build(core): add `secmon` to nightly Docker builds
What the developer wrote
Authored by Roman Zeyde
build(core): add `secmon` to nightly Docker builds
Also, build firmware in a separate step, since it may fail due to a missing signed secmon.
[no changelog]
What changed, and why it matters
This commit changes the nightly build workflow for Trezor hardware wallets. It adds a new build step for a component called 'secmon' (only for the T3W1 model), splits the build into separate steps, and collects build fingerprints into a dedicated folder. There is no indication this fixes or introduces a security vulnerability; it is a build-pipeline improvement.
No security action required. Treat as routine build-maintenance commit. Reviewers may optionally verify the secmon build ordering and artifact handling work as intended in CI.
Security signals we found
No security-relevant code changes in firmware or bootloader
CI/CD workflow reorganization only
New build target 'secmon' added for T3W1 model
No changelog entry explicitly marked [no changelog]
Evidence from the diff
The GitHub Actions workflow .github/workflows/common.yml is updated to build bootloader/prodtest, secmon (T3W1 only), and firmware in separate sequential steps. It introduces _fingerprints/ to collect .fingerprint artifacts and ensures the fingerprint summary step runs even if prior steps fail (if: always()). The comment notes T3W1 firmware requires a signed secmon, which is why secmon is built first. This is CI/CD hardening/organization, not a product security patch.
Changed components
.github/workflows/common.ymlInspect captured patch +29 / −8
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 5ae35132..63882bb2 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -111,22 +111,43 @@ jobs:
fail-fast: false
matrix:
model: [T1B1, T2T1, T2B1, T3B1, T3T1, T3W1]
+ env:
+ REF: ${{ github.head_ref || github.ref_name }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- - run: git checkout ${{ github.head_ref || github.ref_name }}
- - run: ./build-docker.sh --models ${{ matrix.model }} --targets bootloader,firmware,prodtest ${{ github.head_ref || github.ref_name }}
+
+ - run: git checkout ${REF}
+
+ - run: mkdir _fingerprints/
+
+ - name: Build prodtest & bootloader
+ run: |
+ ./build-docker.sh --models ${{ matrix.model }} --targets 'prodtest,bootloader' --skip-bitcoinonly ${REF}
+ cp -v --parents build/*/*/*.fingerprint _fingerprints/
+
+ - name: Build secmon
+ if: ${{ matrix.model == 'T3W1' }}
+ run: |
+ ./build-docker.sh --no-init --models ${{ matrix.model }} --targets 'secmon' --skip-bitcoinonly ${REF}
+ cp -v --parents build/*/*/*.fingerprint _fingerprints/
+
+ - name: Build firmware
+ # T3W1 requires a signed secmon.
+ run: |
+ ./build-docker.sh --no-init --models ${{ matrix.model }} --targets 'firmware' ${REF}
+ cp -v --parents build/*/*/*.fingerprint _fingerprints/
+
- name: Show fingerprints
run: |
- for file in build/*/*/*.fingerprint; do
- if [ -f "$file" ]; then
- origfile="${file%.fingerprint}"
- fingerprint=$(tr -d '\n' < $file)
- echo "\`$fingerprint\` $origfile" >> $GITHUB_STEP_SUMMARY
- fi
+ for file in _fingerprints/build/*/*/*.fingerprint
+ do
+ echo "\`$(tr -d '\n' < $file)\` ${file%.fingerprint}" >> $GITHUB_STEP_SUMMARY
done
cat $GITHUB_STEP_SUMMARY
+ if: always()
+
- uses: actions/upload-artifact@v4
with:
name: reproducible-${{ matrix.model }}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.