Add upstream integration and release workflows for toolkit updates

.github/scripts/download_archive.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Copyright 2026 Elektrobit. All rights reserved.
+#
+# Download the upstream toolkit archive, extract it into a temporary directory
+# and print the resulting paths as KEY=VALUE lines on stdout.
+#
+# Usage: download_archive.sh --url <URL> --token <TOKEN>
+set -euo pipefail
+
+url=""
+token=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --url)   url="$2"; shift 2 ;;
+    --token) token="$2"; shift 2 ;;
+    *) echo "Unknown argument: $1" >&2; exit 1 ;;
+  esac
+done
+
+if [[ -z "${url}" ]]; then
+  echo "ERROR: Required argument --url is not set." >&2
+  exit 1
+fi
+
+if [[ -z "${token}" ]]; then
+  echo "ERROR: Required argument --token is not set." >&2
+  exit 1
+fi
+
+tmp_dir="$(mktemp -d)"
+archive_path="${tmp_dir}/eb_corbos_toolkit.tar.gz"
+extract_root="${tmp_dir}/extracted"
+
+mkdir -p "${extract_root}"
+
+echo "Starting upstream delivery archive download (this may take a while for large files)..." >&2
+echo "Download target: ${archive_path}" >&2
+
+curl \
+  --fail \
+  --progress-bar \
+  --show-error \
+  --location \
+  --retry 3 \
+  --retry-delay 5 \
+  --retry-all-errors \
+  --header "Authorization: Bearer ${token}" \
+  --output "${archive_path}" \
+  --url "${url}"
+
+archive_size_bytes="$(wc -c < "${archive_path}")"
+archive_size_mib="$(awk "BEGIN { printf \"%.2f\", ${archive_size_bytes}/1024/1024 }")"
+echo "Download complete: ${archive_size_bytes} bytes (${archive_size_mib} MiB)." >&2
+
+echo "Starting upstream delivery archive extraction into ${extract_root}..." >&2
+
+tar -xzf "${archive_path}" -C "${extract_root}"
+
+echo "Extraction complete." >&2
+
+toolkit_root="${extract_root}/eb_corbos_toolkit"
+workspace_root="${toolkit_root}/workspace"
+devcontainer_archive="${toolkit_root}/containers/devcontainer-trixie-ebclfsa-amd64.docker-archive.zst"
+buildcontainer_archive="${toolkit_root}/containers/buildcontainer-trixie-ebclfsa-amd64.docker-archive.zst"
+run_script="${workspace_root}/scripts/run.sh"
+bitbake_execution_fixer="${workspace_root}/.devcontainer/scripts/check_userns_restriction.sh"
+manual_pdf="${toolkit_root}/doc/user_manual.pdf"
+manual_html_dir="${toolkit_root}/doc/html"
+prebuilt_dir="${workspace_root}/prebuilt"
+
+echo "Validating extracted layout..." >&2
+for f in "${devcontainer_archive}" "${buildcontainer_archive}" "${run_script}" "${bitbake_execution_fixer}" "${manual_pdf}"; do
+  if [[ ! -f "${f}" ]]; then
+    echo "ERROR: Expected file not found in extracted upstream delivery archive: ${f}" >&2
+    exit 1
+  fi
+done
+for d in "${manual_html_dir}" "${prebuilt_dir}"; do
+  if [[ ! -d "${d}" ]]; then
+    echo "ERROR: Expected directory not found in extracted upstream delivery archive: ${d}" >&2
+    exit 1
+  fi
+done
+echo "Extracted layout looks good." >&2
+
+cat << EOF
+TMP_WORK_DIR=${tmp_dir}
+EXTRACT_ROOT=${extract_root}
+ARCHIVE_PATH=${archive_path}
+WORKSPACE_ROOT=${workspace_root}
+DEVCONTAINER_ARCHIVE=${devcontainer_archive}
+BUILDCONTAINER_ARCHIVE=${buildcontainer_archive}
+DEVCONTAINER_IMAGE=ghcr.io/elektrobit/eb-corbos-toolkit-devcontainer-amd64
+BUILDCONTAINER_IMAGE=ghcr.io/elektrobit/eb-corbos-toolkit-buildcontainer-amd64
+RUN_SCRIPT=${run_script}
+BITBAKE_EXECUTION_FIXER=${bitbake_execution_fixer}
+MANUAL_PDF=${manual_pdf}
+MANUAL_HTML_DIR=${manual_html_dir}
+PREBUILT_DIR=${prebuilt_dir}
+EOF

.github/scripts/integrate_workspace.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Copyright 2026 Elektrobit. All rights reserved.
+#
+# Replace the integration repository's working tree with the upstream workspace,
+# preserving repository-owned metadata files. Must be run from the root of the
+# integration repository checkout.
+#
+# Usage: integrate_workspace.sh --workspace-root <DIR>
+set -euo pipefail
+
+workspace_root=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --workspace-root) workspace_root="$2"; shift 2 ;;
+    *) echo "Unknown argument: $1" >&2; exit 1 ;;
+  esac
+done
+
+if [[ -z "${workspace_root}" ]]; then
+  echo "ERROR: Required argument --workspace-root is not set." >&2
+  exit 1
+fi
+
+if [[ ! -d "${workspace_root}" ]]; then
+  echo "ERROR: Workspace root '${workspace_root}' does not exist." >&2
+  exit 1
+fi
+
+# Remove all tracked and untracked content except the repository metadata and
+# files that must remain in the integration repository. Add entries to this list
+# when additional repository-owned content should be preserved.
+preserve_paths=(
+  '.git'
+  '.github'
+  '.gitignore'
+  'CODE_OF_CONDUCT.md'
+  'README.md'
+)
+
+while IFS= read -r -d '' path; do
+  name="${path#./}"
+  preserve=false
+  for preserve_path in "${preserve_paths[@]}"; do
+    if [[ "${name}" == "${preserve_path}" ]]; then
+      preserve=true
+      break
+    fi
+  done
+
+  if [[ "${preserve}" != true ]]; then
+    rm -rf -- "${path}"
+  fi
+done < <(find . -mindepth 1 -maxdepth 1 -print0)
+
+# Copy the upstream workspace on top, preserving flags, mtimes, ownership.
+# Ignore the "prebuilt" and "build" sub-folders.
+rsync -a --exclude='prebuilt' --exclude='build' "${workspace_root}/." .

.github/scripts/package_release_assets.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Copyright 2026 Elektrobit. All rights reserved.
+#
+# Collect the release assets (toolkit archive, user manual, prebuilt per-target
+# images, SDK sysroots and SSH keys) into a single directory and print its path
+# as a KEY=VALUE line on stdout.
+#
+# Usage: package_release_assets.sh --tmp-work-dir <DIR> --archive-path <FILE> \
+#          --manual-pdf <FILE> --manual-html-dir <DIR> --prebuilt-dir <DIR>
+set -euo pipefail
+
+tmp_work_dir=""
+archive_path=""
+manual_pdf=""
+manual_html_dir=""
+prebuilt_dir=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --tmp-work-dir)   tmp_work_dir="$2"; shift 2 ;;
+    --archive-path)   archive_path="$2"; shift 2 ;;
+    --manual-pdf)     manual_pdf="$2"; shift 2 ;;
+    --manual-html-dir) manual_html_dir="$2"; shift 2 ;;
+    --prebuilt-dir)   prebuilt_dir="$2"; shift 2 ;;
+    *) echo "Unknown argument: $1" >&2; exit 1 ;;
+  esac
+done
+
+for arg_name in tmp_work_dir archive_path manual_pdf manual_html_dir prebuilt_dir; do
+  if [[ -z "${!arg_name}" ]]; then
+    echo "ERROR: Required argument --${arg_name//_/-} is not set." >&2
+    exit 1
+  fi
+done
+
+assets_dir="${tmp_work_dir}/release-assets"
+mkdir -p "${assets_dir}"
+
+mv "${archive_path}" "${assets_dir}/eb_corbos_toolkit.tar.gz"
+cp "${manual_pdf}" "${assets_dir}/user_manual.pdf"
+tar -czf "${assets_dir}/user_manual_html.tar.gz" -C "${manual_html_dir}" .
+
+# Per-target assets: one image archive (named after its .wic file), the SDK
+# sysroot tarball and the SSH target key for every target directory.
+for target_dir in "${prebuilt_dir}"/*/; do
+  [[ -d "${target_dir}" ]] || continue
+
+  image_dir="${target_dir}image"
+  if [[ -d "${image_dir}" ]]; then
+    wic_file="$(find "${image_dir}" -maxdepth 1 -name '*.wic' -print -quit)"
+    if [[ -z "${wic_file}" ]]; then
+      echo "ERROR: No .wic file found in ${image_dir}." >&2
+      exit 1
+    fi
+    image_base="$(basename "${wic_file}" .wic)"
+    tar -czf "${assets_dir}/${image_base}.tar.gz" -C "${image_dir}" .
+  fi
+
+  sdk_dir="${target_dir}sysroot"
+  if [[ -d "${sdk_dir}" ]]; then
+    find "${sdk_dir}" -maxdepth 1 -type f -exec cp {} "${assets_dir}/" \;
+  fi
+
+  key_dir="${target_dir}ssh_keys"
+  if [[ -d "${key_dir}" ]]; then
+    find "${key_dir}" -maxdepth 1 -type f -exec cp {} "${assets_dir}/" \;
+  fi
+done
+
+echo "RELEASE_ASSETS_DIR=${assets_dir}"

.github/scripts/qemu_smoke_test.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# Copyright 2026 Elektrobit. All rights reserved.
+#
+# Smoke test: boot the freshly built "fastdev" image in QEMU inside the
+# devcontainer, wait for SSH availability, power it down cleanly and confirm the
+# shutdown message appears in the QEMU log.
+#
+# Usage: qemu_smoke_test.sh --workspace-root <DIR> --run-script <PATH>
+set -euo pipefail
+
+workspace_root=""
+run_script=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --workspace-root) workspace_root="$2"; shift 2 ;;
+    --run-script)     run_script="$2"; shift 2 ;;
+    *) echo "Unknown argument: $1" >&2; exit 1 ;;
+  esac
+done
+
+if [[ -z "${workspace_root}" ]]; then
+  echo "ERROR: Required argument --workspace-root is not set." >&2
+  exit 1
+fi
+
+if [[ -z "${run_script}" ]]; then
+  echo "ERROR: Required argument --run-script is not set." >&2
+  exit 1
+fi
+
+cd "${workspace_root}"
+
+# Run the dev container in detached mode and keep it running.
+export EXTRA_DOCKER_OPTIONS="-d --log-driver local"
+LOG_FILE=$(mktemp -t ebcl_run_devcontainer-XXXXXX.log 2>/dev/null) ||
+  LOG_FILE="/tmp/ebcl_run_devcontainer.log"
+
+echo "Starting devcontainer in the background" >&2
+DEV_CONTAINER_ID=$("${run_script}" -d -- bash -c "sleep infinity" 2>&1 | tee "${LOG_FILE}" | grep -oE '^[0-9a-f]{64}$')
+if [[ -z "${DEV_CONTAINER_ID}" ]]; then
+  echo "ERROR: Failed to start devcontainer. Log output:" >&2
+  cat "${LOG_FILE}" >&2
+  exit 1
+fi
+
+echo "DEV_CONTAINER_ID=${DEV_CONTAINER_ID}"
+sleep 10
+
+devcontainer_exec() {
+  docker exec "${DEV_CONTAINER_ID}" "$@"
+}
+
+echo "Running fastdev in qemu in background, logging to qemu.log" >&2
+devcontainer_exec bash -c "./scripts/qemu.sh -t fastdev < /dev/null > qemu.log 2>&1 &" >&2
+devcontainer_exec bash -c \
+  "log=/workspace/qemu.log; source /workspace/scripts/includes/common/common.inc; wait_for_ssh fastdev-qemuarm64 70 1" >&2
+
+echo "Terminating fastdev" >&2
+devcontainer_exec ssh fastdev-qemuarm64 crinit-ctl poweroff >&2 || true
+
+echo "Waiting for fastdev to power down" >&2
+max_tries=20
+msg="Power down"
+log="${workspace_root}/qemu.log"
+
+for i in $(seq 1 "${max_tries}"); do
+  if grep -q "${msg}" "${log}" 2>/dev/null; then
+    echo "Waiting for \"${msg}\" message in ${log} succeeded" >&2
+    rm -f "${log}"
+    exit 0
+  fi
+  echo "Waiting for \"${msg}\" message in ${log} ... (${i}/${max_tries})" >&2
+  sleep 1
+done
+
+echo "ERROR: Waiting for \"${msg}\" message in ${log} timed out!" >&2
+cat "${log}" >&2
+exit 1