Merge remote-tracking branch 'origin/master' into develop

.github/workflows/docker_build.yml

@@ -56,6 +56,25 @@ jobs:
           echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
         id: version
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          cache-image: true
+
+      - name: Docker setup
+        uses: docker/setup-buildx-action@v4
+        with:
+          # Add Google/Amazon DockerHub mirrors to buildkit config
+          # https://docs.docker.com/build/ci/github-actions/configure-builder/#registry-mirror
+          buildkitd-config-inline: |
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io", "public.ecr.aws"]
+
+      - name: Sanitize platform string
+        id: sanitize_platform
+        # Replace slashes with underscores
+        run: echo "cleaned_platform=${{ inputs.platform }}" | sed 's/\//_/g' >> $GITHUB_OUTPUT
+
       - name: Docker login
         if: ${{ inputs.push }}
         uses: docker/login-action@v4
@@ -63,17 +82,6 @@ jobs:
           username: meshtastic
           password: ${{ secrets.DOCKER_FIRMWARE_TOKEN }}
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
-      - name: Docker setup
-        uses: docker/setup-buildx-action@v4
-
-      - name: Sanitize platform string
-        id: sanitize_platform
-        # Replace slashes with underscores
-        run: echo "cleaned_platform=${{ inputs.platform }}" | sed 's/\//_/g' >> $GITHUB_OUTPUT
-
       - name: Docker tag
         id: meta
         uses: docker/metadata-action@v6
@@ -95,3 +103,6 @@ jobs:
           platforms: ${{ inputs.platform }}
           build-args: |
             PIO_ENV=${{ inputs.pio_env }}
+          # Cache image layers in GitHub Actions cache to speed up subsequent builds.
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/models_issue_triage.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Apply quality label if needed
         if: steps.quality.outputs.response != '' && steps.quality.outputs.response != 'ok'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           QUALITY_LABEL: ${{ steps.quality.outputs.response }}
         with:
@@ -80,7 +80,7 @@ jobs:
       # ─────────────────────────────────────────────────────────────────────────
       - name: Determine if completeness check should be skipped
         if: steps.quality.outputs.response == 'ok' || steps.quality.outputs.response == ''
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         id: check-skip
         with:
           script: |
@@ -134,7 +134,7 @@ jobs:
 
       - name: Process analysis result
         if: (steps.quality.outputs.response == 'ok' || steps.quality.outputs.response == '') && steps.check-skip.outputs.should_skip != 'true' && steps.analysis.outputs.response != ''
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         id: process
         env:
           AI_RESPONSE: ${{ steps.analysis.outputs.response }}
@@ -174,7 +174,7 @@ jobs:
 
       - name: Apply triage label
         if: steps.process.outputs.label != '' && steps.process.outputs.label != 'none'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           LABEL_NAME: ${{ steps.process.outputs.label }}
         with:
@@ -200,7 +200,7 @@ jobs:
 
       - name: Comment on issue
         if: steps.process.outputs.should_comment == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           COMMENT_BODY: ${{ steps.process.outputs.comment_body }}
         with:

.github/workflows/models_pr_triage.yml

@@ -22,7 +22,7 @@ jobs:
       # Step 1: Check if PR already has automation/type labels (skip if so)
       # ─────────────────────────────────────────────────────────────────────────
       - name: Check existing labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         id: check-labels
         with:
           script: |
@@ -58,7 +58,7 @@ jobs:
 
       - name: Apply quality label if needed
         if: steps.check-labels.outputs.skip_all != 'true' && steps.quality.outputs.response != '' && steps.quality.outputs.response != 'ok'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         id: quality-label
         env:
           QUALITY_LABEL: ${{ steps.quality.outputs.response }}
@@ -113,7 +113,7 @@ jobs:
 
       - name: Apply type label
         if: steps.check-labels.outputs.skip_all != 'true' && steps.check-labels.outputs.has_type_label != 'true' && steps.classify.outputs.response != ''
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           TYPE_LABEL: ${{ steps.classify.outputs.response }}
         with:

.github/workflows/package_ppa.yml

@@ -5,6 +5,8 @@ on:
     secrets:
       PPA_GPG_PRIVATE_KEY:
         required: true
+      PPA_SFTP_PRIVATE_KEY:
+        required: true
     inputs:
       ppa_repo:
         description: Meshtastic PPA to target
@@ -27,6 +29,7 @@ jobs:
       build_location: ppa
 
   package-ppa:
+    if: ${{ github.event_name != 'pull_request_target' && github.event_name != 'pull_request' }}
     runs-on: ubuntu-24.04
     needs: build-debian-src
     steps:
@@ -40,7 +43,7 @@ jobs:
         shell: bash
         run: |
           sudo apt-get update -y --fix-missing
-          sudo apt-get install -y dput
+          sudo apt-get install -y dput openssh-client
 
       - name: Import GPG key
         uses: crazy-max/ghaction-import-gpg@v7
@@ -65,8 +68,42 @@ jobs:
       - name: Display structure of downloaded files
         run: ls -lah
 
-      - name: Publish with dput
-        if: ${{ github.event_name != 'pull_request_target' && github.event_name != 'pull_request' }}
-        timeout-minutes: 15 # dput is terrible, sometimes runs 'forever'
+      - name: Trust Launchpad's SSH key
         run: |
-          dput ${{ inputs.ppa_repo }} meshtasticd_${{ steps.version.outputs.deb }}~${{ inputs.series }}_source.changes
+          mkdir -p ~/.ssh
+          ssh-keyscan -H ppa.launchpad.net >> ~/.ssh/known_hosts
+
+      - name: Setup dput config
+        env:
+          ppa_login: meshtasticorg
+        run: |
+          sudo tee /etc/meshtastic-dput.cf >/dev/null <<EOF
+          [ppa]
+          fqdn                    = ppa.launchpad.net
+          method                  = ftp
+          incoming                = ~%(ppa)s
+          login                   = anonymous
+
+          [ssh-ppa]
+          fqdn                    = ppa.launchpad.net
+          method                  = sftp
+          incoming                = ~%(ssh-ppa)s
+          login                   = ${ppa_login}
+          EOF
+
+      - name: Import SSH key
+        uses: webfactory/ssh-agent@v0.10.0
+        with:
+          ssh-private-key: ${{ secrets.PPA_SFTP_PRIVATE_KEY }}
+        id: ssh
+
+      - name: Publish with dput (sftp)
+        timeout-minutes: 30 # dput is terrible, sometimes runs 'forever'
+        env:
+          up_ppa_repo: ${{ inputs.ppa_repo }}
+          up_series: ${{ inputs.series }}
+          up_version: ${{ steps.version.outputs.deb }}
+        run: >
+          dput -c /etc/meshtastic-dput.cf
+          ssh-${up_ppa_repo}
+          meshtasticd_${up_version}~${up_series}_source.changes

.github/workflows/pr_enforce_labels.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check for PR labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const labels = context.payload.pull_request.labels.map(label => label.name);

.github/workflows/pr_tests.yml

@@ -177,7 +177,7 @@ jobs:
 
       - name: Comment test results on PR
         if: github.event_name == 'pull_request' && needs.native-tests.result != 'skipped'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');