This directory contains the CI/CD workflows for EdgeFirst HAL.

┌─────────────────────────────────────────────────────────────────────────────┐
│                              GitHub Events                                  │
└─────────────────────────────────────────────────────────────────────────────┘
    │                │                  │                │                │
    │ Push/PR        │ Tag (vX.Y.Z)     │ Push/PR        │ PR merged      │ Manual
    │                │                  │ + Release      │ to main        │
    ▼                ▼                  ▼                ▼                ▼
┌──────────┐   ┌──────────────┐   ┌────────────┐   ┌────────────────┐  ┌──────────────┐
│ test.yml │   │ release.yml  │   │  sbom.yml  │   │ tag-release.yml│  │ benchmark.yml│
│ (CI)     │   │ (Publishing) │   │(Compliance)│   │  (Tagging)     │  │ (On-demand)  │
└──────────┘   └──────────────┘   └────────────┘   └────────────────┘  └──────────────┘

tag-release.yml closes the loop: merging a release/** PR into main pushes the vX.Y.Z tag, which is what triggers release.yml.

Triggers: Push/PR to main, develop, or release/**

Three-phase on-target testing keeps the hardware runner doing only what it must: build-arm cross-compiles, hardware-test runs the binaries on the board, and process-hardware-coverage converts the raw profiling data back on a host with the matching toolchain.

The iOS and Android lanes are build-and-link only. GitHub has no runner that can execute either GPU stack, so on-device correctness is gated separately (Android via the internal hal-mobile Device Farm harness — see TESTING.md).

The macOS and iOS lanes fetch the signed ANGLE xcframeworks from the public EdgeFirstAI/angle-package release via scripts/fetch-angle.sh. No credentials are involved, so the full ANGLE-backed validation runs on pushes, same-repo PRs, and fork PRs alike. (Fork PRs still need a maintainer to approve the run, per GitHub's default first-time-contributor policy.)

Triggers: Tags matching vX.Y.Z or vX.Y.ZrcN; also workflow_dispatch for a dry run that builds artifacts without publishing.

The three publish/release jobs are gated on github.event_name == 'push' plus a refs/tags/ ref, so a manual dispatch builds but never publishes.

Triggers: Push/PR to main, develop, or release/**; releases

Triggers: PR closed against main

Pushes the vX.Y.Z tag when a release/X.Y.Z branch merges, which is what starts release.yml. Never tag by hand; the tag follows the merge, not the other way round. The job derives the version from the branch name and rejects anything that is not release/ plus three dot-separated numbers.

Triggers: workflow_dispatch only

Benchmarks are not part of CI. They tie up the hardware runner for a long time and the numbers are only meaningful when collected deliberately — see BENCHMARKS.md.

All workflows use hash-pinned actions, per Au-Zone SPS. Read the pins from the workflow files themselves — a copy here would go stale the first time Dependabot bumps one.

grep -rhoE 'uses: [^ ]+@[a-f0-9]{40}.*' .github/workflows/*.yml | sort -u

Each pin carries a trailing # vX.Y.Z comment naming the tag it corresponds to.

Five jobs upload coverage artifacts, and sonarcloud merges them:

The imx8mp path needs the extra process-hardware-coverage step because the board writes raw .profraw files; converting them to LCOV requires the same toolchain that built the instrumented binaries, which the board does not have.

Supporting scripts in .github/scripts/:

See CONTRIBUTING.md for local testing instructions and TESTING.md for the workspace testing rules.