
-            if ('${{ github.event_name }}' == 'pull_request_target' && '${{ github.event.action }}' != 'closed') {
-              console.log('Skipping cache cleanup for open PR');
-              return;
-            }
-
-            await github.paginate(github.rest.actions.getActionsCacheList, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              per_page: 100,
-              key: key_prefix
-            }).then(caches => {
-              if (caches) {
-                for (const cache of caches) {
-                  console.log(`Deleting cache: ${cache.key}`);
-                  github.rest.actions.deleteActionsCacheById({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    cache_id: cache.id
-                  });
-                }
-              }
-            });
+  # Wokwi tests are run after this workflow as it needs access to secrets

.github/workflows/build_tests.yml → .github/workflows/tests_build.yml

@@ -20,8 +20,8 @@ jobs:
       id: ${{ github.event.pull_request.number || github.ref }}-${{ github.event.pull_request.head.sha || github.sha }}-${{ inputs.chip }}-${{ inputs.type }}
     steps:
       - name: Check if already built
-        if: ${{ github.event.pull_request.number != null }}
         id: cache-build-binaries
+        if: github.event.pull_request.number != null
         uses: actions/cache/restore@v4
         with:
           key: tests-${{ env.id }}-bin
@@ -46,21 +46,6 @@ jobs:
       - name: Checkout user repository
         if: ${{ steps.check-build.outputs.enabled == 'true' }}
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          persist-credentials: false
-          sparse-checkout-cone-mode: false
-          sparse-checkout: |
-            /*
-            !.github
-
-      # To avoid giving unknown scripts elevated permissions, download them from the master branch
-      - name: Get CI scripts from master
-        if: ${{ steps.check-build.outputs.enabled == 'true' }}
-        run: |
-          mkdir -p .github
-          cd .github
-          curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github
 
       - name: Get libs cache
         uses: actions/cache@v4
@@ -83,7 +68,7 @@ jobs:
 
       - name: Upload ${{ inputs.chip }} ${{ inputs.type }} binaries as cache
         uses: actions/cache/save@v4
-        if: ${{ steps.check-build.outputs.enabled == 'true' }}
+        if: steps.check-build.outputs.enabled == 'true' && github.event.pull_request.number != null
         with:
           key: tests-${{ env.id }}-bin
           path: |

.github/workflows/hw.yml → .github/workflows/tests_hw.yml

@@ -22,9 +22,9 @@ jobs:
       image: python:3.10.1-bullseye
       options: --privileged
     steps:
-      - name: Check if already built
-        if: ${{ github.event.pull_request.number != null }}
+      - name: Check if already passed
         id: cache-results
+        if: github.event.pull_request.number != null
         uses: actions/cache/restore@v4
         with:
           key: tests-${{ env.id }}-results-hw
@@ -48,21 +48,6 @@ jobs:
       - name: Checkout user repository
         if: ${{ steps.check-tests.outputs.enabled == 'true' }}
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          persist-credentials: false
-          sparse-checkout-cone-mode: false
-          sparse-checkout: |
-            /*
-            !.github
-
-      # To avoid giving unknown scripts elevated permissions, download them from the master branch
-      - name: Get CI scripts from master
-        if: ${{ steps.check-tests.outputs.enabled == 'true' }}
-        run: |
-          mkdir -p .github
-          cd .github
-          curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github
 
       # setup-python currently only works on ubuntu images
       # - uses: actions/setup-python@v5
@@ -95,7 +80,7 @@ jobs:
 
       - name: Upload ${{ inputs.chip }} ${{ inputs.type }} hardware results as cache
         uses: actions/cache/save@v4
-        if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
+        if: steps.check-tests.outputs.enabled == 'true' && github.event.pull_request.number != null
         with:
           key: tests-${{ env.id }}-results-hw
           path: |

.github/workflows/qemu.yml → .github/workflows/tests_qemu.yml

@@ -18,9 +18,9 @@ jobs:
       QEMU_INSTALL_PATH: "$HOME"
     runs-on: ubuntu-latest
     steps:
-      - name: Check if already run
-        if: ${{ github.event.pull_request.number != null }}
+      - name: Check if already passed
         id: get-cache-results
+        if: github.event.pull_request.number != null
         uses: actions/cache/restore@v4
         with:
           key: tests-${{ env.id }}-results-qemu
@@ -97,7 +97,7 @@ jobs:
         with:
           path: |
             ~/qemu
-          key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/qemu.yml') }}
+          key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/tests_qemu.yml') }}
 
       - name: Download QEMU
         if: ${{ steps.cache-qemu.outputs.cache-hit != 'true' && steps.check-tests.outputs.enabled == 'true' }}
@@ -125,7 +125,7 @@ jobs:
 
       - name: Upload ${{ inputs.chip }} ${{ inputs.type }} QEMU results as cache
         uses: actions/cache/save@v4
-        if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
+        if: steps.check-tests.outputs.enabled == 'true' && github.event.pull_request.number != null
         with:
           key: tests-${{ env.id }}-results-qemu
           path: |