Update to latest upstream

.checkpatch.conf

@@ -5,7 +5,6 @@
 --min-conf-desc-length=1
 --typedefsfile=scripts/checkpatch/typedefsfile
 
---ignore BRACES
 --ignore PRINTK_WITHOUT_KERN_LEVEL
 --ignore SPLIT_STRING
 --ignore VOLATILE
@@ -52,3 +51,4 @@
 --exclude lib/at_parser/generated
 --exclude lib/bin/lwm2m_carrier/include
 --exclude tests/lib/uicc_lwm2m
+--exclude subsys/nrf_compress/lzma

.github/test-spec.yml

@@ -1,5 +1,9 @@
 # This is the Jenkins ci variant of the .github/labler.yaml
 
+"__EXCLUDE__":
+  - "**/VERSION"
+  - "**/*.rst"
+
 "CI-run-twister":
   - any:
       - "!.github/**/*"
@@ -8,7 +12,6 @@
       - "!test-manifests/**/*"
       - "!CODEOWNERS"
       - "!LICENSE"
-      - "!**/*.rst"
       - "!VERSION"
       - "!ncs_version.h.in"
 
@@ -166,14 +169,20 @@
   - "samples/nrf5340/extxip_smp_svr/**/*"
   - "samples/bootloader/**/*"
   - "scripts/bootloader/**/*"
+  - "scripts/nrf_compress/**/*"
+  - "scripts/west_commands/ncs*"
   - "subsys/bootloader/**/*"
-  - "subsys/nonsecure/*"
   - "subsys/partition_manager/*"
   - "subsys/fw_info/**/*"
   - "subsys/mgmt/**/*"
   - "subsys/pcd/**/*"
+  - "subsys/nrf_security/**/*"
+  - "subsys/nrf_compress/**/*"
   - "tests/subsys/bootloader/**/*"
   - "tests/subsys/dfu/**/*"
+  - "tests/subsys/pcd/**/*"
+  - "tests/subsys/kmu/**/*"
+  - "tests/subsys/nrf_compress/**/*"
   - "tests/modules/mcuboot/**/*"
 
 "CI-all-test":
@@ -205,6 +214,7 @@
       - "!include/bluetooth/mesh/**/*"
   - "subsys/nrf_rpc/**/*"
   - "subsys/mpsl/**/*"
+  - "subsys/nrf_security/**/*"
   - "drivers/mpsl/**/*"
 
 "CI-ble-samples-test":
@@ -250,27 +260,6 @@
   - "tests/subsys/bluetooth/mesh/**/*"
   - "samples/bluetooth/mesh/**/*"
 
-"CI-zigbee-test":
-  - "include/zigbee/**/*"
-  - "samples/zigbee/**/*"
-  - "subsys/zigbee/**/*"
-  - "tests/subsys/zigbee/**/*"
-  - "subsys/mpsl/**/*"
-  - "subsys/ieee802154/**/*"
-  - "subsys/bootloader/**/*"
-  - "subsys/partition_manager/**/*"
-  - "subsys/dfu/**/*"
-  - "subsys/fw_info/*"
-  - "subsys/pcd/**/*"
-  - "subsys/bluetooth/controller/*"
-  - "subsys/bluetooth/services/nus.c"
-  - "drivers/mpsl/**/*"
-  - "dts/bindings/radio_fem/**/*"
-  - "applications/ipc_radio/**/*"
-  - "modules/nrfxlib/nrf_802154/**/*"
-  - "modules/mcuboot/**/*"
-  - "applications/zigbee_weather_station/**/*"
-
 "CI-thingy91-test":
   - "modules/cjson/**/*"
   - "modules/azure-sdk-for-c/**/*"
@@ -279,7 +268,6 @@
   - "subsys/net/lib/azure_iot_hub/**/*"
   - "lib/date_time/**/*"
   - "drivers/sensor/sensor_sim/**/*"
-  - "applications/asset_tracker_v2/**/*"
   - "samples/net/aws_iot/**/*"
   - "samples/net/azure_iot_hub/**/*"
   - "samples/net/coap_client/**/*"
@@ -342,6 +330,10 @@
   - "subsys/mpsl/**/*"
   - "subsys/ieee802154/**/*"
   - "subsys/nrf_rpc/**/*"
+  - any:
+      - "subsys/nrf_security/**/*"
+      - "!subsys/nrf_security/doc/**/*"
+      - "!subsys/nrf_security/*.rst"
   - "drivers/mpsl/**/*"
   - "dts/bindings/radio_fem/**/*"
   - "applications/ipc_radio/**/*"
@@ -371,6 +363,7 @@
   - "drivers/hw_cc3xx/*"
   - "drivers/entropy/*"
   - "modules/nrfxlib/nrf_802154/**/*"
+  - "modules/openthread/**/*"
 
 "CI-nfc-test":
   - "subsys/nfc/**/*"
@@ -571,19 +564,6 @@
   - "subsys/partition_manager/**/*"
   - "tests/subsys/net/lib/nrf_cloud/**/*"
 
-"CI-sidewalk-test":
-  - "subsys/bootloader/**/*"
-  - "subsys/partition_manager/**/*"
-  - "subsys/dfu/**/*"
-  - "modules/mcuboot/**/*"
-  - "subsys/fw_info/*"
-  - "subsys/pcd/**/*"
-  - "subsys/bluetooth/controller/*"
-  - any:
-      - "subsys/nrf_security/**/*"
-      - "!subsys/nrf_security/doc/**/*"
-      - "!subsys/nrf_security/*.rst"
-
 "CI-suit-dfu-test":
   - "include/bl*"
   - "include/fprotect.h"
@@ -610,22 +590,45 @@
 
 "CI-test-low-level":
   - "applications/sdp/**/*"
+  - "boards/nordic/nrf54lm20apdk/**/*"
+  - "boards/nordic/nrf54lv10apdk/**/*"
   - "drivers/gpio/**/*"
   - "dts/bindings/gpio/**/*"
   - "include/drivers/gpio/**/*"
   - "include/event_manager_proxy.h"
   - "subsys/event_manager_proxy/**/*"
+  - "samples/zephyr/drivers/adc/**/*"
+  - "samples/zephyr/drivers/audio/**/*"
+  - "samples/zephyr/drivers/i2c/**/*"
+  - "samples/zephyr/drivers/watchdog/**/*"
+  - "samples/zephyr/boards/nordic/**/*"
   - "samples/ipc/**/*"
   - "samples/event_manager_proxy/**/*"
   - "samples/peripheral/lpuart/**/*"
+  - "samples/zephyr/sensor/qdec/**/*"
+  - "samples/zephyr/subsys/settings/**/*"
   - "snippets/sdp/**/*"
-  - "tests/subsys/event_manager_proxy/**/*"
+  - "snippets/nrf54l09-switch-uart/**/*"
+  - "soc/nordic/nrf54l/**/*"
   - "tests/benchmarks/multicore/idle/**/*"
+  - "tests/drivers/audio/**/*"
   - "tests/drivers/gpio/**/*"
   - "tests/drivers/lpuart/**/*"
   - "tests/drivers/pwm/**/*"
   - "tests/drivers/sensor/**/*"
-  - "tests/drivers/audio/**/*"
+  - "tests/drivers/spi/**/*"
+  - "tests/drivers/uart/**/*"
+  - "tests/subsys/event_manager_proxy/**/*"
+  - "tests/zephyr/boards/nrf/**/*"
+  - "tests/zephyr/drivers/adc/**/*"
+  - "tests/zephyr/drivers/comparator/**/*"
+  - "tests/zephyr/drivers/flash/**/*"
+  - "tests/zephyr/drivers/gpio/**/*"
+  - "tests/zephyr/drivers/i2c/**/*"
+  - "tests/zephyr/drivers/mspi/**/*"
+  - "tests/zephyr/drivers/retained_mem/**/*"
+  - "tests/zephyr/drivers/uart/**/*"
+  - "tests/zephyr/drivers/watchdog/**/*"
 
 "CI-ps-test":
   - "samples/nrf_rpc/protocols_serialization/**/*"

.github/workflows/backport.yml

@@ -24,7 +24,7 @@ jobs:
       )
     steps:
       - name: Backport
-        uses: zephyrproject-rtos/action-backport@v2.0.3-3
+        uses: zephyrproject-rtos/action-backport@6b0bae5b575d289305a22ab11a273941b518994c # v2.0.3-3
         with:
           github_token: ${{ secrets.NCS_GITHUB_TOKEN }}
           issue_labels: Backport

.github/workflows/compliance.yml

@@ -18,7 +18,7 @@ jobs:
         git-ref: ${{ github.event.pull_request.head.sha }}
 
     - name: cache-pip
-      uses: actions/cache@v3
+      uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3
       with:
         path: ~/.cache/pip
         key: ${{ runner.os }}-doc-pip
@@ -27,8 +27,8 @@ jobs:
       working-directory: ncs/nrf
       run: |
         pip3 install -U pip
-        pip3 install -U setuptools
         pip3 install -U wheel
+        grep -E "^setuptools" scripts/requirements-fixed.txt | cut -d ' ' -f '1' | xargs pip3 install -U
         grep -E "^python-magic=|^junitparser|^lxml|^gitlint|^pylint|^pykwalify|^yamllint|^unidiff" scripts/requirements-fixed.txt | cut -d ' ' -f '1' | xargs pip3 install -U
         grep -E "^west" scripts/requirements-fixed.txt | cut -d ' ' -f '1' | xargs pip3 install -U
         pip3 show -f west
@@ -70,10 +70,10 @@ jobs:
         git log --pretty=oneline | head -n 10
         # For now we run KconfigBasic, but we should transition to Kconfig
         $ZEPHYR_BASE/scripts/ci/check_compliance.py --annotate -e Kconfig \
-        -e KconfigBasicNoModules -e ClangFormat -c origin/${BASE_REF}..
+        -e KconfigBasicNoModules -e ClangFormat -e Ruff -c origin/${BASE_REF}..
 
     - name: upload-results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
       continue-on-error: true
       if: contains(github.event.pull_request.user.login, 'dependabot[bot]') != true
       with:
@@ -106,3 +106,28 @@ jobs:
         if [ "${exit}" == "1" ]; then
           exit 1;
         fi
+
+    - name: Check added or updated links
+      working-directory: ncs/nrf
+      run: |
+        RE=".. _\`(.*)\`: (.*)"
+        LINKS=$(git diff --unified=0 "${{ github.event.pull_request.base.sha }}..HEAD" -- "doc/nrf/links.txt" | \
+                grep "^+" || true | \
+                grep -Ev "^(---|\+\+\+)" || true)
+
+        while IFS= read -r link; do
+          if [[ $link =~ $RE ]]; then
+            NAME=${BASH_REMATCH[1]}
+            URL=${BASH_REMATCH[2]}
+
+            echo -n "Checking URL for '$NAME' ($URL)... "
+            status=$(curl --write-out "%{http_code}" --output /dev/null --silent --head "$URL" || true)
+
+            if [[ "$status" -ne 200 ]]; then
+              echo "FAIL (HTTP code: ${status})"
+                exit 1
+              else
+                echo "OK"
+              fi
+          fi
+        done <<< "$LINKS"

.github/workflows/contribs.yml

@@ -9,7 +9,7 @@ jobs:
     name: Contribs
     steps:
       - name: Contribs
-        uses: carlescufi/action-contribs@main
+        uses: carlescufi/action-contribs@d139e12dabbe631fcc94ec3e19e386a11d3e1a26 # main
         with:
           github-token: ${{ secrets.NCS_GITHUB_TOKEN }}
           command: 'external'

.github/workflows/docbuild.yml

@@ -34,9 +34,19 @@ jobs:
     steps:
       - name: Checkout sources
         uses: nrfconnect/action-checkout-west-update@main
+        with:
+          git-fetch-depth: 0
+
+      - name: Rebase
+        if: github.event_name == 'pull_request'
+        working-directory: ncs/nrf
+        run: |
+          git config --global user.email "bot@github.com"
+          git config --global user.name "Github Actions"
+          git rebase origin/${{ github.base_ref }}
 
       - name: cache-pip
-        uses: actions/cache@v4
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-doc-pip
@@ -133,7 +143,7 @@ jobs:
 
             # Patch links from Sphinx to Doxygen APIs
             find doc/_build/html/$docset -type f -name "*.html" -exec \
-              sed -ri "/href=\"(.*)\/doxygen\/html\/(.*)\"/{s//href=\"\1\/..\/..\/..\/$docset-apis-$VERSION\/page\/\2\"/; :a s/__/_/;ta; }" {} \;
+              sed -ri "/href=\"([^\"]+)\/doxygen\/html\/([^\"]+)\"/{s//href=\"\1\/..\/..\/..\/$docset-apis-$VERSION\/page\/\2\"/g; :a s/__/_/g;ta; }" {} \;
 
             pushd "$OUTDIR"
             ARCHIVE="$docset-apis-$VERSION.zip"
@@ -143,11 +153,11 @@ jobs:
           done
 
           # Doxygen APIs standalone
-          declare -a DOXYGEN=("nrfx")
+          declare -a DOXYGEN=("nrfx" "wifi")
 
           for docset in "${DOXYGEN[@]}"; do
             OUTDIR=doc/_build/html-doxygen/$docset-apis
-            mv doc/_build/html/$docset "$OUTDIR"
+            mv doc/_build/html/$docset/html "$OUTDIR"
 
             # Populate custom.properties, tags.yml
             cp doc/_zoomin/$docset.apis.custom.properties "$OUTDIR/custom.properties"
@@ -178,12 +188,39 @@ jobs:
           zip -rq "$ARCHIVE" .
           mv "$ARCHIVE" "$ROOT"
           popd
+
+      - name: Find nRF Connect SDK Edited Documents
+        working-directory: ncs/nrf
+        run: |
+          COMMENT="comment.txt"
+          PREFIX="https://ncsdoc.z6.web.core.windows.net/PR-${{ github.event.pull_request.number }}/"
+          CHANGED=$(git diff --name-only --diff-filter=d "${{ github.event.pull_request.base.sha }}..HEAD")
+
+          echo "You can find the documentation preview for this PR [here](${PREFIX})." >> $COMMENT
+
+          NRF=$(echo "$CHANGED" | \
+                grep -e "doc/nrf/" | \
+                grep -e ".rst" | \
+                sed -e "s#^doc/nrf\(.*\)\.rst#${PREFIX}nrf\1.html#g")
+
+          NRF_EXT=$(echo "$CHANGED" | \
+                    grep -e "applications/" -e "samples/" -e "scripts/" -e "tests/" | \
+                    grep -e ".rst" | \
+                    sed -e "s#^\(applications\|samples\|scripts\|tests\)\(.*\)\.rst#${PREFIX}nrf\/\1\2.html#g")
+
+          NRF_ALL=$(printf "$NRF\n$NRF_EXT")
+
+          if [ ! -z "$NRF_ALL" ]; then
+            printf "\nPreview links for modified nRF Connect SDK documents:\n\n$NRF_ALL" >> $COMMENT
+          fi
+
       - name: Store
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'external') || contains(github.event.pull_request.labels.*.name, 'CI-trusted-author') }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
         with:
           name: docs
           path: |
             ncs/nrf/*.zip
             ncs/nrf/monitor*.txt
             ncs/nrf/pr.txt
+            ncs/nrf/comment.txt

.github/workflows/docker.yml

@@ -11,13 +11,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: NordicBuilder