From 7bd80bec07d6a5d71c9c5fa7d1bb9b1b7d53b3be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Desbiens?=
 <frederic.desbiens@eclipse-foundation.org>
Date: Mon, 31 Aug 2026 15:37:23 -0400
Subject: [PATCH] Pinned the NUCLEO Renode download and cached every toolchain
 fetch

Two problems in the pipeline, one of them mine.

The NUCLEO Renode job fetched renode-latest.linux-portable.tar.gz with no
version pin and no checksum, while the PolarFire job three jobs above it
already pinned Renode 1.16.1 and verified its SHA256. That pin landed in #49,
so it was present in this file when #51 added the NUCLEO job; the new job was
modelled on an older copy of the PolarFire step rather than the current one.
The result was a suite whose emulator could change under it on any Renode
release, with nothing verifying what was downloaded. The NUCLEO job now uses
the same pinned, checksum-verified step as PolarFire. The checksum was
recomputed from the published artefact rather than copied on trust.

Separately, every run re-downloaded roughly a gigabyte: the xPack RISC-V
toolchain at ~414 MB and Renode at ~52 MB in each of two jobs. All three are
now restored by actions/cache, keyed on the pinned version so a future bump
invalidates the cache instead of silently serving the old one. This completes
what #53 started for the Arm toolchain.

Caching only makes sense because these are now pinned. Caching an unpinned
"latest" artefact would have frozen CI on whichever build happened to be
fetched first, turning a reproducibility gap into an invisible one.

All four jobs now follow the same shape: cache, install only on a cache miss,
then put the tool on PATH as a separate step so it runs on hit and miss alike.
The PolarFire job also gains a version-reporting step, matching the Arm job, so
the log records which compiler produced the ELF.

Verified both constructed download URLs resolve, and that the Renode 1.16.1
checksum matches the published artefact.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 74 ++++++++++++++++++++++++++++++++--------
 1 file changed, 59 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 602cf2d..721cdc2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,6 +21,12 @@ jobs:
     name: Build PolarFire SoC Icicle Kit (64-Bit RISC-V)
     runs-on: ubuntu-24.04
     timeout-minutes: 20
+
+    env:
+      XPACK_VERSION: 14.3.0-1
+      XPACK_TARBALL: xpack-riscv-none-elf-gcc-14.3.0-1-linux-x64.tar.gz
+      XPACK_SHA256: be1768ef22789f4d9c41384e0261996f51724b84c2efa940d975dd7d9938c726
+
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
@@ -32,18 +38,28 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y cmake ninja-build
 
-      - name: Install Pinned xPack RISC-V GCC 14.3.0
-        env:
-          XPACK_TARBALL: xpack-riscv-none-elf-gcc-14.3.0-1-linux-x64.tar.gz
-          XPACK_SHA256: be1768ef22789f4d9c41384e0261996f51724b84c2efa940d975dd7d9938c726
+      - name: Cache the xPack RISC-V toolchain
+        id: cache-xpack
+        uses: actions/cache@v4
+        with:
+          path: ~/riscv-gcc
+          key: xpack-riscv-none-elf-gcc-${{ env.XPACK_VERSION }}-linux-x64
+
+      - name: Install Pinned xPack RISC-V GCC
+        if: steps.cache-xpack.outputs.cache-hit != 'true'
         run: |
           set -euo pipefail
-          wget -q "https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v14.3.0-1/${XPACK_TARBALL}"
+          wget -q "https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v${XPACK_VERSION}/${XPACK_TARBALL}"
           echo "${XPACK_SHA256}  ${XPACK_TARBALL}" | sha256sum --check --strict
           mkdir -p $HOME/riscv-gcc
           tar -xzf "${XPACK_TARBALL}" -C $HOME/riscv-gcc --strip-components=1
           rm "${XPACK_TARBALL}"
-          echo "$HOME/riscv-gcc/bin" >> $GITHUB_PATH
+
+      - name: Put the RISC-V toolchain on PATH
+        run: echo "$HOME/riscv-gcc/bin" >> $GITHUB_PATH
+
+      - name: Report the toolchain version
+        run: riscv-none-elf-gcc --version
 
       - name: Build SampleX PolarFire Condition-Monitoring Demo
         run: |
@@ -67,6 +83,10 @@ jobs:
     runs-on: ubuntu-24.04
     # Backstop in case Renode itself wedges before the in-script deadline fires.
     timeout-minutes: 15
+    env:
+      RENODE_VERSION: 1.16.1
+      RENODE_SHA256: 1a532d4b5b82de0dd154970c401e0c7b0e498d17304b2cecc007e306c8f9617c
+
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
@@ -84,10 +104,15 @@ jobs:
           name: polarfire-demo-elf
           path: targets/Microchip/POLARFIRE_ICICLE_RENODE/build/app
 
+      - name: Cache the portable Renode environment
+        id: cache-renode
+        uses: actions/cache@v4
+        with:
+          path: ~/renode
+          key: renode-${{ env.RENODE_VERSION }}-linux-portable
+
       - name: Install Pinned Portable Renode Emulation Environment
-        env:
-          RENODE_VERSION: 1.16.1
-          RENODE_SHA256: 1a532d4b5b82de0dd154970c401e0c7b0e498d17304b2cecc007e306c8f9617c
+        if: steps.cache-renode.outputs.cache-hit != 'true'
         run: |
           set -euo pipefail
           TARBALL="renode-${RENODE_VERSION}.linux-portable.tar.gz"
@@ -96,7 +121,9 @@ jobs:
           mkdir -p $HOME/renode
           tar -xzf "${TARBALL}" -C $HOME/renode --strip-components=1
           rm "${TARBALL}"
-          echo "$HOME/renode" >> $GITHUB_PATH
+
+      - name: Put Renode on PATH
+        run: echo "$HOME/renode" >> $GITHUB_PATH
 
       - name: Run Deterministic Headless Renode Test
         run: |
@@ -174,6 +201,10 @@ jobs:
     name: Headless Renode Emulation & Assertion Test (NUCLEO-F401RE)
     needs: build-arm-nucleo
     runs-on: ubuntu-24.04
+    env:
+      RENODE_VERSION: 1.16.1
+      RENODE_SHA256: 1a532d4b5b82de0dd154970c401e0c7b0e498d17304b2cecc007e306c8f9617c
+
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
@@ -191,13 +222,26 @@ jobs:
           name: nucleo-f401re-demo-elf
           path: targets/STMicroelectronics/NUCLEO_F401RE/build/app
 
-      - name: Install Portable Renode Emulation Environment
+      - name: Cache the portable Renode environment
+        id: cache-renode
+        uses: actions/cache@v4
+        with:
+          path: ~/renode
+          key: renode-${{ env.RENODE_VERSION }}-linux-portable
+
+      - name: Install Pinned Portable Renode Emulation Environment
+        if: steps.cache-renode.outputs.cache-hit != 'true'
         run: |
-          wget -q https://builds.renode.io/renode-latest.linux-portable.tar.gz
+          set -euo pipefail
+          TARBALL="renode-${RENODE_VERSION}.linux-portable.tar.gz"
+          wget -q "https://github.com/renode/renode/releases/download/v${RENODE_VERSION}/${TARBALL}"
+          echo "${RENODE_SHA256}  ${TARBALL}" | sha256sum --check --strict
           mkdir -p $HOME/renode
-          tar -xzf renode-latest.linux-portable.tar.gz -C $HOME/renode --strip-components=1
-          rm renode-latest.linux-portable.tar.gz
-          echo "$HOME/renode" >> $GITHUB_PATH
+          tar -xzf "${TARBALL}" -C $HOME/renode --strip-components=1
+          rm "${TARBALL}"
+
+      - name: Put Renode on PATH
+        run: echo "$HOME/renode" >> $GITHUB_PATH
 
       - name: Run Deterministic Headless Renode Test
         run: |