ZMK Upstream Rebase (Zephyr 4.1 update)

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/zmkfirmware/zmk-dev-arm:3.5
+FROM docker.io/zmkfirmware/zmk-dev-arm:4.1-branch
 
 COPY .bashrc tmp
 RUN mv /tmp/.bashrc ~/.bashrc

.gitattributes

@@ -4,3 +4,4 @@
 # Docker on Windows.
 .bashrc text eol=lf
 *.sh text eol=lf
+*.nix text eol=lf

.github/workflows/ble-test.yml

@@ -35,7 +35,7 @@ jobs:
         test: ${{ fromJSON(needs.collect-tests.outputs.test-dirs) }}
     runs-on: ubuntu-latest
     container:
-      image: docker.io/zmkfirmware/zmk-build-arm:3.5
+      image: docker.io/zmkfirmware/zmk-build-arm:4.1
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/build-container.yml

@@ -0,0 +1,111 @@
+name: Build Compiler Service Container
+
+on:
+  push:
+    tags:
+      - "*"
+  pull_request_target:
+    branches:
+      - main
+
+jobs:
+  build:
+    # This job must never be run on a PR from outside the same repository
+    if: github.repository == 'moergo-sc/zmk' && (github.event.pull_request == null || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      ECR_REPOSITORY: zmk-builder-lambda
+      VERSIONS_BUCKET: glove80firmwarepipelines-compilerversionsbucket44-zubaquiyjdam
+      UPDATE_COMPILER_VERSIONS_FUNCTION: arn:aws:lambda:us-east-1:431227615537:function:Glove80FirmwarePipelineSt-UpdateCompilerVersions2A-CNxPOHb4VSuV
+      REVISION_TAG: ${{ github.event.pull_request && github.event.pull_request.head.sha || github.sha  }}
+      PR_NUMBER: ${{ github.event.number }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: moergo-sc/zmk
+          ref: ${{ github.event.pull_request && github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::431227615537:role/GithubCompilerLambdaBuilder
+          aws-region: us-east-1
+      - name: Extract container name from branch name
+        shell: bash
+        run: |
+          if [ "$GITHUB_HEAD_REF" ]; then
+            branch_ref="$GITHUB_HEAD_REF"
+            type="pr"
+            tag="pr${PR_NUMBER}.${GITHUB_HEAD_REF}"
+          elif [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            branch_ref="$GITHUB_REF"
+            type="tag"
+            tag="${GITHUB_REF#refs/tags/}"
+          else
+            echo "Not a pull request or release tag" >&2
+            exit 1
+          fi
+          # Replace / with . in container tag names
+          tag="${tag//\//.}"
+          echo "VERSION_BRANCH=${branch_ref}" >> $GITHUB_ENV
+          echo "VERSION_TYPE=${type}" >> $GITHUB_ENV
+          echo "VERSION_NAME=${tag}" >> $GITHUB_ENV
+        id: extract_name
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+      - uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-22.05
+      - uses: cachix/cachix-action@v15
+        with:
+          name: moergo-glove80-zmk-dev
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+      - name: Build lambda image
+        run: nix-build release.nix --arg revision "\"${REVISION_TAG}\"" --arg firmwareVersion "\"${VERSION_NAME}\"" -A lambdaImage -o lambdaImage
+      - name: Import OCI image into docker-daemon
+        env:
+          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: nix shell -f nix/pinned-nixpkgs.nix skopeo -c skopeo --insecure-policy copy oci:lambdaImage docker-daemon:$REGISTRY/$ECR_REPOSITORY:$REVISION_TAG
+      - name: Push container image to Amazon ECR
+        env:
+          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: docker push $REGISTRY/$ECR_REPOSITORY:$REVISION_TAG
+      - name: Create JSON metadata to represent the built container
+        env:
+          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        shell: bash
+        run: |
+          digest="$(docker inspect --format='{{index .RepoDigests 0}}' $REGISTRY/$ECR_REPOSITORY:$REVISION_TAG)"
+          digest="${digest##*@}"
+          api_version="$(cat lambda/api_version.txt)"
+          timestamp="$(date -u +"%Y%m%d.%H%M%S")"
+
+          if [ "$VERSION_TYPE" = "pr" ]; then
+             release_name="$VERSION_NAME+$timestamp"
+          else
+             release_name="$VERSION_NAME"
+          fi
+
+          jq -n '$ARGS.named' \
+            --arg name         "$release_name" \
+            --arg version_name "$VERSION_NAME" \
+            --arg revision     "$REVISION_TAG" \
+            --arg release_time "$timestamp" \
+            --arg branch       "$VERSION_BRANCH" \
+            --arg digest       "$digest" \
+            --arg api_version  "$api_version" \
+            --argjson boards   '["glove80", "go60"]' \
+            > "/tmp/$VERSION_NAME.json"
+      - name: Upload image metadata file to versions bucket
+        run: aws s3 cp "/tmp/$VERSION_NAME.json" "s3://$VERSIONS_BUCKET/images/$VERSION_NAME.json"
+      - name: Notify the build pipeline that the compile containers have updated
+        run: >-
+          aws lambda invoke --function-name $UPDATE_COMPILER_VERSIONS_FUNCTION
+          --invocation-type Event
+          --cli-binary-format raw-in-base64-out
+          /dev/null

.github/workflows/build-user-config.yml

@@ -49,6 +49,12 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJson(needs.matrix.outputs.build_matrix) }}
     steps:
+      - name: Act Workaround # https://github.com/nektos/act/issues/973
+        if: ${{ env.ACT }}
+        run: |
+          apt-get update && apt-get install -y curl unzip
+          curl -fsSL https://deb.nodesource.com/setup_22.x | bash && apt install -y nodejs
+
       - name: Checkout
         uses: actions/checkout@v4
 
@@ -57,7 +63,7 @@ jobs:
           echo "build_dir=$(mktemp -d)" >> $GITHUB_ENV
 
       - name: Prepare variables
-        shell: sh -x {0}
+        shell: bash -x {0}
         env:
           board: ${{ matrix.board }}
           shield: ${{ matrix.shield }}
@@ -81,7 +87,7 @@ jobs:
           echo "extra_west_args=${extra_west_args}" >> $GITHUB_ENV
           echo "extra_cmake_args=${shield:+-DSHIELD=\"$shield\"}${zmk_load_arg}" >> $GITHUB_ENV
           echo "display_name=${shield:+$shield - }${board}" >> $GITHUB_ENV
-          echo "artifact_name=${artifact_name:-${shield:+$shield-}${board}-zmk}" >> $GITHUB_ENV
+          echo "artifact_name=${artifact_name:-${shield:+$shield-}${board//\//_}-zmk}" >> $GITHUB_ENV
 
       - name: Copy config files to isolated temporary directory
         run: |
@@ -116,6 +122,13 @@ jobs:
         working-directory: ${{ env.base_dir }}
         run: west update --fetch-opt=--filter=tree:0
 
+      - name: Check ZMK revision
+        working-directory: ${{ env.base_dir }}
+        run: |
+          zmk_revision=$(west list -f "{revision}" zmk)
+          echo "zmk_revision=${zmk_revision}" >> $GITHUB_ENV
+          echo "ZMK revision: ${zmk_revision}"
+
       - name: West Zephyr export
         working-directory: ${{ env.base_dir }}
         run: west zephyr-export
@@ -125,6 +138,15 @@ jobs:
         shell: sh -x {0}
         run: west build -s zmk/app -d "${{ env.build_dir }}" -b "${{ matrix.board }}" ${{ env.extra_west_args }} -- -DZMK_CONFIG=${{ env.base_dir }}/${{ inputs.config_path }} ${{ env.extra_cmake_args }} ${{ matrix.cmake-args }}
 
+      - name: Warn about building from main if build fails
+        if: failure() && env.zmk_revision == 'main'
+        run: |
+          echo "# Consider Pinning ZMK" >> $GITHUB_STEP_SUMMARY
+          echo "Your recent build failure might be the result of breaking changes made to ZMK's main branch." >> $GITHUB_STEP_SUMMARY
+          echo "Consider [pinning your ZMK version](https://zmk.dev/blog/2025/06/20/pinned-zmk) to a release for increased stability." >> $GITHUB_STEP_SUMMARY
+          echo "See also the [list of released versions](https://github.com/zmkfirmware/zmk/releases)." >> $GITHUB_STEP_SUMMARY
+          echo "If you wish to stay on main, check the most recent pending release PR for breaking changes. [Our blog](https://zmk.dev/blog) may have upgrade information if breaking changes are significant." >> $GITHUB_STEP_SUMMARY
+
       - name: ${{ env.display_name }} Kconfig file
         run: |
           if [ -f "${{ env.build_dir }}/zephyr/.config" ]

.github/workflows/build.yml

@@ -20,10 +20,10 @@ permissions: {}
 
 jobs:
   build:
-    if: ${{ always() }}
+    if: ${{ false }}
     runs-on: ubuntu-latest
     container:
-      image: docker.io/zmkfirmware/zmk-build-arm:3.5
+      image: docker.io/zmkfirmware/zmk-build-arm:4.1
     needs: compile-matrix
     strategy:
       matrix:
@@ -123,7 +123,7 @@ jobs:
                 }
 
                 const cmakeName = shieldArgs['cmake-args'] ? '-' + (shieldArgs.nickname || shieldArgs['cmake-args'].split(' ').join('')) : '';
-                const artifactName = `${{ matrix.board }}${shieldArgs.shield ? '-' + shieldArgs.shield : ''}${cmakeName}-zmk`;
+                const artifactName = `${{ matrix.board }}${shieldArgs.shield ? '-' + shieldArgs.shield : ''}${cmakeName}-zmk`.replaceAll('/', '_');
 
                 await artifact.uploadArtifact(artifactName, files, rootDirectory, options);
               } catch (e) {
@@ -139,7 +139,7 @@ jobs:
               throw new Error('Failed to build one or more configurations');
             }
   compile-matrix:
-    if: ${{ !cancelled() }}
+    if: ${{ false && !cancelled() }}
     runs-on: ubuntu-latest
     needs: [core-coverage, board-changes, nightly]
     outputs:
@@ -180,7 +180,7 @@ jobs:
               shieldArgs: JSON.stringify(shieldArgs),
             }));
   core-coverage:
-    if: ${{ needs.get-changed-files.outputs.core-changes == 'true' }}
+    if: ${{ false && needs.get-changed-files.outputs.core-changes == 'true' }}
     runs-on: ubuntu-latest
     needs: get-changed-files
     outputs:
@@ -211,7 +211,7 @@ jobs:
 
             return [...include, ...coreCoverage.include];
   board-changes:
-    if: ${{ needs.get-changed-files.outputs.board-changes == 'true' }}
+    if: ${{ false && needs.get-changed-files.outputs.board-changes == 'true' }}
     runs-on: ubuntu-latest
     needs: [get-grouped-hardware, get-changed-files]
     outputs:
@@ -295,7 +295,7 @@ jobs:
               });
             }))).flat();
   nightly:
-    if: ${{ github.event_name == 'schedule' && github.repository_owner == 'zmkfirmware' }}
+    if: ${{ false && github.event_name == 'schedule' && github.repository_owner == 'zmkfirmware' }}
     runs-on: ubuntu-latest
     needs: get-grouped-hardware
     outputs:
@@ -340,6 +340,7 @@ jobs:
 
             return [...includeOnboard, ...includeInterconnect];
   get-grouped-hardware:
+    if: ${{ false }}
     runs-on: ubuntu-latest
     outputs:
       organized-metadata: ${{ steps.organize-metadata.outputs.result }}
@@ -419,7 +420,7 @@ jobs:
             return JSON.stringify(grouped).replace(/\\/g,"\\\\").replace(/`/g,"\\`");
           result-encoding: string
   get-changed-files:
-    if: ${{ github.event_name != 'schedule' }}
+    if: ${{ false && github.event_name != 'schedule' }}
     runs-on: ubuntu-latest
     outputs:
       changed-files: ${{ steps.changed-files.outputs.all_changed_files }}

.github/workflows/cleanup-container.yml

@@ -0,0 +1,43 @@
+name: Clean up PR Compiler Service Container
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+
+jobs:
+  build:
+    if: github.repository == 'moergo-sc/zmk'
+    runs-on: ubuntu-latest
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      ECR_REPOSITORY: zmk-builder-lambda
+      VERSIONS_BUCKET: glove80firmwarepipelines-compilerversionsbucket44-zubaquiyjdam
+      UPDATE_COMPILER_VERSIONS_FUNCTION: arn:aws:lambda:us-east-1:431227615537:function:Glove80FirmwarePipelineSt-UpdateCompilerVersions2A-CNxPOHb4VSuV
+      PR_NUMBER: ${{ github.event.number }}
+    steps:
+      - name: Extract image tag name
+        shell: bash
+        run: |
+          tag="pr${PR_NUMBER}.${GITHUB_HEAD_REF}"
+          # Replace / with . in container tag names
+          tag="${tag//\//.}"
+          echo "VERSION_NAME=${tag}" >> $GITHUB_ENV
+        id: extract_name
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::431227615537:role/GithubCompilerLambdaBuilder
+          aws-region: us-east-1
+      - name: Delete the image metadata file from the versions s3 bucket
+        run: aws s3 rm s3://$VERSIONS_BUCKET/images/$VERSION_NAME.json
+      - name: Notify the build pipeline that the compile containers have updated
+        run: >-
+          aws lambda invoke --function-name $UPDATE_COMPILER_VERSIONS_FUNCTION
+          --invocation-type Event
+          --cli-binary-format raw-in-base64-out
+          /dev/null

.github/workflows/hardware-metadata-validation.yml

@@ -18,7 +18,7 @@ jobs:
   validate-metadata:
     runs-on: ubuntu-latest
     container:
-      image: docker.io/zmkfirmware/zmk-dev-arm:3.5
+      image: docker.io/zmkfirmware/zmk-dev-arm:4.1
     steps:
       - uses: actions/checkout@v4
       - name: Install dependencies

.github/workflows/nix-build.yml

@@ -0,0 +1,71 @@
+name: Build Firmware
+
+on:
+  push:
+    paths:
+      - ".github/workflows/nix-build.yml"
+      - "default.nix"
+      - "app/**"
+      - "nix/**"
+    branches:
+      - "**"
+    tags:
+      - "**"
+  pull_request:
+    paths:
+      - ".github/workflows/nix-build.yml"
+      - "default.nix"
+      - "app/**"
+      - "nix/**"
+
+jobs:
+  build:
+    name: Build Firmware
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        board:
+          - glove80
+          - go60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-22.05
+      - uses: cachix/cachix-action@v15
+        with:
+          name: moergo-glove80-zmk-dev
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipPush: "${{ github.repository != 'moergo-sc/zmk' }}"
+      - name: Build ${{ matrix.board }} combined firmware
+        run: nix-build -A ${{matrix.board}}_combined -o combined
+      - name: Copy result out of nix store
+        run: cp combined/${{matrix.board}}.uf2 ${{matrix.board}}.uf2
+      - name: Upload result
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{matrix.board}}.uf2
+          path: ${{matrix.board}}.uf2
+  release:
+    name: Create Release for Tag
+    if: >-
+      github.repository == 'moergo-sc/zmk'
+      && github.event_name == 'push'
+      && contains(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download Glove80 firmware artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: glove80.uf2
+      - name: Download Go60 firmware artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: go60.uf2
+      - name: Create Release for Tag
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: "glove80.uf2,go60.uf2"
+          artifactErrorsFailBuild: true
+          generateReleaseNotes: true