From 29893e0c281c7266eeeffe956a5b1c367dfc9417 Mon Sep 17 00:00:00 2001
From: Jonathan Bennett <jbennett@incomsystems.biz>
Date: Fri, 4 Jul 2025 14:22:59 -0500
Subject: [PATCH 01/16] Don't run ble getFromRadio() unless the phone has
 requested a packet (#7231)

---
 src/nimble/NimbleBluetooth.cpp | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/nimble/NimbleBluetooth.cpp b/src/nimble/NimbleBluetooth.cpp
index 8f53c9229..834184292 100644
--- a/src/nimble/NimbleBluetooth.cpp
+++ b/src/nimble/NimbleBluetooth.cpp
@@ -29,6 +29,7 @@ class BluetoothPhoneAPI : public PhoneAPI, public concurrency::OSThread
     uint8_t fromRadioBytes[meshtastic_FromRadio_size] = {0};
     size_t numBytes = 0;
     bool hasChecked = false;
+    bool phoneWants = false;
 
   protected:
     virtual int32_t runOnce() override
@@ -38,10 +39,10 @@ class BluetoothPhoneAPI : public PhoneAPI, public concurrency::OSThread
             for (uint8_t i = 0; i < queue_size; i++) {
                 handleToRadio(nimble_queue.at(i).data(), nimble_queue.at(i).length());
             }
-            LOG_WARN("Queue_size %u", queue_size);
+            LOG_DEBUG("Queue_size %u", queue_size);
             queue_size = 0;
         }
-        if (hasChecked == false) {
+        if (hasChecked == false && phoneWants == true) {
             numBytes = getFromRadio(fromRadioBytes);
             hasChecked = true;
         }
@@ -98,9 +99,12 @@ class NimbleBluetoothFromRadioCallback : public NimBLECharacteristicCallbacks
 {
     virtual void onRead(NimBLECharacteristic *pCharacteristic)
     {
-        while (!bluetoothPhoneAPI->hasChecked) {
+        int tries = 0;
+        bluetoothPhoneAPI->phoneWants = true;
+        while (!bluetoothPhoneAPI->hasChecked && tries < 100) {
             bluetoothPhoneAPI->setIntervalFromNow(0);
             delay(20);
+            tries++;
         }
         std::lock_guard<std::mutex> guard(bluetoothPhoneAPI->nimble_mutex);
         std::string fromRadioByteString(bluetoothPhoneAPI->fromRadioBytes,
@@ -111,6 +115,7 @@ class NimbleBluetoothFromRadioCallback : public NimBLECharacteristicCallbacks
             bluetoothPhoneAPI->setIntervalFromNow(0);
         bluetoothPhoneAPI->numBytes = 0;
         bluetoothPhoneAPI->hasChecked = false;
+        bluetoothPhoneAPI->phoneWants = false;
     }
 };
 
@@ -186,7 +191,12 @@ class NimbleBluetoothServerCallback : public NimBLEServerCallbacks
             new meshtastic::BluetoothStatus(meshtastic::BluetoothStatus::ConnectionState::DISCONNECTED));
 
         if (bluetoothPhoneAPI) {
+            std::lock_guard<std::mutex> guard(bluetoothPhoneAPI->nimble_mutex);
             bluetoothPhoneAPI->close();
+            bluetoothPhoneAPI->hasChecked = false;
+            bluetoothPhoneAPI->phoneWants = false;
+            bluetoothPhoneAPI->numBytes = 0;
+            bluetoothPhoneAPI->queue_size = 0;
         }
     }
 };

From 798b1f4d861e756ecd2324083726c098cfb7325e Mon Sep 17 00:00:00 2001
From: Ben Meadors <benmmeadors@gmail.com>
Date: Sat, 5 Jul 2025 07:35:20 -0500
Subject: [PATCH 02/16] Add HWIDs for T1000-E in DFU mode (#7235)

---
 boards/tracker-t1000-e.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/boards/tracker-t1000-e.json b/boards/tracker-t1000-e.json
index 2be716e22..9e8870041 100644
--- a/boards/tracker-t1000-e.json
+++ b/boards/tracker-t1000-e.json
@@ -11,7 +11,8 @@
       ["0x239A", "0x8029"],
       ["0x239A", "0x0029"],
       ["0x239A", "0x002A"],
-      ["0x239A", "0x802A"]
+      ["0x239A", "0x802A"],
+      ["0x2886", "0x0057"]
     ],
     "usb_product": "T1000-E-BOOT",
     "mcu": "nrf52840",

From 98d010761e5a8c0f5651974268adcb09ef2f6639 Mon Sep 17 00:00:00 2001
From: Aiden Fox Ivey <aiden@aidenfoxivey.com>
Date: Fri, 20 Jun 2025 16:07:23 -0400
Subject: [PATCH 03/16] Add constant time compare to AES-CCM

Signed-off-by: Aiden Fox Ivey <aiden@aidenfoxivey.com>
---
 src/mesh/aes-ccm.cpp | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/mesh/aes-ccm.cpp b/src/mesh/aes-ccm.cpp
index a650ba2fc..a73c9473e 100644
--- a/src/mesh/aes-ccm.cpp
+++ b/src/mesh/aes-ccm.cpp
@@ -10,6 +10,31 @@
 #include "aes-ccm.h"
 #if !MESHTASTIC_EXCLUDE_PKI
 
+/**
+ * Constant-time comparison of two byte arrays
+ *
+ * @param a First byte array to compare
+ * @param b Second byte array to compare
+ * @param len Number of bytes to compare
+ * @return 0 if arrays are equal, 1 if different or if inputs are invalid
+ */
+static int constant_time_compare(const void *a_, const void *b_, size_t len)
+{
+    // Cast to volatile to prevent the compiler from optimizing out their comparison.
+    const volatile uint8_t *volatile a = (const volatile uint8_t *volatile) a_;
+    const volatile uint8_t *volatile b = (const volatile uint8_t *volatile) b_;
+    if (len == 0)
+        return 0;
+    if (a == NULL || b == NULL)
+        return 1;
+    size_t i;
+    volatile uint8_t d = 0U;
+    for (i = 0U; i < len; i++) {
+        d |= (a[i] ^ b[i]);
+    }
+    return (1 & ((d - 1) >> 8)) - 1;
+}
+
 static void WPA_PUT_BE16(uint8_t *a, uint16_t val)
 {
     a[0] = val >> 8;
@@ -146,7 +171,7 @@ bool aes_ccm_ad(const uint8_t *key, size_t key_len, const uint8_t *nonce, size_t
     aes_ccm_encr(L, crypt, crypt_len, plain, a);
     aes_ccm_auth_start(M, L, nonce, aad, aad_len, crypt_len, x);
     aes_ccm_auth(plain, crypt_len, x);
-    if (memcmp(x, t, M) != 0) { // FIXME make const comp
+    if (constant_time_compare(x, t, M) != 0) {
         return false;
     }
     return true;

From 13786572066c570d053a9669a59c1804c2ca7aa8 Mon Sep 17 00:00:00 2001
From: Aiden Fox Ivey <aiden@aidenfoxivey.com>
Date: Sat, 21 Jun 2025 00:12:09 -0400
Subject: [PATCH 04/16] Fix documentation comments.

---
 src/mesh/aes-ccm.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/mesh/aes-ccm.cpp b/src/mesh/aes-ccm.cpp
index a73c9473e..e1c65c7aa 100644
--- a/src/mesh/aes-ccm.cpp
+++ b/src/mesh/aes-ccm.cpp
@@ -16,22 +16,23 @@
  * @param a First byte array to compare
  * @param b Second byte array to compare
  * @param len Number of bytes to compare
- * @return 0 if arrays are equal, 1 if different or if inputs are invalid
+ * @return 0 if arrays are equal, -1 if different or if inputs are invalid
  */
 static int constant_time_compare(const void *a_, const void *b_, size_t len)
 {
-    // Cast to volatile to prevent the compiler from optimizing out their comparison.
+    /* Cast to volatile to prevent the compiler from optimizing out their comparison. */
     const volatile uint8_t *volatile a = (const volatile uint8_t *volatile) a_;
     const volatile uint8_t *volatile b = (const volatile uint8_t *volatile) b_;
     if (len == 0)
         return 0;
     if (a == NULL || b == NULL)
-        return 1;
+        return -1;
     size_t i;
     volatile uint8_t d = 0U;
     for (i = 0U; i < len; i++) {
         d |= (a[i] ^ b[i]);
     }
+    /* Constant time bit arithmetic to convert d > 0 to -1 and d = 0 to 0. */
     return (1 & ((d - 1) >> 8)) - 1;
 }
 

From 2a2620988928ceaf78f61b025529cf6d6eb13fea Mon Sep 17 00:00:00 2001
From: Jonathan Bennett <jbennett@incomsystems.biz>
Date: Sat, 5 Jul 2025 12:56:29 -0500
Subject: [PATCH 05/16] Trunk

---
 src/mesh/aes-ccm.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/mesh/aes-ccm.cpp b/src/mesh/aes-ccm.cpp
index e1c65c7aa..420d80e9a 100644
--- a/src/mesh/aes-ccm.cpp
+++ b/src/mesh/aes-ccm.cpp
@@ -21,8 +21,8 @@
 static int constant_time_compare(const void *a_, const void *b_, size_t len)
 {
     /* Cast to volatile to prevent the compiler from optimizing out their comparison. */
-    const volatile uint8_t *volatile a = (const volatile uint8_t *volatile) a_;
-    const volatile uint8_t *volatile b = (const volatile uint8_t *volatile) b_;
+    const volatile uint8_t *volatile a = (const volatile uint8_t *volatile)a_;
+    const volatile uint8_t *volatile b = (const volatile uint8_t *volatile)b_;
     if (len == 0)
         return 0;
     if (a == NULL || b == NULL)

From 708978911ba64c97af25751e1b4927a771a5d84d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 5 Jul 2025 19:26:20 -0500
Subject: [PATCH 06/16] chore(deps): update meshtastic/device-ui digest to
 8c7092c (#7238)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 platformio.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/platformio.ini b/platformio.ini
index 795f86eb9..5ba5e63e0 100644
--- a/platformio.ini
+++ b/platformio.ini
@@ -109,7 +109,7 @@ lib_deps =
 [device-ui_base]
 lib_deps =
 	# renovate: datasource=git-refs depName=meshtastic/device-ui packageName=https://github.com/meshtastic/device-ui gitBranch=master
-	https://github.com/meshtastic/device-ui/archive/4b7bf369adfa5a7bd419fa8293d21206576d52d0.zip
+	https://github.com/meshtastic/device-ui/archive/8c7092c73425adfda1aac8c6960df06cd85f6d92.zip
 
 ; Common libs for environmental measurements in telemetry module
 [environmental_base]

From 40c586ca97dfd10aeaeb73fc9b5d7ebf54fab60e Mon Sep 17 00:00:00 2001
From: Jonathan Bennett <jbennett@incomsystems.biz>
Date: Sun, 6 Jul 2025 16:36:22 -0500
Subject: [PATCH 07/16] Automatically bail user out of displaymode_color when
 not HAS_TFT (#7248)

---
 src/mesh/NodeDB.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/mesh/NodeDB.cpp b/src/mesh/NodeDB.cpp
index 5630a4ea3..a20acfda0 100644
--- a/src/mesh/NodeDB.cpp
+++ b/src/mesh/NodeDB.cpp
@@ -369,6 +369,14 @@ NodeDB::NodeDB()
         config.device.rebroadcast_mode = meshtastic_Config_DeviceConfig_RebroadcastMode_LOCAL_ONLY;
     }
 
+#if !HAS_TFT
+    if (config.display.displaymode == meshtastic_Config_DisplayConfig_DisplayMode_COLOR) {
+        // On a device without MUI, this display mode makes no sense, and will break logic.
+        config.display.displaymode = meshtastic_Config_DisplayConfig_DisplayMode_DEFAULT;
+        config.bluetooth.enabled = true;
+    }
+#endif
+
     if (devicestateCRC != crc32Buffer(&devicestate, sizeof(devicestate)))
         saveWhat |= SEGMENT_DEVICESTATE;
     if (nodeDatabaseCRC != crc32Buffer(&nodeDatabase, sizeof(nodeDatabase)))

From 09d4ee1ea7ab6bc77b59ad943008ac831f8afdfc Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 7 Jul 2025 06:37:15 -0500
Subject: [PATCH 08/16] Upgrade trunk (#7254)

Co-authored-by: sachaw <11172820+sachaw@users.noreply.github.com>
---
 .trunk/trunk.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 2ddebdf1d..1dfff137a 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -9,14 +9,14 @@ plugins:
 lint:
   enabled:
     - checkov@3.2.447
-    - renovate@41.17.2
+    - renovate@41.19.0
     - prettier@3.6.2
     - trufflehog@3.89.2
     - yamllint@1.37.1
     - bandit@1.8.5
-    - trivy@0.64.0
+    - trivy@0.64.1
     - taplo@0.9.3
-    - ruff@0.12.1
+    - ruff@0.12.2
     - isort@6.0.1
     - markdownlint@0.45.0
     - oxipng@9.1.5

From f95c77b8bd8babd071e7cc2b36f0e3952bf4ed92 Mon Sep 17 00:00:00 2001
From: Max <rekin.m@gmail.com>
Date: Mon, 7 Jul 2025 15:50:13 +0300
Subject: [PATCH 09/16] Fast fix, remove saving tx power inside limitPower()
 (#7255)

---
 src/mesh/RadioInterface.cpp | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/src/mesh/RadioInterface.cpp b/src/mesh/RadioInterface.cpp
index 3632378a5..faa67a1c2 100644
--- a/src/mesh/RadioInterface.cpp
+++ b/src/mesh/RadioInterface.cpp
@@ -645,10 +645,6 @@ void RadioInterface::limitPower(int8_t loraMaxPower)
     if (power > loraMaxPower) // Clamp power to maximum defined level
         power = loraMaxPower;
 
-    if (TX_GAIN_LORA == 0) { // Setting power in config with defined TX_GAIN_LORA will cause decreasing power on each reboot
-        config.lora.tx_power = power; // Set limited power in config
-    }
-
     LOG_INFO("Final Tx power: %d dBm", power);
 }
 

From f2fb473ecf1a0e0c19b12134c5250f76efdf252d Mon Sep 17 00:00:00 2001
From: Austin <vidplace7@gmail.com>
Date: Mon, 7 Jul 2025 20:34:25 -0400
Subject: [PATCH 10/16] GitHub Actions faster!! (#7244)

Use new meshtastic/gh-action-firmware Action

Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
---
 .github/workflows/build_esp32.yml           | 33 +++++++++++----------
 .github/workflows/build_esp32_c3.yml        | 33 +++++++++++----------
 .github/workflows/build_esp32_c6.yml        | 33 +++++++++++----------
 .github/workflows/build_esp32_s3.yml        | 33 +++++++++++----------
 .github/workflows/build_nrf52.yml           | 24 ++++++++++-----
 .github/workflows/build_rpi2040.yml         | 22 ++++++++++----
 .github/workflows/build_stm32.yml           | 22 ++++++++++----
 .github/workflows/main_matrix.yml           |  1 +
 .github/workflows/nightly.yml               |  2 ++
 .github/workflows/sec_sast_semgrep_cron.yml |  1 +
 .github/workflows/stale_bot.yml             |  1 +
 .github/workflows/tests.yml                 |  2 ++
 bin/{build-rpi2040.sh => build-rp2xx0.sh}   |  0
 bin/{build-stm32.sh => build-stm32wl.sh}    |  0
 14 files changed, 127 insertions(+), 80 deletions(-)
 rename bin/{build-rpi2040.sh => build-rp2xx0.sh} (100%)
 rename bin/{build-stm32.sh => build-stm32wl.sh} (100%)

diff --git a/.github/workflows/build_esp32.yml b/.github/workflows/build_esp32.yml
index 616f51746..4ec5d12db 100644
--- a/.github/workflows/build_esp32.yml
+++ b/.github/workflows/build_esp32.yml
@@ -15,23 +15,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Get release version string
+        shell: bash
+        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
+        id: version
+
       - name: Build ESP32
         id: build
-        uses: ./.github/actions/build-variant
+        uses: meshtastic/gh-action-firmware@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          board: ${{ inputs.board }}
-          remove-debug-flags: >-
-            ./arch/esp32/esp32.ini
-            ./arch/esp32/esp32s2.ini
-            ./arch/esp32/esp32s3.ini
-            ./arch/esp32/esp32c3.ini
-            ./arch/esp32/esp32c6.ini
-          build-script-path: bin/build-esp32.sh
-          ota-firmware-source: firmware.bin
-          ota-firmware-target: release/bleota.bin
-          artifact-paths: |
+          pio_platform: esp32
+          pio_env: ${{ inputs.board }}
+          pio_target: build
+          ota_firmware_source: firmware.bin
+          ota_firmware_target: release/bleota.bin
+
+      - name: Store binaries as an artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware-esp32-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
+          overwrite: true
+          path: |
             release/*.bin
             release/*.elf
-          #include-web-ui: true
-          arch: esp32
diff --git a/.github/workflows/build_esp32_c3.yml b/.github/workflows/build_esp32_c3.yml
index 1b6b832e9..335acaa2e 100644
--- a/.github/workflows/build_esp32_c3.yml
+++ b/.github/workflows/build_esp32_c3.yml
@@ -15,23 +15,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Get release version string
+        shell: bash
+        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
+        id: version
+
       - name: Build ESP32-C3
         id: build
-        uses: ./.github/actions/build-variant
+        uses: meshtastic/gh-action-firmware@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          board: ${{ inputs.board }}
-          remove-debug-flags: >-
-            ./arch/esp32/esp32.ini
-            ./arch/esp32/esp32s2.ini
-            ./arch/esp32/esp32s3.ini
-            ./arch/esp32/esp32c3.ini
-            ./arch/esp32/esp32c6.ini
-          build-script-path: bin/build-esp32.sh
-          ota-firmware-source: firmware-c3.bin
-          ota-firmware-target: release/bleota-c3.bin
-          artifact-paths: |
+          pio_platform: esp32
+          pio_env: ${{ inputs.board }}
+          pio_target: build
+          ota_firmware_source: firmware-c3.bin
+          ota_firmware_target: release/bleota-c3.bin
+
+      - name: Store binaries as an artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware-esp32c3-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
+          overwrite: true
+          path: |
             release/*.bin
             release/*.elf
-          #include-web-ui: true
-          arch: esp32c3
diff --git a/.github/workflows/build_esp32_c6.yml b/.github/workflows/build_esp32_c6.yml
index 29dac51e1..6ab588dde 100644
--- a/.github/workflows/build_esp32_c6.yml
+++ b/.github/workflows/build_esp32_c6.yml
@@ -15,23 +15,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Get release version string
+        shell: bash
+        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
+        id: version
+
       - name: Build ESP32-C6
         id: build
-        uses: ./.github/actions/build-variant
+        uses: meshtastic/gh-action-firmware@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          board: ${{ inputs.board }}
-          remove-debug-flags: >-
-            ./arch/esp32/esp32.ini
-            ./arch/esp32/esp32s2.ini
-            ./arch/esp32/esp32s3.ini
-            ./arch/esp32/esp32c3.ini
-            ./arch/esp32/esp32c6.ini
-          build-script-path: bin/build-esp32.sh
-          ota-firmware-source: firmware-c3.bin
-          ota-firmware-target: release/bleota-c3.bin
-          artifact-paths: |
+          pio_platform: esp32
+          pio_env: ${{ inputs.board }}
+          pio_target: build
+          ota_firmware_source: firmware-c3.bin
+          ota_firmware_target: release/bleota-c3.bin
+
+      - name: Store binaries as an artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware-esp32c6-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
+          overwrite: true
+          path: |
             release/*.bin
             release/*.elf
-          #include-web-ui: true
-          arch: esp32c6
diff --git a/.github/workflows/build_esp32_s3.yml b/.github/workflows/build_esp32_s3.yml
index 7e0373503..dba0d7999 100644
--- a/.github/workflows/build_esp32_s3.yml
+++ b/.github/workflows/build_esp32_s3.yml
@@ -15,23 +15,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Get release version string
+        shell: bash
+        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
+        id: version
+
       - name: Build ESP32-S3
         id: build
-        uses: ./.github/actions/build-variant
+        uses: meshtastic/gh-action-firmware@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          board: ${{ inputs.board }}
-          remove-debug-flags: >-
-            ./arch/esp32/esp32.ini
-            ./arch/esp32/esp32s2.ini
-            ./arch/esp32/esp32s3.ini
-            ./arch/esp32/esp32c3.ini
-            ./arch/esp32/esp32c6.ini
-          build-script-path: bin/build-esp32.sh
-          ota-firmware-source: firmware-s3.bin
-          ota-firmware-target: release/bleota-s3.bin
-          artifact-paths: |
+          pio_platform: esp32
+          pio_env: ${{ inputs.board }}
+          pio_target: build
+          ota_firmware_source: firmware-s3.bin
+          ota_firmware_target: release/bleota-s3.bin
+
+      - name: Store binaries as an artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware-esp32s3-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
+          overwrite: true
+          path: |
             release/*.bin
             release/*.elf
-          #include-web-ui: true
-          arch: esp32s3
diff --git a/.github/workflows/build_nrf52.yml b/.github/workflows/build_nrf52.yml
index 786508f86..bafaf2fb2 100644
--- a/.github/workflows/build_nrf52.yml
+++ b/.github/workflows/build_nrf52.yml
@@ -15,16 +15,24 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Get release version string
+        shell: bash
+        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
+        id: version
+
       - name: Build NRF52
         id: build
-        uses: ./.github/actions/build-variant
+        uses: meshtastic/gh-action-firmware@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          board: ${{ inputs.board }}
-          build-script-path: bin/build-nrf52.sh
-          artifact-paths: |
-            release/*.hex
+          pio_platform: nrf52
+          pio_env: ${{ inputs.board }}
+          pio_target: build
+
+      - name: Store binaries as an artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware-nrf52840-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
+          overwrite: true
+          path: |
             release/*.uf2
             release/*.elf
-            release/*.zip
-          arch: nrf52840
diff --git a/.github/workflows/build_rpi2040.yml b/.github/workflows/build_rpi2040.yml
index 53fee34d2..2aa0c477a 100644
--- a/.github/workflows/build_rpi2040.yml
+++ b/.github/workflows/build_rpi2040.yml
@@ -15,14 +15,24 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Get release version string
+        shell: bash
+        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
+        id: version
+
       - name: Build Raspberry Pi 2040
         id: build
-        uses: ./.github/actions/build-variant
+        uses: meshtastic/gh-action-firmware@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          board: ${{ inputs.board }}
-          build-script-path: bin/build-rpi2040.sh
-          artifact-paths: |
+          pio_platform: rp2xx0
+          pio_env: ${{ inputs.board }}
+          pio_target: build
+
+      - name: Store binaries as an artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware-rp2040-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
+          overwrite: true
+          path: |
             release/*.uf2
             release/*.elf
-          arch: rp2040
diff --git a/.github/workflows/build_stm32.yml b/.github/workflows/build_stm32.yml
index dc469d994..dd14d9d0f 100644
--- a/.github/workflows/build_stm32.yml
+++ b/.github/workflows/build_stm32.yml
@@ -15,15 +15,25 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Get release version string
+        shell: bash
+        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
+        id: version
+
       - name: Build STM32WL
         id: build
-        uses: ./.github/actions/build-variant
+        uses: meshtastic/gh-action-firmware@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          board: ${{ inputs.board }}
-          build-script-path: bin/build-stm32.sh
-          artifact-paths: |
+          pio_platform: stm32wl
+          pio_env: ${{ inputs.board }}
+          pio_target: build
+
+      - name: Store binaries as an artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware-stm32-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
+          overwrite: true
+          path: |
             release/*.hex
             release/*.bin
             release/*.elf
-          arch: stm32
diff --git a/.github/workflows/main_matrix.yml b/.github/workflows/main_matrix.yml
index 03e61d572..a6112e0e4 100644
--- a/.github/workflows/main_matrix.yml
+++ b/.github/workflows/main_matrix.yml
@@ -135,6 +135,7 @@ jobs:
       board: ${{ matrix.board }}
 
   build-debian-src:
+    if: github.repository == 'meshtastic/firmware'
     uses: ./.github/workflows/build_debian_src.yml
     with:
       series: UNRELEASED
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 36ec22f17..309772b12 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -8,6 +8,7 @@ permissions: read-all
 
 jobs:
   trunk_check:
+    if: github.repository == 'meshtastic/firmware'
     name: Trunk Check and Upload
     runs-on: ubuntu-24.04
 
@@ -21,6 +22,7 @@ jobs:
           trunk-token: ${{ secrets.TRUNK_TOKEN }}
 
   trunk_upgrade:
+    if: github.repository == 'meshtastic/firmware'
     # See: https://github.com/trunk-io/trunk-action/blob/v1/readme.md#automatic-upgrades
     name: Trunk Upgrade (PR)
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/sec_sast_semgrep_cron.yml b/.github/workflows/sec_sast_semgrep_cron.yml
index d7eef29b4..e391aa07b 100644
--- a/.github/workflows/sec_sast_semgrep_cron.yml
+++ b/.github/workflows/sec_sast_semgrep_cron.yml
@@ -13,6 +13,7 @@ permissions:
 
 jobs:
   semgrep-full:
+    if: github.repository == 'meshtastic/firmware'
     runs-on: ubuntu-24.04
     container:
       image: semgrep/semgrep
diff --git a/.github/workflows/stale_bot.yml b/.github/workflows/stale_bot.yml
index 5ae6bdfc9..5a11fdfa8 100644
--- a/.github/workflows/stale_bot.yml
+++ b/.github/workflows/stale_bot.yml
@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   stale_issues:
+    if: github.repository == 'meshtastic/firmware'
     name: Close Stale Issues
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 28b6a40a5..34b28b39c 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,9 +12,11 @@ permissions:
 
 jobs:
   native-tests:
+    if: github.repository == 'meshtastic/firmware'
     uses: ./.github/workflows/test_native.yml
 
   hardware-tests:
+    if: github.repository == 'meshtastic/firmware'
     runs-on: test-runner
     steps:
       - name: Checkout code
diff --git a/bin/build-rpi2040.sh b/bin/build-rp2xx0.sh
similarity index 100%
rename from bin/build-rpi2040.sh
rename to bin/build-rp2xx0.sh
diff --git a/bin/build-stm32.sh b/bin/build-stm32wl.sh
similarity index 100%
rename from bin/build-stm32.sh
rename to bin/build-stm32wl.sh

From 415dc4aa471640cd4e55967e4381fb62ff59203d Mon Sep 17 00:00:00 2001
From: Ben Meadors <benmmeadors@gmail.com>
Date: Mon, 7 Jul 2025 19:35:57 -0500
Subject: [PATCH 11/16] Try-fix: L76K spamming bad times can crash nodes
 (#7261)

* Try-fix: Clear GPS buffer when we encounter a bad time in NMEA

* Fix signed int warnings
---
 src/gps/GPS.cpp                            |  5 ++++-
 src/gps/RTC.cpp                            | 12 ++++++------
 src/gps/RTC.h                              | 13 +++++++++++--
 src/graphics/draw/NotificationRenderer.cpp |  9 ++++++---
 4 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/src/gps/GPS.cpp b/src/gps/GPS.cpp
index 142241c43..345c738d6 100644
--- a/src/gps/GPS.cpp
+++ b/src/gps/GPS.cpp
@@ -1536,7 +1536,10 @@ The Unix epoch (or Unix time or POSIX time or Unix timestamp) is the number of s
         if (t.tm_mon > -1) {
             LOG_DEBUG("NMEA GPS time %02d-%02d-%02d %02d:%02d:%02d age %d", d.year(), d.month(), t.tm_mday, t.tm_hour, t.tm_min,
                       t.tm_sec, ti.age());
-            perhapsSetRTC(RTCQualityGPS, t);
+            if (perhapsSetRTC(RTCQualityGPS, t) == RTCSetResultInvalidTime) {
+                // Clear the GPS buffer if we got an invalid time
+                clearBuffer();
+            }
             return true;
         } else
             return false;
diff --git a/src/gps/RTC.cpp b/src/gps/RTC.cpp
index 219a593e0..5054be3f0 100644
--- a/src/gps/RTC.cpp
+++ b/src/gps/RTC.cpp
@@ -105,7 +105,7 @@ void readFromRTC()
  *
  * If we haven't yet set our RTC this boot, set it from a GPS derived time
  */
-bool perhapsSetRTC(RTCQuality q, const struct timeval *tv, bool forceUpdate)
+RTCSetResult perhapsSetRTC(RTCQuality q, const struct timeval *tv, bool forceUpdate)
 {
     static uint32_t lastSetMsec = 0;
     uint32_t now = millis();
@@ -113,7 +113,7 @@ bool perhapsSetRTC(RTCQuality q, const struct timeval *tv, bool forceUpdate)
 #ifdef BUILD_EPOCH
     if (tv->tv_sec < BUILD_EPOCH) {
         LOG_WARN("Ignore time (%ld) before build epoch (%ld)!", printableEpoch, BUILD_EPOCH);
-        return false;
+        return RTCSetResultInvalidTime;
     }
 #endif
 
@@ -184,9 +184,9 @@ bool perhapsSetRTC(RTCQuality q, const struct timeval *tv, bool forceUpdate)
         readFromRTC();
 #endif
 
-        return true;
+        return RTCSetResultSuccess;
     } else {
-        return false;
+        return RTCSetResultNotSet; // RTC was already set with a higher quality time
     }
 }
 
@@ -215,7 +215,7 @@ const char *RtcName(RTCQuality quality)
  * @param t The time to potentially set the RTC to.
  * @return True if the RTC was set to the provided time, false otherwise.
  */
-bool perhapsSetRTC(RTCQuality q, struct tm &t)
+RTCSetResult perhapsSetRTC(RTCQuality q, struct tm &t)
 {
     /* Convert to unix time
     The Unix epoch (or Unix time or POSIX time or Unix timestamp) is the number of seconds that have elapsed since January 1, 1970
@@ -231,7 +231,7 @@ bool perhapsSetRTC(RTCQuality q, struct tm &t)
     // LOG_DEBUG("Got time from GPS month=%d, year=%d, unixtime=%ld", t.tm_mon, t.tm_year, tv.tv_sec);
     if (t.tm_year < 0 || t.tm_year >= 300) {
         // LOG_DEBUG("Ignore invalid GPS month=%d, year=%d, unixtime=%ld", t.tm_mon, t.tm_year, tv.tv_sec);
-        return false;
+        return RTCSetResultInvalidTime;
     } else {
         return perhapsSetRTC(q, &tv);
     }
diff --git a/src/gps/RTC.h b/src/gps/RTC.h
index caa48dc06..96dec575b 100644
--- a/src/gps/RTC.h
+++ b/src/gps/RTC.h
@@ -22,13 +22,22 @@ enum RTCQuality {
     RTCQualityGPS = 4
 };
 
+/// The RTC set result codes
+/// Used to indicate the result of an attempt to set the RTC.
+enum RTCSetResult {
+    RTCSetResultNotSet = 0,      ///< RTC was set successfully
+    RTCSetResultSuccess = 1,     ///< RTC was set successfully
+    RTCSetResultInvalidTime = 3, ///< The provided time was invalid (e.g., before the build epoch)
+    RTCSetResultError = 4        ///< An error occurred while setting the RTC
+};
+
 RTCQuality getRTCQuality();
 
 extern uint32_t lastSetFromPhoneNtpOrGps;
 
 /// If we haven't yet set our RTC this boot, set it from a GPS derived time
-bool perhapsSetRTC(RTCQuality q, const struct timeval *tv, bool forceUpdate = false);
-bool perhapsSetRTC(RTCQuality q, struct tm &t);
+RTCSetResult perhapsSetRTC(RTCQuality q, const struct timeval *tv, bool forceUpdate = false);
+RTCSetResult perhapsSetRTC(RTCQuality q, struct tm &t);
 
 /// Return a string name for the quality
 const char *RtcName(RTCQuality quality);
diff --git a/src/graphics/draw/NotificationRenderer.cpp b/src/graphics/draw/NotificationRenderer.cpp
index 3b682cc55..057c91008 100644
--- a/src/graphics/draw/NotificationRenderer.cpp
+++ b/src/graphics/draw/NotificationRenderer.cpp
@@ -42,7 +42,7 @@ uint32_t NotificationRenderer::currentNumber = 0;
 uint32_t pow_of_10(uint32_t n)
 {
     uint32_t ret = 1;
-    for (int i = 0; i < n; i++) {
+    for (uint32_t i = 0; i < n; i++) {
         ret *= 10;
     }
     return ret;
@@ -80,6 +80,9 @@ void NotificationRenderer::drawBannercallback(OLEDDisplay *display, OLEDDisplayU
     if (!isOverlayBannerShowing() || pauseBanner)
         return;
     switch (current_notification_type) {
+    case notificationTypeEnum::none:
+        // Do nothing - no notification to display
+        break;
     case notificationTypeEnum::text_banner:
     case notificationTypeEnum::selection_picker:
         drawAlertBannerOverlay(display, state);
@@ -144,12 +147,12 @@ void NotificationRenderer::drawNumberPicker(OLEDDisplay *display, OLEDDisplayUiS
     const char *linePointers[totalLines + 1] = {0}; // this is sort of a dynamic allocation
 
     // copy the linestarts to display to the linePointers holder
-    for (int i = 0; i < lineCount; i++) {
+    for (uint16_t i = 0; i < lineCount; i++) {
         linePointers[i] = lineStarts[i];
     }
     std::string digits = " ";
     std::string arrowPointer = " ";
-    for (int i = 0; i < numDigits; i++) {
+    for (uint16_t i = 0; i < numDigits; i++) {
         // Modulo minus modulo to return just the current number
         digits += std::to_string((currentNumber % (pow_of_10(numDigits - i))) / (pow_of_10(numDigits - i - 1))) + " ";
         if (curSelected == i) {

From e1f40c2db91b753831be2f29ce074274bd029f6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ing=2E=20Jan=20Kal=C3=A1b?= <jan+github@kalabovi.org>
Date: Tue, 8 Jul 2025 02:36:21 +0200
Subject: [PATCH 12/16] Fix install script (#7259)

This partially reverse 2ab717c (#7143), fixing the install script. It looks like a bad/missed copy/paste.
---
 bin/device-install.sh | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/bin/device-install.sh b/bin/device-install.sh
index 42d0c4089..4674113b6 100755
--- a/bin/device-install.sh
+++ b/bin/device-install.sh
@@ -7,12 +7,7 @@ MCU=""
 
 # Variant groups
 BIGDB_8MB=(
-	# Check if FILENAME contains "-tft-" and set target partitionScheme accordingly.
-if [[ $FILENAME == *"-tft-"* ]]; then
-    TFT_BUILD=true
-fi
-
-# Extract BASENAME from %FILENAME% for later use.r-s3"
+	"picomputer-s3"
 	"unphone"
 	"seeed-sensecap-indicator"
 	"crowpanel-esp32s3"

From fa23be442444497c1aa729faa90cea9ae9c3ecde Mon Sep 17 00:00:00 2001
From: Jonathan Bennett <jbennett@incomsystems.biz>
Date: Mon, 7 Jul 2025 19:50:44 -0500
Subject: [PATCH 13/16] Revert "GitHub Actions faster!! (#7244)" (#7262)

This reverts commit f2fb473ecf1a0e0c19b12134c5250f76efdf252d.
---
 .github/workflows/build_esp32.yml           | 33 ++++++++++-----------
 .github/workflows/build_esp32_c3.yml        | 33 ++++++++++-----------
 .github/workflows/build_esp32_c6.yml        | 33 ++++++++++-----------
 .github/workflows/build_esp32_s3.yml        | 33 ++++++++++-----------
 .github/workflows/build_nrf52.yml           | 24 +++++----------
 .github/workflows/build_rpi2040.yml         | 22 ++++----------
 .github/workflows/build_stm32.yml           | 22 ++++----------
 .github/workflows/main_matrix.yml           |  1 -
 .github/workflows/nightly.yml               |  2 --
 .github/workflows/sec_sast_semgrep_cron.yml |  1 -
 .github/workflows/stale_bot.yml             |  1 -
 .github/workflows/tests.yml                 |  2 --
 bin/{build-rp2xx0.sh => build-rpi2040.sh}   |  0
 bin/{build-stm32wl.sh => build-stm32.sh}    |  0
 14 files changed, 80 insertions(+), 127 deletions(-)
 rename bin/{build-rp2xx0.sh => build-rpi2040.sh} (100%)
 rename bin/{build-stm32wl.sh => build-stm32.sh} (100%)

diff --git a/.github/workflows/build_esp32.yml b/.github/workflows/build_esp32.yml
index 4ec5d12db..616f51746 100644
--- a/.github/workflows/build_esp32.yml
+++ b/.github/workflows/build_esp32.yml
@@ -15,26 +15,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Get release version string
-        shell: bash
-        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-        id: version
-
       - name: Build ESP32
         id: build
-        uses: meshtastic/gh-action-firmware@main
+        uses: ./.github/actions/build-variant
         with:
-          pio_platform: esp32
-          pio_env: ${{ inputs.board }}
-          pio_target: build
-          ota_firmware_source: firmware.bin
-          ota_firmware_target: release/bleota.bin
-
-      - name: Store binaries as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: firmware-esp32-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
-          overwrite: true
-          path: |
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          board: ${{ inputs.board }}
+          remove-debug-flags: >-
+            ./arch/esp32/esp32.ini
+            ./arch/esp32/esp32s2.ini
+            ./arch/esp32/esp32s3.ini
+            ./arch/esp32/esp32c3.ini
+            ./arch/esp32/esp32c6.ini
+          build-script-path: bin/build-esp32.sh
+          ota-firmware-source: firmware.bin
+          ota-firmware-target: release/bleota.bin
+          artifact-paths: |
             release/*.bin
             release/*.elf
+          #include-web-ui: true
+          arch: esp32
diff --git a/.github/workflows/build_esp32_c3.yml b/.github/workflows/build_esp32_c3.yml
index 335acaa2e..1b6b832e9 100644
--- a/.github/workflows/build_esp32_c3.yml
+++ b/.github/workflows/build_esp32_c3.yml
@@ -15,26 +15,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Get release version string
-        shell: bash
-        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-        id: version
-
       - name: Build ESP32-C3
         id: build
-        uses: meshtastic/gh-action-firmware@main
+        uses: ./.github/actions/build-variant
         with:
-          pio_platform: esp32
-          pio_env: ${{ inputs.board }}
-          pio_target: build
-          ota_firmware_source: firmware-c3.bin
-          ota_firmware_target: release/bleota-c3.bin
-
-      - name: Store binaries as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: firmware-esp32c3-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
-          overwrite: true
-          path: |
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          board: ${{ inputs.board }}
+          remove-debug-flags: >-
+            ./arch/esp32/esp32.ini
+            ./arch/esp32/esp32s2.ini
+            ./arch/esp32/esp32s3.ini
+            ./arch/esp32/esp32c3.ini
+            ./arch/esp32/esp32c6.ini
+          build-script-path: bin/build-esp32.sh
+          ota-firmware-source: firmware-c3.bin
+          ota-firmware-target: release/bleota-c3.bin
+          artifact-paths: |
             release/*.bin
             release/*.elf
+          #include-web-ui: true
+          arch: esp32c3
diff --git a/.github/workflows/build_esp32_c6.yml b/.github/workflows/build_esp32_c6.yml
index 6ab588dde..29dac51e1 100644
--- a/.github/workflows/build_esp32_c6.yml
+++ b/.github/workflows/build_esp32_c6.yml
@@ -15,26 +15,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Get release version string
-        shell: bash
-        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-        id: version
-
       - name: Build ESP32-C6
         id: build
-        uses: meshtastic/gh-action-firmware@main
+        uses: ./.github/actions/build-variant
         with:
-          pio_platform: esp32
-          pio_env: ${{ inputs.board }}
-          pio_target: build
-          ota_firmware_source: firmware-c3.bin
-          ota_firmware_target: release/bleota-c3.bin
-
-      - name: Store binaries as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: firmware-esp32c6-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
-          overwrite: true
-          path: |
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          board: ${{ inputs.board }}
+          remove-debug-flags: >-
+            ./arch/esp32/esp32.ini
+            ./arch/esp32/esp32s2.ini
+            ./arch/esp32/esp32s3.ini
+            ./arch/esp32/esp32c3.ini
+            ./arch/esp32/esp32c6.ini
+          build-script-path: bin/build-esp32.sh
+          ota-firmware-source: firmware-c3.bin
+          ota-firmware-target: release/bleota-c3.bin
+          artifact-paths: |
             release/*.bin
             release/*.elf
+          #include-web-ui: true
+          arch: esp32c6
diff --git a/.github/workflows/build_esp32_s3.yml b/.github/workflows/build_esp32_s3.yml
index dba0d7999..7e0373503 100644
--- a/.github/workflows/build_esp32_s3.yml
+++ b/.github/workflows/build_esp32_s3.yml
@@ -15,26 +15,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Get release version string
-        shell: bash
-        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-        id: version
-
       - name: Build ESP32-S3
         id: build
-        uses: meshtastic/gh-action-firmware@main
+        uses: ./.github/actions/build-variant
         with:
-          pio_platform: esp32
-          pio_env: ${{ inputs.board }}
-          pio_target: build
-          ota_firmware_source: firmware-s3.bin
-          ota_firmware_target: release/bleota-s3.bin
-
-      - name: Store binaries as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: firmware-esp32s3-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
-          overwrite: true
-          path: |
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          board: ${{ inputs.board }}
+          remove-debug-flags: >-
+            ./arch/esp32/esp32.ini
+            ./arch/esp32/esp32s2.ini
+            ./arch/esp32/esp32s3.ini
+            ./arch/esp32/esp32c3.ini
+            ./arch/esp32/esp32c6.ini
+          build-script-path: bin/build-esp32.sh
+          ota-firmware-source: firmware-s3.bin
+          ota-firmware-target: release/bleota-s3.bin
+          artifact-paths: |
             release/*.bin
             release/*.elf
+          #include-web-ui: true
+          arch: esp32s3
diff --git a/.github/workflows/build_nrf52.yml b/.github/workflows/build_nrf52.yml
index bafaf2fb2..786508f86 100644
--- a/.github/workflows/build_nrf52.yml
+++ b/.github/workflows/build_nrf52.yml
@@ -15,24 +15,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Get release version string
-        shell: bash
-        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-        id: version
-
       - name: Build NRF52
         id: build
-        uses: meshtastic/gh-action-firmware@main
+        uses: ./.github/actions/build-variant
         with:
-          pio_platform: nrf52
-          pio_env: ${{ inputs.board }}
-          pio_target: build
-
-      - name: Store binaries as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: firmware-nrf52840-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
-          overwrite: true
-          path: |
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          board: ${{ inputs.board }}
+          build-script-path: bin/build-nrf52.sh
+          artifact-paths: |
+            release/*.hex
             release/*.uf2
             release/*.elf
+            release/*.zip
+          arch: nrf52840
diff --git a/.github/workflows/build_rpi2040.yml b/.github/workflows/build_rpi2040.yml
index 2aa0c477a..53fee34d2 100644
--- a/.github/workflows/build_rpi2040.yml
+++ b/.github/workflows/build_rpi2040.yml
@@ -15,24 +15,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Get release version string
-        shell: bash
-        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-        id: version
-
       - name: Build Raspberry Pi 2040
         id: build
-        uses: meshtastic/gh-action-firmware@main
+        uses: ./.github/actions/build-variant
         with:
-          pio_platform: rp2xx0
-          pio_env: ${{ inputs.board }}
-          pio_target: build
-
-      - name: Store binaries as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: firmware-rp2040-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
-          overwrite: true
-          path: |
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          board: ${{ inputs.board }}
+          build-script-path: bin/build-rpi2040.sh
+          artifact-paths: |
             release/*.uf2
             release/*.elf
+          arch: rp2040
diff --git a/.github/workflows/build_stm32.yml b/.github/workflows/build_stm32.yml
index dd14d9d0f..dc469d994 100644
--- a/.github/workflows/build_stm32.yml
+++ b/.github/workflows/build_stm32.yml
@@ -15,25 +15,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Get release version string
-        shell: bash
-        run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-        id: version
-
       - name: Build STM32WL
         id: build
-        uses: meshtastic/gh-action-firmware@main
+        uses: ./.github/actions/build-variant
         with:
-          pio_platform: stm32wl
-          pio_env: ${{ inputs.board }}
-          pio_target: build
-
-      - name: Store binaries as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: firmware-stm32-${{ inputs.board }}-${{ steps.version.outputs.long }}.zip
-          overwrite: true
-          path: |
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          board: ${{ inputs.board }}
+          build-script-path: bin/build-stm32.sh
+          artifact-paths: |
             release/*.hex
             release/*.bin
             release/*.elf
+          arch: stm32
diff --git a/.github/workflows/main_matrix.yml b/.github/workflows/main_matrix.yml
index a6112e0e4..03e61d572 100644
--- a/.github/workflows/main_matrix.yml
+++ b/.github/workflows/main_matrix.yml
@@ -135,7 +135,6 @@ jobs:
       board: ${{ matrix.board }}
 
   build-debian-src:
-    if: github.repository == 'meshtastic/firmware'
     uses: ./.github/workflows/build_debian_src.yml
     with:
       series: UNRELEASED
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 309772b12..36ec22f17 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -8,7 +8,6 @@ permissions: read-all
 
 jobs:
   trunk_check:
-    if: github.repository == 'meshtastic/firmware'
     name: Trunk Check and Upload
     runs-on: ubuntu-24.04
 
@@ -22,7 +21,6 @@ jobs:
           trunk-token: ${{ secrets.TRUNK_TOKEN }}
 
   trunk_upgrade:
-    if: github.repository == 'meshtastic/firmware'
     # See: https://github.com/trunk-io/trunk-action/blob/v1/readme.md#automatic-upgrades
     name: Trunk Upgrade (PR)
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/sec_sast_semgrep_cron.yml b/.github/workflows/sec_sast_semgrep_cron.yml
index e391aa07b..d7eef29b4 100644
--- a/.github/workflows/sec_sast_semgrep_cron.yml
+++ b/.github/workflows/sec_sast_semgrep_cron.yml
@@ -13,7 +13,6 @@ permissions:
 
 jobs:
   semgrep-full:
-    if: github.repository == 'meshtastic/firmware'
     runs-on: ubuntu-24.04
     container:
       image: semgrep/semgrep
diff --git a/.github/workflows/stale_bot.yml b/.github/workflows/stale_bot.yml
index 5a11fdfa8..5ae6bdfc9 100644
--- a/.github/workflows/stale_bot.yml
+++ b/.github/workflows/stale_bot.yml
@@ -11,7 +11,6 @@ permissions:
 
 jobs:
   stale_issues:
-    if: github.repository == 'meshtastic/firmware'
     name: Close Stale Issues
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 34b28b39c..28b6a40a5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,11 +12,9 @@ permissions:
 
 jobs:
   native-tests:
-    if: github.repository == 'meshtastic/firmware'
     uses: ./.github/workflows/test_native.yml
 
   hardware-tests:
-    if: github.repository == 'meshtastic/firmware'
     runs-on: test-runner
     steps:
       - name: Checkout code
diff --git a/bin/build-rp2xx0.sh b/bin/build-rpi2040.sh
similarity index 100%
rename from bin/build-rp2xx0.sh
rename to bin/build-rpi2040.sh
diff --git a/bin/build-stm32wl.sh b/bin/build-stm32.sh
similarity index 100%
rename from bin/build-stm32wl.sh
rename to bin/build-stm32.sh

From 19af2d9e3b1b3ea7912cc04b03052c3686be8ff8 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 8 Jul 2025 06:22:24 -0500
Subject: [PATCH 14/16] Upgrade trunk (#7266)

Co-authored-by: sachaw <11172820+sachaw@users.noreply.github.com>
---
 .trunk/trunk.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 1dfff137a..0986e6eb0 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -9,11 +9,11 @@ plugins:
 lint:
   enabled:
     - checkov@3.2.447
-    - renovate@41.19.0
+    - renovate@41.23.4
     - prettier@3.6.2
     - trufflehog@3.89.2
     - yamllint@1.37.1
-    - bandit@1.8.5
+    - bandit@1.8.6
     - trivy@0.64.1
     - taplo@0.9.3
     - ruff@0.12.2

From 88b299dd416480a0ccdde8a1dccf23a3a065e9a3 Mon Sep 17 00:00:00 2001
From: HarukiToreda <116696711+HarukiToreda@users.noreply.github.com>
Date: Tue, 8 Jul 2025 07:22:57 -0400
Subject: [PATCH 15/16] Modules and favorite screen fix (#7264)

* T-watch screen misalignment fix

* Trunk fix

* Fix for favorite frame when module screen is enabled
---
 src/graphics/Screen.cpp | 49 +++++++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 19 deletions(-)

diff --git a/src/graphics/Screen.cpp b/src/graphics/Screen.cpp
index ed8119738..d8a60f1f4 100644
--- a/src/graphics/Screen.cpp
+++ b/src/graphics/Screen.cpp
@@ -944,22 +944,6 @@ void Screen::setFrames(FrameFocus focus)
     indicatorIcons.push_back(digital_icon_clock);
 #endif
 
-    // We don't show the node info of our node (if we have it yet - we should)
-    size_t numMeshNodes = nodeDB->getNumMeshNodes();
-    if (numMeshNodes > 0)
-        numMeshNodes--;
-
-    for (size_t i = 0; i < nodeDB->getNumMeshNodes(); i++) {
-        const meshtastic_NodeInfoLite *n = nodeDB->getMeshNodeByIndex(i);
-        if (n && n->num != nodeDB->getNodeNum() && n->is_favorite) {
-            if (fsi.positions.firstFavorite == 255)
-                fsi.positions.firstFavorite = numframes;
-            fsi.positions.lastFavorite = numframes;
-            normalFrames[numframes++] = graphics::UIRenderer::drawNodeInfo;
-            indicatorIcons.push_back(icon_node);
-        }
-    }
-
 #if HAS_WIFI && !defined(ARCH_PORTDUINO)
     if (!dismissedFrames.wifi && isWifiAvailable()) {
         fsi.positions.wifi = numframes;
@@ -969,7 +953,7 @@ void Screen::setFrames(FrameFocus focus)
 #endif
 
     // Beware of what changes you make in this code!
-    // We pass numfames into GetMeshModulesWithUIFrames() which is highly important!
+    // We pass numframes into GetMeshModulesWithUIFrames() which is highly important!
     // Inside of that callback, goes over to MeshModule.cpp and we run
     // modulesWithUIFrames.resize(startIndex, nullptr), to insert nullptr
     // entries until we're ready to start building the matching entries.
@@ -998,6 +982,34 @@ void Screen::setFrames(FrameFocus focus)
 
     LOG_DEBUG("Added modules.  numframes: %d", numframes);
 
+    // We don't show the node info of our node (if we have it yet - we should)
+    size_t numMeshNodes = nodeDB->getNumMeshNodes();
+    if (numMeshNodes > 0)
+        numMeshNodes--;
+
+    // Temporary array to hold favorite node frames
+    std::vector<FrameCallback> favoriteFrames;
+
+    for (size_t i = 0; i < nodeDB->getNumMeshNodes(); i++) {
+        const meshtastic_NodeInfoLite *n = nodeDB->getMeshNodeByIndex(i);
+        if (n && n->num != nodeDB->getNodeNum() && n->is_favorite) {
+            favoriteFrames.push_back(graphics::UIRenderer::drawNodeInfo);
+        }
+    }
+
+    // Insert favorite frames *after* collecting them all
+    if (!favoriteFrames.empty()) {
+        fsi.positions.firstFavorite = numframes;
+        for (auto &f : favoriteFrames) {
+            normalFrames[numframes++] = f;
+            indicatorIcons.push_back(icon_node);
+        }
+        fsi.positions.lastFavorite = numframes - 1;
+    } else {
+        fsi.positions.firstFavorite = 255;
+        fsi.positions.lastFavorite = 255;
+    }
+
     fsi.frameCount = numframes;   // Total framecount is used to apply FOCUS_PRESERVE
     this->frameCount = numframes; // ✅ Save frame count for use in custom overlay
     LOG_DEBUG("Finished build frames. numframes: %d", numframes);
@@ -1009,8 +1021,7 @@ void Screen::setFrames(FrameFocus focus)
     static OverlayCallback overlays[] = {graphics::UIRenderer::drawNavigationBar, NotificationRenderer::drawBannercallback};
     ui->setOverlays(overlays, sizeof(overlays) / sizeof(overlays[0]));
 
-    prevFrame = -1; // Force drawNodeInfo to pick a new node (because our list
-                    // just changed)
+    prevFrame = -1; // Force drawNodeInfo to pick a new node (because our list just changed)
 
     // Focus on a specific frame, in the frame set we just created
     switch (focus) {

From 9c08220d247011fc30aa6a02dd73158ac9c8d31f Mon Sep 17 00:00:00 2001
From: Jason P <applewiz@mac.com>
Date: Tue, 8 Jul 2025 06:24:12 -0500
Subject: [PATCH 16/16] TFT_MESH Fixes Across Various Devices (#7247)

* Rename "r,g,b" variables to having a TFT_MESH_ prefix

* Reboot and then user options

* Restore TFT_MESH on any ST7789Spi driver
---
 src/graphics/Screen.cpp           | 14 +++----
 src/graphics/draw/MenuHandler.cpp | 68 +++++++++++++++----------------
 2 files changed, 41 insertions(+), 41 deletions(-)

diff --git a/src/graphics/Screen.cpp b/src/graphics/Screen.cpp
index d8a60f1f4..5d33feb4d 100644
--- a/src/graphics/Screen.cpp
+++ b/src/graphics/Screen.cpp
@@ -294,13 +294,13 @@ Screen::Screen(ScanI2C::DeviceAddress address, meshtastic_Config_DisplayConfig_O
     LOG_INFO("Protobuf Value uiconfig.screen_rgb_color: %d", uiconfig.screen_rgb_color);
     int32_t rawRGB = uiconfig.screen_rgb_color;
     if (rawRGB > 0 && rawRGB <= 255255255) {
-        uint8_t r = (rawRGB >> 16) & 0xFF;
-        uint8_t g = (rawRGB >> 8) & 0xFF;
-        uint8_t b = rawRGB & 0xFF;
-        LOG_INFO("Values of r,g,b: %d, %d, %d", r, g, b);
+        uint8_t TFT_MESH_r = (rawRGB >> 16) & 0xFF;
+        uint8_t TFT_MESH_g = (rawRGB >> 8) & 0xFF;
+        uint8_t TFT_MESH_b = rawRGB & 0xFF;
+        LOG_INFO("Values of r,g,b: %d, %d, %d", TFT_MESH_r, TFT_MESH_g, TFT_MESH_b);
 
-        if (r <= 255 && g <= 255 && b <= 255) {
-            TFT_MESH = COLOR565(r, g, b);
+        if (TFT_MESH_r <= 255 && TFT_MESH_g <= 255 && TFT_MESH_b <= 255) {
+            TFT_MESH = COLOR565(TFT_MESH_r, TFT_MESH_g, TFT_MESH_b);
         }
     }
 
@@ -313,8 +313,8 @@ Screen::Screen(ScanI2C::DeviceAddress address, meshtastic_Config_DisplayConfig_O
                             ST7789_MISO, ST7789_SCK);
 #else
     dispdev = new ST7789Spi(&SPI1, ST7789_RESET, ST7789_RS, ST7789_NSS, GEOMETRY_RAWMODE, TFT_WIDTH, TFT_HEIGHT);
-    static_cast<ST7789Spi *>(dispdev)->setRGB(TFT_MESH);
 #endif
+    static_cast<ST7789Spi *>(dispdev)->setRGB(TFT_MESH);
 #elif defined(USE_SSD1306)
     dispdev = new SSD1306Wire(address.address, -1, -1, geometry,
                               (address.port == ScanI2C::I2CPort::WIRE1) ? HW_I2C::I2C_TWO : HW_I2C::I2C_ONE);
diff --git a/src/graphics/draw/MenuHandler.cpp b/src/graphics/draw/MenuHandler.cpp
index 43c226896..a66ccd983 100644
--- a/src/graphics/draw/MenuHandler.cpp
+++ b/src/graphics/draw/MenuHandler.cpp
@@ -358,6 +358,9 @@ void menuHandler::systemBaseMenu()
     static int optionsEnumArray[7] = {Back};
     int options = 1;
 
+    optionsArray[options] = "Reboot";
+    optionsEnumArray[options++] = Reboot;
+
     optionsArray[options] = "Beeps Action";
     optionsEnumArray[options++] = Beeps;
 
@@ -366,9 +369,6 @@ void menuHandler::systemBaseMenu()
         optionsEnumArray[options++] = Brightness;
     }
 
-    optionsArray[options] = "Reboot";
-    optionsEnumArray[options++] = Reboot;
-
 #if defined(HELTEC_MESH_NODE_T114) || defined(HELTEC_VISION_MASTER_T190) || HAS_TFT
     optionsArray[options] = "Screen Color";
     optionsEnumArray[options++] = Color;
@@ -677,52 +677,52 @@ void menuHandler::TFTColorPickerMenu(OLEDDisplay *display)
     bannerOptions.optionsArrayPtr = optionsArray;
     bannerOptions.optionsCount = 10;
     bannerOptions.bannerCallback = [display](int selected) -> void {
-        uint8_t r = 0;
-        uint8_t g = 0;
-        uint8_t b = 0;
+        uint8_t TFT_MESH_r = 0;
+        uint8_t TFT_MESH_g = 0;
+        uint8_t TFT_MESH_b = 0;
         if (selected == 1) {
             LOG_INFO("Setting color to system default or defined variant");
             // Given just before we set all these to zero, we will allow this to go through
         } else if (selected == 2) {
             LOG_INFO("Setting color to Meshtastic Green");
-            r = 103;
-            g = 234;
-            b = 148;
+            TFT_MESH_r = 103;
+            TFT_MESH_g = 234;
+            TFT_MESH_b = 148;
         } else if (selected == 3) {
             LOG_INFO("Setting color to Yellow");
-            r = 255;
-            g = 255;
-            b = 128;
+            TFT_MESH_r = 255;
+            TFT_MESH_g = 255;
+            TFT_MESH_b = 128;
         } else if (selected == 4) {
             LOG_INFO("Setting color to Red");
-            r = 255;
-            g = 64;
-            b = 64;
+            TFT_MESH_r = 255;
+            TFT_MESH_g = 64;
+            TFT_MESH_b = 64;
         } else if (selected == 5) {
             LOG_INFO("Setting color to Orange");
-            r = 255;
-            g = 160;
-            b = 20;
+            TFT_MESH_r = 255;
+            TFT_MESH_g = 160;
+            TFT_MESH_b = 20;
         } else if (selected == 6) {
             LOG_INFO("Setting color to Purple");
-            r = 204;
-            g = 153;
-            b = 255;
+            TFT_MESH_r = 204;
+            TFT_MESH_g = 153;
+            TFT_MESH_b = 255;
         } else if (selected == 7) {
             LOG_INFO("Setting color to Teal");
-            r = 64;
-            g = 224;
-            b = 208;
+            TFT_MESH_r = 64;
+            TFT_MESH_g = 224;
+            TFT_MESH_b = 208;
         } else if (selected == 8) {
             LOG_INFO("Setting color to Pink");
-            r = 255;
-            g = 105;
-            b = 180;
+            TFT_MESH_r = 255;
+            TFT_MESH_g = 105;
+            TFT_MESH_b = 180;
         } else if (selected == 9) {
             LOG_INFO("Setting color to White");
-            r = 255;
-            g = 255;
-            b = 255;
+            TFT_MESH_r = 255;
+            TFT_MESH_g = 255;
+            TFT_MESH_b = 255;
         }
 
 #if defined(HELTEC_MESH_NODE_T114) || defined(HELTEC_VISION_MASTER_T190) || HAS_TFT
@@ -731,14 +731,14 @@ void menuHandler::TFTColorPickerMenu(OLEDDisplay *display)
             display->fillRect(0, 0, SCREEN_WIDTH, SCREEN_HEIGHT);
             display->setColor(WHITE);
 
-            if (r == 0 && g == 0 && b == 0) {
+            if (TFT_MESH_r == 0 && TFT_MESH_g == 0 && TFT_MESH_b == 0) {
 #ifdef TFT_MESH_OVERRIDE
                 TFT_MESH = TFT_MESH_OVERRIDE;
 #else
                 TFT_MESH = COLOR565(0x67, 0xEA, 0x94);
 #endif
             } else {
-                TFT_MESH = COLOR565(r, g, b);
+                TFT_MESH = COLOR565(TFT_MESH_r, TFT_MESH_g, TFT_MESH_b);
             }
 
 #if defined(HELTEC_MESH_NODE_T114) || defined(HELTEC_VISION_MASTER_T190)
@@ -746,10 +746,10 @@ void menuHandler::TFTColorPickerMenu(OLEDDisplay *display)
 #endif
 
             screen->setFrames(graphics::Screen::FOCUS_SYSTEM);
-            if (r == 0 && g == 0 && b == 0) {
+            if (TFT_MESH_r == 0 && TFT_MESH_g == 0 && TFT_MESH_b == 0) {
                 uiconfig.screen_rgb_color = 0;
             } else {
-                uiconfig.screen_rgb_color = (r << 16) | (g << 8) | b;
+                uiconfig.screen_rgb_color = (TFT_MESH_r << 16) | (TFT_MESH_g << 8) | TFT_MESH_b;
             }
             LOG_INFO("Storing Value of %d to uiconfig.screen_rgb_color", uiconfig.screen_rgb_color);
             nodeDB->saveProto("/prefs/uiconfig.proto", meshtastic_DeviceUIConfig_size, &meshtastic_DeviceUIConfig_msg, &uiconfig);