ci: clone coldcard repo only once

Co-Authored-By: GPT-5 (Preview) <[email protected]>

Author: Sjors

.github/actions/install-sim/action.yml

@@ -18,14 +18,25 @@ runs:
         apt-get install -y libsdl2-image-2.0-0 libusb-1.0-0
         tar -xvf trezor-firmware.tar.gz
 
+    # Coldcard: download seeded firmware (seed job must run earlier)
+    - name: Download seeded Coldcard firmware
+      if: inputs.device == 'coldcard'
+      uses: actions/download-artifact@v4
+      with:
+        name: coldcard-firmware-src
+        path: test/work/firmware
+
     - if: inputs.device == 'coldcard'
       shell: bash
       run: |
         apt-get update
         apt-get install -y libpcsclite-dev libusb-1.0-0 swig
         git config --global user.email "[email protected]"
         git config --global user.name "ci"
-        pushd test/work; git clone --recursive https://github.com/Coldcard/firmware.git; popd
+        pushd test/work
+        if [ ! -d "firmware" ]; then
+          git clone --recursive https://github.com/Coldcard/firmware.git
+        popd
         tar -xvf coldcard-mpy.tar.gz
         pushd test/work/firmware; git am ../../data/coldcard-multisig.patch; popd
         poetry run pip install -r test/work/firmware/requirements.txt

.github/workflows/ci.yml

@@ -118,15 +118,23 @@ jobs:
       # binaries compatible with Debian Bookworm (glibc 2.36) Python containers.
       # Trezor T binaries don't need this.
       runs-on: ubuntu-22.04
+      ref: ${{ github.sha }}
 
+  coldcard-firmware-seed:
+    uses: ./.github/workflows/coldcard-firmware-seed.yml
+    with:
+      ref: ${{ github.sha }}
+
+  # Use the generic sim-builder with a Coldcard seed dependency
   sim-builder-coldcard:
     name: Coldcard sim builder
-    needs: prepare-sim-matrices
+    needs: [prepare-sim-matrices, coldcard-firmware-seed]
     uses: ./.github/workflows/sim-builder.yml
     with:
       sim: coldcard
       include: ${{ needs.prepare-sim-matrices.outputs.coldcard }}
       runs-on: ubuntu-22.04
+      ref: ${{ github.sha }}
 
   sim-builder-bitbox:
     name: Bitbox sim builder
@@ -136,6 +144,7 @@ jobs:
       sim: bitbox
       include: ${{ needs.prepare-sim-matrices.outputs.bitbox }}
       runs-on: ubuntu-latest
+      ref: ${{ github.sha }}
 
   sim-builder-jade:
     name: Jade sim builder
@@ -145,6 +154,7 @@ jobs:
       sim: jade
       include: ${{ needs.prepare-sim-matrices.outputs.jade }}
       runs-on: ubuntu-latest
+      ref: ${{ github.sha }}
 
   sim-builder-ledger:
     name: Ledger sim builder
@@ -154,6 +164,7 @@ jobs:
       sim: ledger
       include: ${{ needs.prepare-sim-matrices.outputs.ledger }}
       runs-on: ubuntu-latest
+      ref: ${{ github.sha }}
 
   sim-builder-keepkey:
     name: Keepkey sim builder
@@ -163,6 +174,7 @@ jobs:
       sim: keepkey
       include: ${{ needs.prepare-sim-matrices.outputs.keepkey }}
       runs-on: ubuntu-22.04
+      ref: ${{ github.sha }}
 
   ledger-s-app-builder:
     name: Ledger Nano S Bitcoin App builder

.github/workflows/coldcard-firmware-seed.yml

@@ -0,0 +1,30 @@
+name: Coldcard Firmware Seed
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: false
+        type: string
+
+jobs:
+  seed:
+    name: Seed Coldcard firmware (once per run)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          fetch-depth: 0
+
+      - name: Clone Coldcard firmware (with submodules)
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p test/work
+          git clone --recursive https://github.com/Coldcard/firmware.git test/work/firmware
+
+      - name: Upload seeded repo as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: coldcard-firmware-src
+          path: test/work/firmware

.github/workflows/sim-builder.yml

@@ -12,6 +12,9 @@ on:
         required: false
         type: string
         default: ubuntu-latest
+      ref:                # Ref from caller so we check out the PR commit
+        required: false
+        type: string
 
 jobs:
   build-simulator:
@@ -23,6 +26,18 @@ jobs:
         include: ${{ fromJSON(inputs.include) }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          fetch-depth: 0
+
+      # Coldcard: download seeded firmware (seed job must run earlier)
+      - name: Download seeded Coldcard firmware
+        if: ${{ inputs.sim == 'coldcard' }}
+        uses: actions/download-artifact@v4
+        with:
+          name: coldcard-firmware-src
+          path: test/work/firmware
+
       - uses: ./.github/actions/build-sim
         with:
           name: ${{ matrix.name }}

test/setup_environment.sh

@@ -133,30 +133,22 @@ if [[ -n ${build_coldcard} ]]; then
         coldcard_setup_needed=true
     else
         cd firmware
-        git reset --hard HEAD~3 # Undo git-am for checking and updating
-        git fetch
-
-        # Determine if we need to pull. From https://stackoverflow.com/a/3278427
-        UPSTREAM=${1:-'@{u}'}
-        LOCAL=$(git rev-parse @)
-        REMOTE=$(git rev-parse "$UPSTREAM")
-        BASE=$(git merge-base @ "$UPSTREAM")
+        # Ensure repo matches upstream (handles seeded artifact without local commits)
+        git fetch origin
+        git reset --hard origin/master
+        coldcard_setup_needed=true
 
-        if [ $LOCAL = $REMOTE ]; then
-            echo "Up-to-date"
-        elif [ $LOCAL = $BASE ]; then
-            git pull
-            coldcard_setup_needed=true
-        fi
+        # No additional pull needed; hard-reset above already synced to upstream
     fi
-    # Apply patch to make simulator work in linux environments
-    git am ../../data/coldcard-multisig.patch
 
     # Build the simulator. This is cached, but it is also fast
     poetry run pip install -r requirements.txt
     pip install -r requirements.txt
     cd unix
     if [ "$coldcard_setup_needed" == true ] ; then
+        # Apply patch to make simulator work in linux environments
+        git am ../../../data/coldcard-multisig.patch
+
         pushd ../external/micropython/mpy-cross/
         make
         popd