Upmerge to 6edb06e

.github/workflows/build.yml

@@ -49,11 +49,11 @@ jobs:
  runs-on: ubuntu-22.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -71,11 +71,11 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
  with:
  use-verbose-mode: 'yes'
@@ -85,17 +85,17 @@ jobs:
  runs-on: ubuntu-22.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
  run: |
  python -m pip install --upgrade pip
- pip install codespell
+ pip install --force-reinstall codespell==2.2.4
  - name: Check
  run: |
  script/code-spell check
@@ -104,11 +104,11 @@ jobs:
  runs-on: ubuntu-20.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -144,11 +144,11 @@ jobs:
  CXX: ${{ matrix.compiler_cpp }}
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -163,11 +163,11 @@ jobs:
  runs-on: ubuntu-22.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -182,21 +182,21 @@ jobs:
  runs-on: ubuntu-20.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
  run: |
  sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev
  rm -rf third_party/mbedtls/repo
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  repository: ARMmbed/mbedtls
- ref: v3.2.1
+ ref: v3.5.0
  path: third_party/mbedtls/repo
  - name: Build
  run: |
@@ -235,11 +235,11 @@ jobs:
  gcc_extract_dir: arm-gnu-toolchain-12.2.rel1-x86_64-arm-none-eabi
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -276,11 +276,11 @@ jobs:
  CXX: g++-${{ matrix.gcc_ver }}
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -309,11 +309,11 @@ jobs:
  CXX: clang++-${{ matrix.clang_ver }}
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -347,11 +347,11 @@ jobs:
  LDFLAGS: -m32
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -375,11 +375,11 @@ jobs:
  runs-on: ubuntu-20.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -411,11 +411,11 @@ jobs:
  CXX: ${{ matrix.CXX }}
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap
@@ -435,11 +435,11 @@ jobs:
  image: openthread/environment
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Install unzip

.github/workflows/codeql.yml

@@ -54,19 +54,19 @@ jobs:
 
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
  - name: Checkout repository
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
  - name: Bootstrap
  run: |
  sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev
 
  - name: Initialize CodeQL
- uses: github/codeql-action/init@a09933a12a80f87b87005513f0abb1494c27a716 # v2.21.4
+ uses: github/codeql-action/init@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
  with:
  languages: ${{ matrix.language }}
  # If you wish to specify custom queries, you can do so here or in a config file.
@@ -80,6 +80,6 @@ jobs:
  ./script/test build
 
  - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@a09933a12a80f87b87005513f0abb1494c27a716 # v2.21.4
+ uses: github/codeql-action/analyze@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
  with:
  category: "/language:${{matrix.language}}"

.github/workflows/docker.yml

@@ -55,11 +55,11 @@ jobs:
  - docker_name: environment
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
 

.github/workflows/fuzz.yml

@@ -45,7 +45,7 @@ jobs:
  runs-on: ubuntu-20.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 

.github/workflows/makefile-check.yml

@@ -48,11 +48,11 @@ jobs:
  runs-on: ubuntu-20.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Check

.github/workflows/otbr.yml

@@ -62,7 +62,7 @@ jobs:
  # of OMR prefix and Domain prefix is not deterministic.
  BORDER_ROUTING: 0
  steps:
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Build OTBR Docker
@@ -156,6 +156,13 @@ jobs:
  packet_verification: 2
  nat64: 0
  description: ""
+ - otbr_mdns: "avahi"
+ otbr_trel: 0
+ cert_scripts: ./tests/scripts/thread-cert/border_router/*.py
+ packet_verification: 1
+ nat64: 0
+ use_core_firewall: 1
+ description: "core firewall"
  name: BR ${{ matrix.description }} (${{ matrix.otbr_mdns }}, TREL=${{matrix.otbr_trel}})
  env:
  REFERENCE_DEVICE: 1
@@ -172,7 +179,11 @@ jobs:
  NAT64: ${{ matrix.nat64 }}
  MAX_JOBS: 3
  steps:
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+ - name: Set firewall environment variables
+ if: ${{ matrix.use_core_firewall }}
+ run: |
+ echo "FIREWALL=0" >> $GITHUB_ENV
  - name: Build OTBR Docker
  env:
  GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -223,7 +234,7 @@ jobs:
  - thread-border-router
  runs-on: ubuntu-20.04
  steps:
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
  - name: Bootstrap

.github/workflows/otci.yml

@@ -57,11 +57,11 @@ jobs:
  REAL_DEVICE: 0
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  - name: Bootstrap
  run: |
  sudo rm /etc/apt/sources.list.d/* && sudo apt-get update

.github/workflows/otns.yml

@@ -58,11 +58,11 @@ jobs:
  runs-on: ubuntu-22.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
  with:
  go-version: "1.20"
@@ -101,7 +101,7 @@ jobs:
  name: Examples
  runs-on: ubuntu-22.04
  steps:
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
  with:
  go-version: "1.20"
@@ -159,11 +159,11 @@ jobs:
  STRESS_LEVEL: ${{ matrix.stress_level }}
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
  with:
  go-version: "1.20"
@@ -206,11 +206,11 @@ jobs:
  runs-on: ubuntu-22.04
  steps:
  - name: Harden Runner
- uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+ uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
  with:
  egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  - name: Bootstrap
  run: |
  sudo apt-get --no-install-recommends install -y lcov