junk in the Trunk (#6149)

.github/ISSUE_TEMPLATE/Bug Report.yml

@@ -1,7 +1,7 @@
 name: Bug Report
 description: File a bug report
 title: "[Bug]: "
-labels: ["bug", "triage"]
+labels: [bug, triage]
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/New Board.yml

@@ -1,7 +1,7 @@
 name: New Board
 description: Request us to support new hardware
 title: "[Board]: "
-labels: ["enhancement", "triage"]
+labels: [enhancement, triage]
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,7 +1,7 @@
 name: Feature Request
 description: Request a new feature
 title: "[Feature Request]: "
-labels: ["enhancement"]
+labels: [enhancement]
 body:
   - type: markdown
     attributes:

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+# Configuration related to self-hosted runner.
+self-hosted-runner:
+  # Labels of self-hosted runner in array of strings.
+  labels:
+    - test-runner

.github/actions/build-variant/action.yml

@@ -34,7 +34,7 @@ inputs:
   arch:
     description: Processor arch name
     required: true
-    default: "esp32"
+    default: esp32
 
 runs:
   using: composite

.github/actions/setup-base/action.yml

@@ -1,13 +1,13 @@
-name: "Setup Build Base Composite Action"
-description: "Base build actions for Meshtastic Platform IO steps"
+name: Setup Build Base Composite Action
+description: Base build actions for Meshtastic Platform IO steps
 
 runs:
-  using: "composite"
+  using: composite
   steps:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        submodules: "recursive"
+        submodules: recursive
         ref: ${{github.event.pull_request.head.ref}}
         repository: ${{github.event.pull_request.head.repo.full_name}}
 

.github/dependabot.yml

@@ -1,26 +1,27 @@
+#trunk-ignore-all(yamllint/quoted-strings): required by dependabot syntax check
 version: 2
 updates:
   - package-ecosystem: docker
     directory: devcontainer
     schedule:
       interval: daily
-      time: "05:00" # trunk-ignore(yamllint/quoted-strings): required by dependabot syntax check
+      time: "05:00"
       timezone: US/Pacific
   - package-ecosystem: docker
     directory: /
     schedule:
       interval: daily
-      time: "05:00" # trunk-ignore(yamllint/quoted-strings): required by dependabot syntax check
+      time: "05:00"
       timezone: US/Pacific
   - package-ecosystem: gitsubmodule
     directory: /
     schedule:
       interval: daily
-      time: "05:00" # trunk-ignore(yamllint/quoted-strings): required by dependabot syntax check
+      time: "05:00"
       timezone: US/Pacific
   - package-ecosystem: github-actions
     directory: /.github/workflows
     schedule:
       interval: daily
-      time: "05:00" # trunk-ignore(yamllint/quoted-strings): required by dependabot syntax check
+      time: "05:00"
       timezone: US/Pacific

.github/workflows/build_nrf52.yml

@@ -7,6 +7,8 @@ on:
         required: true
         type: string
 
+permissions: read-all
+
 jobs:
   build-nrf52:
     runs-on: ubuntu-latest

.github/workflows/build_rpi2040.yml

@@ -7,6 +7,8 @@ on:
         required: true
         type: string
 
+permissions: read-all
+
 jobs:
   build-rpi2040:
     runs-on: ubuntu-latest

.github/workflows/build_stm32.yml

@@ -7,6 +7,8 @@ on:
         required: true
         type: string
 
+permissions: read-all
+
 jobs:
   build-stm32:
     runs-on: ubuntu-latest

.github/workflows/tests.yml

@@ -2,9 +2,11 @@ name: End to end tests
 
 on:
   schedule:
-    - cron: "0 0 * * *" # Run every day at midnight
+    - cron: 0 0 * * * # Run every day at midnight
   workflow_dispatch: {}
 
+permissions: read-all
+
 jobs:
   native-tests:
     uses: ./.github/workflows/test_native.yml

.trunk/configs/.markdownlint.yaml

@@ -8,3 +8,4 @@ line_length: false
 spaces: false
 url: false
 whitespace: false
+headings: false

Dockerfile

@@ -1,8 +1,9 @@
 # trunk-ignore-all(terrascan/AC_DOCKER_0002): Known terrascan issue
-# trunk-ignore-all(hadolint/DL3008): Use latest version of apt packages for buildchain
 # trunk-ignore-all(trivy/DS002): We must run as root for this container
 # trunk-ignore-all(checkov/CKV_DOCKER_8): We must run as root for this container
 # trunk-ignore-all(hadolint/DL3002): We must run as root for this container
+# trunk-ignore-all(hadolint/DL3008): Do not pin apt package versions
+# trunk-ignore-all(hadolint/DL3013): Do not pin pip package versions
 
 FROM python:3.12-bookworm AS builder
 ENV DEBIAN_FRONTEND=noninteractive
@@ -10,12 +11,13 @@ ENV TZ=Etc/UTC
 
 # Install Dependencies
 ENV PIP_ROOT_USER_ACTION=ignore
-RUN apt-get update && apt-get install --no-install-recommends -y wget g++ zip git ca-certificates \
+RUN apt-get update && apt-get install --no-install-recommends -y \
+        wget g++ zip git ca-certificates \
         libgpiod-dev libyaml-cpp-dev libbluetooth-dev libi2c-dev \
-        libusb-1.0-0-dev libulfius-dev liborcania-dev libssl-dev pkg-config && \
-    apt-get clean && rm -rf /var/lib/apt/lists/* && \
-    pip install --no-cache-dir -U platformio==6.1.16 && \
-    mkdir /tmp/firmware
+        libusb-1.0-0-dev libulfius-dev liborcania-dev libssl-dev pkg-config \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && pip install --no-cache-dir -U platformio \
+    && mkdir /tmp/firmware
 
 # Copy source code
 WORKDIR /tmp/firmware
@@ -35,8 +37,9 @@ ENV TZ=Etc/UTC
 # nosemgrep: dockerfile.security.last-user-is-root.last-user-is-root
 USER root
 
-RUN apt-get update && apt-get --no-install-recommends -y install libc-bin libc6 libgpiod2 libyaml-cpp0.7 libi2c0 libulfius2.7 libusb-1.0-0-dev liborcania2.3 libssl3 && \
-    apt-get clean && rm -rf /var/lib/apt/lists/* \
+RUN apt-get update && apt-get --no-install-recommends -y install \
+        libc-bin libc6 libgpiod2 libyaml-cpp0.7 libi2c0 libulfius2.7 libusb-1.0-0-dev liborcania2.3 libssl3 \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
     && mkdir -p /var/lib/meshtasticd \
     && mkdir -p /etc/meshtasticd/config.d \
     && mkdir -p /etc/meshtasticd/ssl

alpine.Dockerfile

@@ -1,14 +1,18 @@
 # trunk-ignore-all(trivy/DS002): We must run as root for this container
 # trunk-ignore-all(checkov/CKV_DOCKER_8): We must run as root for this container
 # trunk-ignore-all(hadolint/DL3002): We must run as root for this container
+# trunk-ignore-all(hadolint/DL3018): Do not pin apk package versions
+# trunk-ignore-all(hadolint/DL3013): Do not pin pip package versions
 
 FROM python:3.12-alpine3.21 AS builder
 
 ENV PIP_ROOT_USER_ACTION=ignore
-RUN apk add bash g++ libstdc++-dev linux-headers zip git ca-certificates libgpiod-dev yaml-cpp-dev bluez-dev \
-        libusb-dev i2c-tools-dev openssl-dev pkgconf argp-standalone && \
-    pip install --no-cache-dir -U platformio==6.1.16 && \
-    mkdir /tmp/firmware
+RUN apk --no-cache add \
+        bash g++ libstdc++-dev linux-headers zip git ca-certificates libgpiod-dev yaml-cpp-dev bluez-dev \
+        libusb-dev i2c-tools-dev openssl-dev pkgconf argp-standalone \
+    && rm -rf /var/cache/apk/* \
+    && pip install --no-cache-dir -U platformio \
+    && mkdir /tmp/firmware
 
 WORKDIR /tmp/firmware
 COPY . /tmp/firmware
@@ -27,7 +31,9 @@ FROM alpine:3.21
 # nosemgrep: dockerfile.security.last-user-is-root.last-user-is-root
 USER root
 
-RUN apk add libstdc++ libgpiod yaml-cpp libusb i2c-tools \
+RUN apk --no-cache add \
+        libstdc++ libgpiod yaml-cpp libusb i2c-tools \
+    && rm -rf /var/cache/apk/* \
     && mkdir -p /var/lib/meshtasticd \
     && mkdir -p /etc/meshtasticd/config.d \
     && mkdir -p /etc/meshtasticd/ssl

src/modules/WaypointModule.cpp

@@ -144,7 +144,7 @@ void WaypointModule::drawFrame(OLEDDisplay *display, OLEDDisplayUiState *state,
             bearingToOther -= myHeading;
         screen->drawNodeHeading(display, compassX, compassY, compassDiam, bearingToOther);
 
-        float bearingToOtherDegrees = (bearingToOther < 0) ? bearingToOther + 2*PI : bearingToOther;
+        float bearingToOtherDegrees = (bearingToOther < 0) ? bearingToOther + 2 * PI : bearingToOther;
         bearingToOtherDegrees = bearingToOtherDegrees * 180 / PI;
 
         // Distance to Waypoint
@@ -161,7 +161,6 @@ void WaypointModule::drawFrame(OLEDDisplay *display, OLEDDisplayUiState *state,
                 snprintf(distStr, sizeof(distStr), "%.1fkm   %.0f°", d / 1000, bearingToOtherDegrees);
         }
 
-
     }
 
     // If our node doesn't have position

test/test_crypto/test_main.cpp

@@ -1,3 +1,4 @@
+// trunk-ignore-all(gitleaks): These are dummy values. Not real secrets.
 #include "CryptoEngine.h"
 
 #include "TestUtil.h"

variants/xiao_ble/README.md

@@ -116,8 +116,9 @@ The default pin mapping in `variant.h` uses 'automatic Tx/Rx switching' mode. If
  
 
 <strong>MCU -> E22 connections</strong>
+
 | Xiao BLE pin | variant.h definition | E22 pin   | Notes                                                                                                                |
-| :------------ | :---------------------------- | :-----------------| :------------------------------------------------------------------------------------------------------------------- |
+| :----------- | :------------------- | :-------- | :------------------------------------------------------------------------------------------------------------------- |
 | D0           | SX126X_CS            | 19 (NSS)  |                                                                                                                      |
 | D1           | SX126X_DIO1          | 13 (DIO1) |                                                                                                                      |
 | D2           | SX126X_BUSY          | 14 (BUSY) |                                                                                                                      |
@@ -131,8 +132,9 @@ The default pin mapping in `variant.h` uses 'automatic Tx/Rx switching' mode. If
 &nbsp;
 
 <strong>E22 -> E22 connections:</strong>
+
 | E22 pin | E22 pin | Notes                                                                     |
-| :------------ | :---------------------------- | :------------------------------------------------------------------------ |
+| :------ | :------ | :------------------------------------------------------------------------ |
 | TXEN    | DIO2    | These must be physically connected for automatic Tx/Rx switching to work. |
 
 <h3>Note</h3>
@@ -148,8 +150,9 @@ The schematic (`xiao-ble-e22-schematic.png`) in the `eagle-project` directory us
 <h3>Example wiring for "Manual Tx/Rx switching" mode:</h3>
 
 <strong>MCU -> E22 connections</strong>
+
 | Xiao BLE pin | variant.h definition | E22 pin   | Notes |
-| :------------ | :---------------------------- | :-----------------| :--------------------------- |
+| :----------- | :------------------- | :-------- | :---- |
 | D0           | SX126X_CS            | 19 (NSS)  |       |
 | D1           | SX126X_DIO1          | 13 (DIO1) |       |
 | D2           | SX126X_BUSY          | 14 (BUSY) |       |