What changed, and why it matters
This commit only updates Trezor's internal continuous-integration (CI) hardware-test configuration. It adds two new physical device models (T3B1 and T3W1) to the automated test runner list and tells the test harness how to label them during firmware flashing. There is no change to the firmware code that runs on users' devices, no change to cryptographic handling, and no security fix or vulnerability present in the diff.
No security action required. Treat as routine CI/infrastructure maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies .github/workflows/core-hw.yml and ci/hardware_tests/bootstrap.py. It expands the GitHub Actions matrix to include T3B1 and T3W1 hardware runners, maps those models to self-hosted runner labels (hw-t3b1, hw-t3w1), adds a DISABLE_TROPIC=1 environment variable for tests, and teaches the bootstrap script to flash T3B1 as ‘Safe 3’ and T3W1 as ‘Safe 7’. These are purely infrastructure/test-orchestration changes.
Changed components
.github/workflows/core-hw.ymlci/hardware_tests/bootstrap.pyInspect captured patch +10 / −5
diff --git a/.github/workflows/core-hw.yml b/.github/workflows/core-hw.yml
index 189c8486..872b9da4 100644
--- a/.github/workflows/core-hw.yml
+++ b/.github/workflows/core-hw.yml
@@ -23,11 +23,11 @@ jobs:
runs-on:
- self-hosted
# FIXME runner4 with t2b1 does not work at the moment
- - ${{ matrix.model == 'T2B1' && 'runner3' || matrix.model == 'T3T1' && 'hw-t3t1' || 'hw-t2t1' }}
+ - ${{ matrix.model == 'T2B1' && 'runner3' || matrix.model == 'T3T1' && 'hw-t3t1' || matrix.model == 'T3B1' && 'hw-t3b1' || matrix.model == 'T3W1' && 'hw-t3w1' || 'hw-t2t1' }}
strategy:
fail-fast: false
matrix:
- model: [T2T1, T2B1, T3T1]
+ model: [T2T1, T2B1, T3B1, T3T1, T3W1]
coins: [universal, btconly]
env:
TREZOR_MODEL: ${{ matrix.model }}
@@ -35,6 +35,7 @@ jobs:
PYTEST_TIMEOUT: 600 # 10m single test timeout
PYOPT: 0
DISABLE_OPTIGA: 1
+ DISABLE_TROPIC: 1
STORAGE_INSECURE_TESTING_MODE: 1
BOOTLOADER_DEVEL: ${{ matrix.model == 'T2T1' && '0' || '1' }}
# TODO: enable SD-related tests after fixing #4924
@@ -76,17 +77,19 @@ jobs:
runs-on:
- self-hosted
# FIXME runner4 with t2b1 does not work at the moment
- - ${{ matrix.model == 'T2B1' && 'runner3' || matrix.model == 'T3T1' && 'hw-t3t1' || 'hw-t2t1' }}
+ - ${{ matrix.model == 'T2B1' && 'runner3' || matrix.model == 'T3T1' && 'hw-t3t1' || matrix.model == 'T3B1' && 'hw-t3b1' || matrix.model == 'T3W1' && 'hw-t3w1' || 'hw-t2t1' }}
if: false # FIXME https://github.com/trezor/trezor-firmware/issues/3128
strategy:
fail-fast: false
matrix:
- model: [T2T1, T2B1, T3T1]
+ model: [T2T1, T2B1, T3B1, T3T1, T3W1]
env:
TREZOR_MODEL: ${{ matrix.model }}
PYTEST_TIMEOUT: 1200
PYOPT: 0
DISABLE_OPTIGA: 1
+ DISABLE_TROPIC: 1
+ STORAGE_INSECURE_TESTING_MODE: 1
BOOTLOADER_DEVEL: ${{ matrix.model == 'T2T1' && '0' || '1' }}
TT_UHUB_PORT: all
steps:
diff --git a/ci/hardware_tests/bootstrap.py b/ci/hardware_tests/bootstrap.py
index cdadf05f..89bf81aa 100755
--- a/ci/hardware_tests/bootstrap.py
+++ b/ci/hardware_tests/bootstrap.py
@@ -23,10 +23,12 @@ def main(model: str, file: str = None):
elif model == "T2T1":
# t1.power_off()
path = tt.update_firmware(file, "Trezor T")
- elif model == "T2B1":
+ elif model in ("T2B1", "T3B1"):
path = tt.update_firmware(file, "Safe 3")
elif model == "T3T1":
path = tt.update_firmware(file, "Safe 5")
+ elif model == "T3W1":
+ path = tt.update_firmware(file, "Safe 7")
else:
raise ValueError("Unknown Trezor model.")
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.