openpilot v0.10.3 release

date: 2025-12-18T23:23:16
master commit: 3cdee7b54718ee14bd85befd6c5bad3d699c5479

panda/.github/workflows/jenkins-pr-trigger.yaml

@@ -0,0 +1,45 @@
+name: jenkins scan
+
+on:
+  issue_comment:
+    types: [created, edited]
+
+jobs:
+  # TODO: gc old branches in a separate job in this workflow
+  scan-comments:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.issue.pull_request }}
+    steps:
+    - name: Check for trigger phrase
+      id: check_comment
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const triggerPhrase = "trigger-jenkins";
+          const comment = context.payload.comment.body;
+          const commenter = context.payload.comment.user.login;
+
+          const { data: permissions } = await github.rest.repos.getCollaboratorPermissionLevel({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            username: commenter
+          });
+
+          const hasWriteAccess = permissions.permission === 'write' || permissions.permission === 'admin';
+
+          return (hasWriteAccess && comment.includes(triggerPhrase));
+        result-encoding: json
+
+    - name: Checkout repository
+      if: steps.check_comment.outputs.result == 'true'
+      uses: actions/checkout@v4
+      with:
+        ref: refs/pull/${{ github.event.issue.number }}/head
+
+    - name: Push to tmp-jenkins branch
+      if: steps.check_comment.outputs.result == 'true'
+      run: |
+        git config --global user.name "github-actions[bot]"
+        git config --global user.email "github-actions[bot]@users.noreply.github.com"
+        git checkout -b tmp-jenkins-${{ github.event.issue.number }}
+        GIT_LFS_SKIP_PUSH=1 git push -f origin tmp-jenkins-${{ github.event.issue.number }}

panda/.github/workflows/test.yaml

@@ -0,0 +1,83 @@
+name: tests
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref != 'refs/heads/master' && github.ref || github.run_id }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+env:
+  RUN: source .venv/bin/activate && /bin/bash -c
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - run: ./setup.sh
+      - name: Test python package installer
+        run: ${{ env.RUN }} "pip install --break-system-packages .[dev]"
+      - name: Build panda images and bootstub
+        run: ${{ env.RUN }} "scons -j4"
+      - name: Build with UBSan
+        run: ${{ env.RUN }} "scons -j4 --ubsan"
+      - name: Build jungle firmware with FINAL_PROVISIONING support
+        run: ${{ env.RUN }} "FINAL_PROVISIONING=1 scons -j4 board/jungle"
+      - name: Build panda in release mode
+        run: ${{ env.RUN }} "CERT=certs/debug RELEASE=1 scons -j4"
+
+  test:
+    name: ./test.sh
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ['macos-latest', 'ubuntu-latest']
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - run: ./test.sh
+
+  misra_linter:
+    name: MISRA C:2012 Linter
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Cache cppcheck
+        id: cppcheck-cache
+        uses: actions/cache@v4
+        with:
+          path: tests/misra/cppcheck
+          key: cppcheck-${{ hashFiles('tests/misra/*') }}
+      - run: ./setup.sh
+      - name: Build FW
+        run: ${{ env.RUN }} "scons -j$(nproc)"
+      - name: Run MISRA C:2012 analysis
+        run: ${{ env.RUN }} "cd tests/misra && ./test_misra.sh"
+
+  misra_mutation:
+    name: MISRA C:2012 Mutation
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Cache cppcheck
+        id: cppcheck-cache
+        uses: actions/cache@v4
+        with:
+          path: tests/misra/cppcheck
+          key: cppcheck-${{ hashFiles('tests/misra/*') }}
+      - run: ./setup.sh
+      - name: Build FW
+        run: ${{ env.RUN }} "scons -j$(nproc)"
+      - name: tests/misra/install.sh
+        run: ${{ env.RUN }} "cd tests/misra && ./install.sh"
+      - name: MISRA mutation tests
+        run: ${{ env.RUN }} "cd tests/misra && pytest test_mutation.py"

panda/.github/workflows/update-cppcheck.yml

@@ -0,0 +1,37 @@
+name: Update cppcheck
+
+on:
+  #push:
+  schedule:
+    - cron: "0 14 * * 1" # every Monday at 2am UTC (6am PST)
+  workflow_dispatch:
+
+jobs:
+  update-cppcheck:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get latest cppcheck version
+        id: version
+        run: |
+          LATEST=$(curl -fsSL https://api.github.com/repos/danmar/cppcheck/releases/latest | jq -r .tag_name)
+          echo "vers=$LATEST" >> "$GITHUB_OUTPUT"
+      - name: Update VERS in install.sh
+        run: |
+          sed -i "s/^VERS=\".*\"/VERS=\"${{ steps.version.outputs.vers }}\"/" tests/misra/install.sh
+          grep VERS tests/misra/install.sh
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83
+        with:
+          author: Vehicle Researcher <user@comma.ai>
+          token: ${{ secrets.ACTIONS_CREATE_PR_PAT }}
+          commit-message: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
+          title: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
+          body: "See all cppcheck releases: https://github.com/danmar/cppcheck/releases"
+          branch: "update-cppcheck"
+          base: "master"
+          delete-branch: true
+          labels: bot