Merged changes ahead of the v6.5.2.202603 release

.git-blame-ignore-revs

@@ -0,0 +1,62 @@
+# Commits that changed file headers, copyright lines or version constants across
+# the whole tree. They carry no behavioural change, so `git blame` should look
+# through them to the commit that last touched the code itself.
+#
+# GitHub applies this file automatically. To use it locally, run once:
+#
+#     git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# Add a commit here only when it is mechanical and repository-wide. A commit
+# that changes behaviour does not belong in this file, however large it is.
+
+# 2023-10-23  Update release version to 6.3.0 and date to 10-31-2023 (#308)
+# 1366 files
+13b700fd3ed763cedcba7dbd17b859077a01aa9c
+
+# 2024-01-29  Update copyright.
+# 3618 files
+8276bcf71142197e09551e29f1779299fa591ec7
+
+# 2024-01-30  Update version id string.
+# 1048 files
+3e1da1f0b0973e6b833b08b10fb27c7c718835b3
+
+# 2024-02-23  Update the copyright for all assembly files.
+# 798 files
+039a3463974f922f6dd6bfb8afb7ee2895eaebcf
+
+# 2024-02-27  Update version number to 6.4.1
+# 237 files
+27f0ce9ca2334b975c298fd00eac1bc05ecec1f7
+
+# 2025-02-24  Updated ports version to v6.4.2.
+# 235 files
+376e26be292f7d579091650a70b5670195240539
+
+# 2026-03-05  Updated copyright headers and version number constants (#509)
+# 5970 files
+c3259a216026372e3833dd8996a68f77e8595fbd
+
+# 2026-06-03  Release 6.5.1.202602 preparation (#543)
+# 204 files
+de1c6e9bbe13e2db480e4e0ed2d3589ebdd5db27
+
+# 2026-06-06  Added copyright headers to files missing them
+# 581 files
+730b61874bc5cf40768987605ae5187fde0fa1e2
+
+# 2026-06-08  Release 6.5.1.202602a preparation (#547)
+# 207 files
+df30b8b96e4c0c6d72e0bb80d2a2ec31666e5afe
+
+# 2026-09-15  Normalized the AI disclosure comment to one fixed line per file (#740)
+# 455 files
+9e4c57138dfa004cd512b60259c1c5047a8b3dd1
+
+# 2026-09-28  Normalized the AI disclosure comment and added a check that keeps it so (#762)
+# 158 files
+83361990cb4d03da8851e30030688ed3abb4d840
+
+# 2026-09-28  Updated ThreadX version constants and port strings to 6.5.2.202603 (#781)
+# 212 files
+a7ded6a3b9e12985a6c52af4df419d2326cccc0a

.github/dependabot.yml

@@ -0,0 +1,91 @@
+version: 2
+
+# Keeps the pinned action SHAs moving.
+#
+# Every action reference under .github/workflows is a 40-character commit SHA
+# with the version in a trailing comment. A SHA pin *without* this file is worse
+# than a floating tag: it freezes CI on whatever was current the day it was
+# written, which is how actions/cache@v1 came to sit in ci_cortex_m.yml until
+# GitHub started auto-failing every request that used it. Measured on
+# 2026-08-24, before the catch-up: download-artifact was four majors behind,
+# checkout and upload-artifact three each, cache and upload-pages-artifact two.
+# Nothing had ever reported that, because there was no configuration here -- nor
+# in netxduo, filex, guix or rtos-docs-asciidoc, so this file sets the pattern
+# rather than following one.
+#
+# Dependabot understands the SHA form and rewrites the trailing version comment
+# together with the pin, so the comment cannot drift away from the SHA it
+# describes. That is what keeps "which exact code ran in our CI" answerable from
+# the repository, which the SBOM and certification work needs on its own.
+#
+# Two things this does not fix. It reports drift, not silence: a workflow that
+# never triggers rots unnoticed no matter what is pinned in it, and the trigger
+# fixes in ci_cortex_m.yml and regression_test.yml are the cure for that. And it
+# does nothing at all until this file reaches the default branch -- see the note
+# on target-branch below.
+#
+# There is no entry for any other ecosystem, and that is a decision rather than
+# an oversight: the project forbids external dependencies, there are no
+# submodules, and the one pinned tool -- gcovr in scripts/install.sh -- lives in
+# a shell script that no Dependabot ecosystem can parse. That pin moves by hand.
+updates:
+  - package-ecosystem: "github-actions"
+    # "/" is the only accepted value for this ecosystem; it covers
+    # .github/workflows and .github/actions. The five reusable-workflow
+    # references in regression_test.yml are local paths
+    # (./.github/workflows/regression_template.yml) and are correctly left
+    # alone -- they carry no version to move.
+    directory: "/"
+
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+
+    # Dependabot reads this file from the repository's DEFAULT branch, which is
+    # master. But master is deliberately kept behind dev, and pull requests
+    # belong on dev, where the regression suites gate them. target-branch sends
+    # the pull requests to dev and makes Dependabot read the workflows it is
+    # updating from dev as well.
+    #
+    # The consequence to plan for: landing this file on dev arms it, it does not
+    # fire it. Nothing happens until a release merge carries it to master.
+    #
+    # Setting target-branch also opts out of Dependabot *security* updates,
+    # which only ever run against the default branch. For this ecosystem the
+    # cost is small -- an action advisory arrives as an ordinary version bump on
+    # the weekly run -- but it is a real trade and not a detail to rediscover
+    # later.
+    target-branch: "dev"
+
+    groups:
+      # Patch and minor arrive together in one pull request: they are the
+      # routine traffic, and reviewing them one at a time is how an update queue
+      # starts being ignored, which is the failure mode this file exists to
+      # prevent. Majors stay ungrouped, one pull request each, because every
+      # breaking change this repository has met in an action set has been a
+      # major -- download-artifact v8 defaulting digest-mismatch to error, and
+      # upload-artifact v6 requiring runner 2.327.1 or newer, are both from the
+      # last catch-up.
+      actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+    # Nine distinct third-party and first-party actions are in use. Dependabot's
+    # default limit of five would hold majors back with nothing saying that it
+    # had; ten leaves room for a wave without becoming a silent cap.
+    open-pull-requests-limit: 10
+
+    labels:
+      - "dependencies"
+
+    # Reviewers are not listed here. .github/CODEOWNERS already routes every
+    # path to @eclipse-threadx/admins and Dependabot honours it.
+    #
+    # Commit subjects are left at Dependabot's own "Bump x from a to b" wording.
+    # The project asks for a past-tense subject and still gets one: these pull
+    # requests are squash-merged, and the subject is set at that point.

.github/workflows/ci_cortex_m.yml

@@ -1,14 +1,31 @@
-# This is a basic workflow to help you get started with Actions
-
 name: cortex_m
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
+# Cross-compiles the Cortex-M ports with GCC.
+#
+# Two things were wrong with this workflow and both are fixed here.
+#
+# It ran on master only, for both push and pull_request, while dev is the
+# integration branch -- the same defect ports_arch_check.yml carries a comment
+# about, where it cost eight months of ports drifting unnoticed. So this
+# gated no pull request that anybody opened.
+#
+# And it had not compiled anything since at least 2026-06-08. Every run since
+# then failed in six to eight seconds, at "Prepare all required actions",
+# before checkout: GitHub automatically fails any request using
+# actions/cache@v1. Nobody noticed, because of the first defect.
+#
+# The toolchain setup now follows clang_check.yml rather than third party
+# actions: a pinned release fetched directly, verified against Arm's published
+# checksum, and cached with actions/cache@v4. That also moves the compiler
+# from 9-2019-q4 to a version matching the project's stated GCC 14 default.
+#
+# This covers four ports of the forty under ports/ that have a gnu directory.
+# Widening that to every Arm gnu port is separate work.
 on:
   push:
-    branches: [ master ]
+    branches: [ master, dev ]
   pull_request:
-    branches: [ master ]
+    branches: [ master, dev ]
     paths:
       - ".github/workflows/ci_cortex_m.yml"
       - 'common/**'
@@ -18,60 +35,79 @@ on:
       - 'ports/cortex_m4/gnu/**'
       - 'ports/cortex_m7/gnu/**'
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
   build:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     strategy:
+      fail-fast: false
       matrix:
         port: [0, 3, 4, 7]
 
     name: Cortex M${{ matrix.port }} build
 
-    # Steps represent a sequence of tasks that will be executed as part of the job
+    env:
+      # Pinned deliberately, as the runner image is: a toolchain upgrade should
+      # be a reviewable commit rather than something that changes underneath the
+      # ports. Releases: https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads
+      GCC_VERSION: 14.3.rel1
+      GCC_TARGET: arm-none-eabi
+
     steps:
-    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
 
-    # Store the arm compilers in the cache to speed up builds
-    - name: Cache arm-none-eabi-gcc tools
+    - name: Cache the Arm GNU toolchain
       id: cache-arm-gcc
-      uses: actions/cache@v1
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
-        path: $HOME/arm-none-eabi-gcc-9-2019-q4
-        key: ${{ runner.os }}-arm-gcc-9-2019-q4
+        path: toolchain
+        key: arm-gnu-toolchain-${{ env.GCC_VERSION }}-x86_64-${{ env.GCC_TARGET }}
 
-    # Get the arm-non-eabi-gcc toolchain
-    - name: Install arm-none-eabi-gcc
-      uses: fiam/arm-none-eabi-gcc@v1
+    - name: Install the Arm GNU toolchain
       if: steps.cache-arm-gcc.outputs.cache-hit != 'true'
-      with:
-          release: '9-2019-q4' # The arm-none-eabi-gcc release to use.
-          directory: $HOME/arm-none-eabi-gcc-9-2019-q4
+      run: |
+        set -eu
+        base="https://developer.arm.com/-/media/Files/downloads/gnu/${GCC_VERSION}/binrel"
+        archive="arm-gnu-toolchain-${GCC_VERSION}-x86_64-${GCC_TARGET}.tar.xz"
+        mkdir -p toolchain && cd toolchain
+        curl -fsSLO "$base/$archive"
+        curl -fsSLO "$base/$archive.sha256asc"
+        sha256sum -c "$archive.sha256asc"
+        tar xf "$archive"
+        rm -f "$archive"
 
-    # Get CMake into the environment
-    - name: Install cmake 3.19.1
-      uses: lukka/get-cmake@v3.19.1
+    - name: Put the toolchain on PATH
+      run: |
+        set -eu
+        echo "$GITHUB_WORKSPACE/toolchain/arm-gnu-toolchain-${GCC_VERSION}-x86_64-${GCC_TARGET}/bin" >> "$GITHUB_PATH"
 
-    # Get Ninja into the environment
-    - name: Install ninja-build
-      uses: seanmiddleditch/gha-setup-ninja@v3
+    # Only reaches apt if the runner image has stopped shipping ninja. This
+    # repository has already paid for unguarded apt calls: scripts/install.sh
+    # carries a long comment about apt-get update stalling for over two hours
+    # and taking whole regression runs with it. Do not turn this into an
+    # unconditional install.
+    - name: Ensure ninja is available
+      run: |
+        set -eu
+        if command -v ninja >/dev/null 2>&1; then
+          ninja --version
+        else
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ninja-build
+        fi
+
+    - name: Report the toolchain version
+      run: ${{ env.GCC_TARGET }}-gcc --version
 
-    # Prepare the build system
     - name: Prepare build system
       run: cmake -Bbuild -DCMAKE_TOOLCHAIN_FILE=./cmake/cortex_m${{ matrix.port }}.cmake -GNinja .
-      env:
-        PATH: "$HOME/arm-none-eabi-gcc-9-2019-q4/bin:$PATH"
 
     - name: Compile and link
       run: cmake --build ./build
-      env:
-        PATH: "$HOME/arm-none-eabi-gcc-9-2019-q4/bin:$PATH"
-
-

.github/workflows/clang_check.yml

@@ -0,0 +1,74 @@
+name: clang_check
+
+# Builds the Arm ports with Arm Toolchain for Embedded, which is LLVM based and
+# is the successor to Arm Compiler 6. The gnu ports are otherwise only ever
+# built with GNU tooling, and GNU as accepts several non-canonical forms that
+# LLVM's assembler rejects; this catches those before they accumulate.
+on:
+  pull_request:
+    branches: [ master, dev ]
+    paths:
+      - ".github/workflows/clang_check.yml"
+      - "scripts/check_clang.sh"
+      # CMakeLists.txt, cmake/ and common_smp/ were missing until 26 Aug 2026,
+      # so this check did not run when the files it reads changed. The
+      # ports_smp example builds compile common_smp/src and the CMake stage
+      # reads the toolchain file and the top-level project. utility/ is
+      # deliberately absent: the FreeRTOS and POSIX layers under it are not
+      # enabled by any target this workflow builds. Keep this list and
+      # gcc_check.yml's the same.
+      - "CMakeLists.txt"
+      - "cmake/**"
+      - "common/**"
+      # common_modules/ holds the portable module manager that the module
+      # manager stage compiles once per Arm module port -- the larger half of
+      # what that stage builds. Without it a change there leaves the stage
+      # unrun, which is the same "absent from the count reads as covered" the
+      # stage exists to close.
+      - "common_modules/**"
+      - "common_smp/**"
+      - "ports/**"
+      - "ports_arch/**"
+      - "ports_module/**"
+      - "ports_smp/**"
+
+jobs:
+  atfe:
+    runs-on: ubuntu-24.04
+
+    env:
+      # Pinned deliberately, as the runner image is: a toolchain upgrade should
+      # be a reviewable commit rather than something that changes underneath the
+      # ports. Releases: https://github.com/arm/arm-toolchain/releases
+      ATFE_VERSION: 22.1.0
+
+    steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
+    - name: Checkout sources
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Cache Arm Toolchain for Embedded
+      id: cache-atfe
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: atfe
+        key: atfe-${{ env.ATFE_VERSION }}-linux-x86_64
+
+    - name: Install Arm Toolchain for Embedded
+      if: steps.cache-atfe.outputs.cache-hit != 'true'
+      run: |
+        set -eu
+        base="https://github.com/arm/arm-toolchain/releases/download/release-${ATFE_VERSION}-ATfE"
+        archive="ATfE-${ATFE_VERSION}-Linux-x86_64.tar.xz"
+        mkdir -p atfe && cd atfe
+        curl -fsSLO "$base/$archive"
+        curl -fsSLO "$base/$archive.sha256"
+        sha256sum -c "$archive.sha256"
+        tar xf "$archive"
+        rm -f "$archive"
+
+    - name: Build the Arm ports with clang
+      run: scripts/check_clang.sh --clang "atfe/ATfE-${ATFE_VERSION}-Linux-x86_64/bin/clang"