feat: add CI workflows

Signed-off-by: Marvin Drees <[email protected]>

.github/workflows/build.yml

@@ -0,0 +1,63 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: --deny warnings
+
+jobs:
+  generate-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      commits: ${{ steps.commits.outputs.hashes }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Get all commit hashes
+        id: commits
+        run: |
+          echo "hashes=[$(git log -z --pretty=format:"'%H'," ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | sed 's/.$//')]" >> "$GITHUB_OUTPUT"
+  build:
+    name: Build
+    needs: generate-matrix
+    strategy:
+      matrix:
+        commit: ${{ fromJson(needs.generate-matrix.outputs.commits) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.commit }}
+      - name: Install toolchain and tools
+        run: |
+          rustup toolchain install nightly --profile minimal
+          rustup default nightly
+          cargo install flip-link
+      - name: Build
+        run: cargo run --verbose --release
+      - uses: actions/upload-artifact@v4
+        with:
+          name: Picoprog-Image
+          path: target/thumbv6m-none-eabi/release/picoprog.uf2

.github/workflows/lint.yml

@@ -0,0 +1,73 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: --deny warnings
+
+jobs:
+  generate-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      commits: ${{ steps.commits.outputs.hashes }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Get all commit hashes
+        id: commits
+        run: |
+          echo "hashes=[$(git log -z --pretty=format:"'%H'," ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | sed 's/.$//')]" >> "$GITHUB_OUTPUT"
+  commit-lint:
+    name: Conventional Commits
+    needs: generate-matrix
+    strategy:
+      matrix:
+        commit: ${{ fromJson(needs.generate-matrix.outputs.commits) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.commit }}
+      - uses: bugbundle/[email protected]
+  cargo:
+    name: Rustfmt and Clippy
+    needs: generate-matrix
+    strategy:
+      matrix:
+        commit: ${{ fromJson(needs.generate-matrix.outputs.commits) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.commit }}
+      - name: Install toolchain and tools
+        run: |
+          rustup toolchain install nightly --profile minimal
+          rustup default nightly
+          rustup component add clippy rustfmt
+      - name: Check Code Formatting
+        run: cargo fmt -- --check
+      - name: Lint with Clippy
+        run: cargo clippy -- -D warnings

.github/workflows/release.yml

@@ -0,0 +1,44 @@
+name: SLSA generic generator
+
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      digests: ${{ steps.hash.outputs.digests }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install toolchain and tools
+        run: |
+          rustup toolchain install nightly --profile minimal
+          rustup default nightly
+      - name: Install toolchain and tools
+        run: |
+          rustup toolchain install nightly --profile minimal
+          rustup default nightly
+          cargo install flip-link
+      - name: Build
+        run: cargo run --release
+      - name: Generate subject for provenance
+        id: hash
+        run: |
+          set -euo pipefail
+          echo "hashes=$(sha256sum target/thumbv6m-none-eabi/release/picoprog.uf2 | base64 -w0)" >> "${GITHUB_OUTPUT}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: Picoprog-Image
+          path: target/thumbv6m-none-eabi/release/picoprog.uf2
+  provenance:
+    needs: build
+    permissions:
+      actions: read # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      base64-subjects: "${{ needs.build.outputs.digests }}"
+      upload-assets: true