ci: collect reproducible build artifacts
What the developer wrote
Authored by Roman Zeyde
ci: collect reproducible build artifacts
[no changelog]
What changed, and why it matters
This commit changes the Trezor firmware CI pipeline so that build artifacts (not just small fingerprint files) are collected and uploaded after reproducible builds. It is a workflow/infrastructure change with no visible effect on the firmware code, device behavior, or security of the product itself.
No security action required. Treat as routine CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The GitHub Actions workflow .github/workflows/common.yml is updated to copy the entire build/ directory tree into _artifacts/ instead of only *.fingerprint files, and to upload _artifacts/ as the workflow artifact. The reproducible build fingerprints are still computed and displayed. No source code, build scripts, cryptographic checks, or firmware logic are modified.
Changed components
.github/workflows/common.ymlInspect captured patch +7 / −6
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 63882bb2..817444a8 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -120,28 +120,29 @@ jobs:
- run: git checkout ${REF}
- - run: mkdir _fingerprints/
+ - run: mkdir _artifacts/
- name: Build prodtest & bootloader
run: |
./build-docker.sh --models ${{ matrix.model }} --targets 'prodtest,bootloader' --skip-bitcoinonly ${REF}
- cp -v --parents build/*/*/*.fingerprint _fingerprints/
+ cd build/ && cp -v --recursive --parents * ../_artifacts/
- name: Build secmon
if: ${{ matrix.model == 'T3W1' }}
run: |
./build-docker.sh --no-init --models ${{ matrix.model }} --targets 'secmon' --skip-bitcoinonly ${REF}
- cp -v --parents build/*/*/*.fingerprint _fingerprints/
+ cd build/ && cp -v --recursive --parents * ../_artifacts/
- name: Build firmware
# T3W1 requires a signed secmon.
run: |
./build-docker.sh --no-init --models ${{ matrix.model }} --targets 'firmware' ${REF}
- cp -v --parents build/*/*/*.fingerprint _fingerprints/
+ cd build/ && cp -v --recursive --parents * ../_artifacts/
- name: Show fingerprints
run: |
- for file in _fingerprints/build/*/*/*.fingerprint
+ tree _artifacts
+ for file in _artifacts/*/*/*.fingerprint
do
echo "\`$(tr -d '\n' < $file)\` ${file%.fingerprint}" >> $GITHUB_STEP_SUMMARY
done
@@ -152,5 +153,5 @@ jobs:
with:
name: reproducible-${{ matrix.model }}
path: |
- build/*/*/*.bin
+ _artifacts/
retention-days: 7
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.