Run Linux CI in the shared Docker image

.github/actions/setup-ibmswtpm/action.yml

@@ -57,7 +57,7 @@ runs:
           VARIANT="mlo${VARIANT}"
         fi
         echo "sha=$SHA" >> "$GITHUB_OUTPUT"
-        echo "cache-key=ibmswtpm2-${{ runner.os }}-${SHA}-${VARIANT}-v1" >> "$GITHUB_OUTPUT"
+        echo "cache-key=ibmswtpm2-${{ runner.os }}-${SHA}-${VARIANT}-${WOLFTPM_CI_IMAGE:-native}-v1" >> "$GITHUB_OUTPUT"
         echo "ibmswtpm2 ${{ inputs.ref }} -> $SHA (variant $VARIANT)"
 
     - name: Restore ibmswtpm2 build cache

.github/actions/setup-wolfcose/action.yml

@@ -68,7 +68,7 @@ runs:
             "${{ inputs.make-target }}" \
             "${{ inputs.cc }}" | $HASH_CMD | cut -c1-16)
         echo "sha=$SHA" >> "$GITHUB_OUTPUT"
-        echo "cache-key=wolfcose-${{ runner.os }}-${SHA}-${CFGHASH}-v1" >> "$GITHUB_OUTPUT"
+        echo "cache-key=wolfcose-${{ runner.os }}-${SHA}-${CFGHASH}-${WOLFTPM_CI_IMAGE:-native}-v1" >> "$GITHUB_OUTPUT"
         echo "wolfCOSE ${{ inputs.ref }} -> $SHA (cfg $CFGHASH)"
 
     - name: Restore wolfCOSE build cache

.github/actions/setup-wolfssl/action.yml

@@ -72,7 +72,7 @@ runs:
             "${{ inputs.cc }}" \
             "${{ inputs.prefix }}" | $HASH_CMD | cut -c1-16)
         echo "sha=$SHA" >> "$GITHUB_OUTPUT"
-        echo "cache-key=wolfssl-${{ runner.os }}-${SHA}-${CFGHASH}-v1" >> "$GITHUB_OUTPUT"
+        echo "cache-key=wolfssl-${{ runner.os }}-${SHA}-${CFGHASH}-${WOLFTPM_CI_IMAGE:-native}-v1" >> "$GITHUB_OUTPUT"
         echo "wolfSSL ${{ inputs.ref }} -> $SHA (cfg $CFGHASH)"
 
     - name: Restore wolfSSL build cache

.github/docker/wolftpm-ci/Dockerfile

@@ -1,37 +1,73 @@
-# wolfTPM CI base image.
-#
-# Bakes the apt dependencies that wolfTPM CI jobs install on every run so
-# the apt mirror is never contacted on the happy path (the source of the
-# intermittent `apt-get update` timeouts). Mirrors the wolfBoot CI image
-# model (ghcr.io/wolfssl/wolfboot-ci-*): jobs run inside this image via
-# `container: image: ghcr.io/wolfssl/wolftpm-ci:<tag>` instead of calling
-# `sudo apt-get install`.
-#
-# Built and pushed by .github/workflows/publish-ci-image.yml. Pin consumers
-# to a version tag (e.g. :v1.0), never :latest, and bump the tag when this
-# file changes.
+# Shared image for every wolfTPM Linux CI workload.
+# Install system dependencies here, never in workflows or composite actions.
+# Publish and verify the versioned image before updating its consumers.
 FROM ubuntu:24.04
 
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install --no-install-recommends -y \
-    autoconf \
-    automake \
-    build-essential \
-    ca-certificates \
-    clang \
-    clang-tools \
-    cmake \
-    git \
-    iproute2 \
-    libclang-rt-18-dev \
-    libssl-dev \
-    libtool \
-    libtss2-tcti-mssim0 \
-    openssl \
-    pkg-config \
-    sudo \
-    tpm2-tools \
-    valgrind \
-    zip \
+ENV DEBIAN_FRONTEND=noninteractive \
+    WOLFTPM_CI_IMAGE=v1.1 \
+    CARGO_HOME=/opt/cargo \
+    RUSTUP_HOME=/opt/rustup
+
+# Allow image builders to use another official Ubuntu mirror.
+ARG UBUNTU_ARCHIVE_MIRROR=http://archive.ubuntu.com/ubuntu/
+RUN sed -i "s|http://archive.ubuntu.com/ubuntu/|${UBUNTU_ARCHIVE_MIRROR}|g" \
+        /etc/apt/sources.list.d/ubuntu.sources \
+    && apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 -o APT::Update::Error-Mode=any update \
+    && apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 install --no-install-recommends -y \
+    autoconf automake bison build-essential ca-certificates ccache \
+    clang clang-14 clang-15 clang-17 clang-tools cmake curl \
+    device-tree-compiler dfu-util file flex g++-11 g++-12 g++-13 \
+    g++-multilib gcc-11 gcc-12 gcc-13 gcc-arm-none-eabi gcc-multilib \
+    git gperf iproute2 jq libcapstone-dev libclang-18-dev \
+    libclang-rt-18-dev libdw-dev libmagic1 libnewlib-arm-none-eabi \
+    libsdl2-dev libssl-dev libtool libtss2-tcti-mssim0 \
+    mono-mcs mono-tools-devel ninja-build nunit nunit-console openssl \
+    patch pkg-config procps psmisc python3 python3-dev python3-pip \
+    python3-venv rsync sudo tpm2-tools unzip util-linux valgrind wget \
+    xxd xz-utils zip \
     && rm -rf /var/lib/apt/lists/*
+
+# Keep the Python tools away from Ubuntu's externally managed interpreter.
+RUN python3 -m venv /opt/ci-python \
+    && /opt/ci-python/bin/pip install --no-cache-dir \
+        'semgrep==1.166.0' 'spdx-tools==0.8.*' 'codespell[toml]==2.4.3'
+
+# Zephyr retains its existing release and SDK. Its Python dependencies are
+# isolated from the scanners and SBOM validator.
+RUN git clone --depth 1 --branch v3.4.0 \
+        https://github.com/zephyrproject-rtos/zephyr.git /tmp/zephyr-deps \
+    && python3 -m venv /opt/zephyr-python \
+    && /opt/zephyr-python/bin/pip install --no-cache-dir \
+        -r /tmp/zephyr-deps/scripts/requirements-base.txt \
+        -r /tmp/zephyr-deps/scripts/requirements-build-test.txt \
+    && rm -rf /tmp/zephyr-deps
+
+RUN curl -fsSL --retry 3 \
+        https://github.com/zephyrproject-rtos/sdk-ng/releases/download/v0.16.1/zephyr-sdk-0.16.1_linux-x86_64_minimal.tar.xz \
+        -o /tmp/zephyr-sdk.tar.xz \
+    && tar -xJf /tmp/zephyr-sdk.tar.xz -C /opt \
+    && cd /opt/zephyr-sdk-0.16.1 \
+    && ./setup.sh -h -c -t x86_64-zephyr-elf \
+    && rm /tmp/zephyr-sdk.tar.xz
+
+# rustup lives outside HOME, which GitHub overrides for container jobs.
+RUN curl -fsSL --retry 3 https://sh.rustup.rs -o /tmp/rustup.sh \
+    && sh /tmp/rustup.sh -y --no-modify-path --profile minimal \
+        --default-toolchain stable --component clippy --component rustfmt \
+    && rm /tmp/rustup.sh
+
+ENV PATH=/opt/ci-python/bin:/opt/cargo/bin:${PATH}
+
+# Include the STM32 emulator in this image rather than installing dependencies
+# in a second CI container. Pin the source so image rebuilds are reproducible.
+ARG M33MU_REF=7ff584479f8cb53c5016a5a429484e82b498b289
+RUN git init -q /tmp/m33mu \
+    && git -C /tmp/m33mu remote add origin https://github.com/danielinux/m33mu.git \
+    && git -C /tmp/m33mu fetch --depth 1 origin "$M33MU_REF" \
+    && git -C /tmp/m33mu checkout -q --detach FETCH_HEAD \
+    && cmake -S /tmp/m33mu -B /tmp/m33mu/build \
+        -DM33MU_BUILD_TESTS=OFF -DM33MU_ENABLE_WOLFSSL=OFF \
+        -DM33MU_ENABLE_RUST_PLUGINS=OFF \
+    && cmake --build /tmp/m33mu/build --target m33mu -j4 \
+    && cmake --install /tmp/m33mu/build \
+    && rm -rf /tmp/m33mu

.github/workflows/cmake-build.yml

@@ -18,6 +18,11 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
 
     runs-on: ${{ matrix.config.os }}
+    container:
+      image: ${{ startsWith(matrix.config.os, 'ubuntu-') && 'ghcr.io/wolfssl/wolftpm-ci:v1.1' || '' }}
+    defaults:
+      run:
+        shell: bash
     strategy:
       fail-fast: false
       matrix:
@@ -141,14 +146,6 @@ jobs:
       with:
         submodules: true
 
-# Install cmake (matrix includes a Windows leg, so this job stays on the host
-# runner; apt is made resilient instead of moving into the Linux CI image)
-    - name: Install cmake
-      if: runner.os == 'Linux'
-      uses: ./.github/actions/apt-retry
-      with:
-        packages: cmake
-
 #pull and build wolfssl
     # Every matrix entry builds the identical wolfSSL (only the wolfTPM options
     # vary), so cache the install prefix keyed on the resolved wolfSSL commit +
@@ -164,7 +161,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: install
-        key: wolfssl-cmake-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1
+        key: wolfssl-cmake-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1-ci-v1.1
 
     - name: Checkout wolfssl
       if: steps.wolfssl_cache.outputs.cache-hit != 'true'
@@ -221,12 +218,11 @@ jobs:
     name: CMake static export check
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
-    # cmake baked into the CI image — no apt mirror on the happy path.
+    defaults:
+      run:
+        shell: bash
     container:
-      image: ghcr.io/wolfssl/wolftpm-ci:v1.0
-      credentials:
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
+      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
     steps:
       - uses: actions/checkout@master
         with:
@@ -244,7 +240,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: install
-          key: wolfssl-cmake-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1
+          key: wolfssl-cmake-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1-ci-v1.1
 
       - name: Checkout wolfssl
         if: steps.wolfssl_cache.outputs.cache-hit != 'true'

.github/workflows/codeql.yml

@@ -23,20 +23,18 @@ jobs:
     name: CodeQL (C, security)
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
+    defaults:
+      run:
+        shell: bash
     timeout-minutes: 40
     steps:
       - name: Checkout wolfTPM
         uses: actions/checkout@v4
         with:
           submodules: true
 
-      # CodeQL's action is fiddly inside a custom container, so keep this job
-      # on the host runner and just make apt resilient to mirror timeouts.
-      - name: Install build tools
-        uses: ./.github/actions/apt-retry
-        with:
-          packages: autoconf automake libtool
-
       # Full-feature wolfSSL so every wolfTPM code path is compiled and
       # therefore visible to CodeQL.
       - name: Setup wolfSSL

.github/workflows/codespell.yml

@@ -18,6 +18,11 @@ jobs:
     name: Check spelling
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
+    defaults:
+      run:
+        shell: bash
     timeout-minutes: 5
     steps:
       - name: Checkout wolfTPM
@@ -26,7 +31,7 @@ jobs:
           submodules: true
 
       - name: Run codespell
-        uses: codespell-project/actions-codespell@v2
-        with:
-          skip: .git,./IDE,./certs,./m4,*.der,*.pem,*prebuilt_bindings.rs
-          ignore_words_list: inh,inout,keypair,nd,parm,rcv,ser,loadIn,importIn,certifyIn,bu,fo,daa,pris,hsi,fram,hart,cna
+        run: |
+          codespell --count \
+            --skip '.git,./IDE,./certs,./m4,*.der,*.pem,*prebuilt_bindings.rs' \
+            --ignore-words-list 'inh,inout,keypair,nd,parm,rcv,ser,loadIn,importIn,certifyIn,bu,fo,daa,pris,hsi,fram,hart,cna'

.github/workflows/coverity-scan-fixes.yml

@@ -9,6 +9,11 @@ jobs:
   coverity:
     if: github.repository_owner == 'wolfssl'
     runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
+    defaults:
+      run:
+        shell: bash
     timeout-minutes: 5
     steps:
     - uses: actions/checkout@v4
@@ -27,7 +32,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: wolfssl
-        key: wolfssl-coverity-fixes-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1
+        key: wolfssl-coverity-fixes-${{ runner.os }}-${{ steps.wolfssl_rev.outputs.sha }}-v1-ci-v1.1
 
     - uses: actions/checkout@master
       if: steps.wolfssl_cache.outputs.cache-hit != 'true'

.github/workflows/freestanding-build.yml

@@ -21,6 +21,11 @@ jobs:
   freestanding:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
+    defaults:
+      run:
+        shell: bash
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/fuzz.yml

@@ -43,6 +43,13 @@ jobs:
   fuzz:
     needs: select
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
+      # Preserve the kernel ASLR workaround used by these tests.
+      options: --privileged
+    defaults:
+      run:
+        shell: bash
     timeout-minutes: 30
     strategy:
       fail-fast: false