ci: add interrupted-OTA swap-move canary

Two tardigrade sweeps on nrf52840dk/nrf52840 with Zephyr pinned to
v3.7.0: power loss across the v1->v2 swap-move upgrade, and power loss
across the revert of a completed-but-unconfirmed upgrade, the failure
class of issue #1966 (PR #2100) and PR #2199.

The tardigrade action is pinned by full commit SHA; that revision pins
Renode to a versioned release archive verified by SHA-256 before
extraction, runs with strict profile validation, and resolves profile
assets only inside the caller workspace.  The platform description is
fetched from the same pinned revision.

Signed-off-by: Neil Berkman <neil@xuku.com>

Author: neilberkman

.github/workflows/ota-resilience-canary.yml

@@ -0,0 +1,266 @@
+name: OTA resilience canary
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/ota-resilience-canary.yml
+      - boot/**
+      - scripts/**
+      - zephyr/**
+      - root-rsa-2048.pem
+  schedule:
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+    inputs:
+      zephyr_ref:
+        description: 'Which Zephyr ref should be used?'
+        required: true
+        default: 'main'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  ZEPHYR_VERSION: main
+  # Tardigrade revision used both for the action pin below and for
+  # fetching the platform description; keep the two in sync.
+  TARDIGRADE_REF: 64840d247635c1e02588c0b12a42e289aede19f5
+
+jobs:
+  swap-move-canary:
+    runs-on: ubuntu-24.04
+    container:
+      image: zephyrprojectrtos/ci-base:v0.29.0
+      options: '--entrypoint /bin/bash'
+    timeout-minutes: 90
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Set Zephyr version for manual runs
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "ZEPHYR_VERSION=${{ github.event.inputs.zephyr_ref }}" >> $GITHUB_ENV
+
+      - name: Checkout Zephyr
+        uses: actions/checkout@v4
+        with:
+          repository: zephyrproject-rtos/zephyr
+          ref: ${{ env.ZEPHYR_VERSION }}
+          path: repos/zephyr
+
+      - name: Install Zephyr Python requirements
+        working-directory: repos/zephyr
+        run: pip install -r scripts/requirements-actions.txt --require-hashes
+
+      - name: Setup Zephyr SDK and workspace
+        uses: zephyrproject-rtos/action-zephyr-setup@360ff9b36e58499d9eb28015cdcde7ca03a5b04d
+        with:
+          base-path: repos/zephyr
+          toolchains: arm-zephyr-eabi
+          sdk-version: 1.0.0
+          west-project-filter: -.*,+cmsis,+cmsis_6,+hal_nordic,+mbedtls,+mcuboot,+tinycrypt,+zcbor,+tf-psa-crypto
+          ccache-max-size: 256MB
+
+      - name: Checkout MCUboot
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          path: repos/bootloader/mcuboot
+
+      - name: Build MCUboot bootloader (swap-move, RSA-2048)
+        working-directory: repos
+        run: |
+          export ZEPHYR_BASE=$(pwd)/zephyr
+          export ZEPHYR_TOOLCHAIN_VARIANT=zephyr
+          west build -b nrf52840dk/nrf52840 bootloader/mcuboot/boot/zephyr \
+            -d build_boot \
+            -p always \
+            -- \
+            -DCONFIG_BOOT_SWAP_USING_MOVE=y \
+            -DCONFIG_BOOT_SIGNATURE_TYPE_RSA=y \
+            -DCONFIG_BOOT_SIGNATURE_TYPE_RSA_LEN=2048 \
+            -DCONFIG_BOOT_VALIDATE_SLOT0=n
+
+      - name: Build test application images
+        working-directory: repos
+        run: |
+          set -euo pipefail
+          export ZEPHYR_BASE=$(pwd)/zephyr
+          export ZEPHYR_TOOLCHAIN_VARIANT=zephyr
+          pip3 install --quiet click intelhex cbor2 cryptography
+
+          # Build hello_world as the test application.
+          west build -b nrf52840dk/nrf52840 zephyr/samples/hello_world \
+            -d build_app \
+            -p always \
+            -- \
+            -DCONFIG_BOOTLOADER_MCUBOOT=y
+
+          IMGTOOL="python3 bootloader/mcuboot/scripts/imgtool.py"
+          KEY="bootloader/mcuboot/root-rsa-2048.pem"
+
+          # Upgrade scenario images.
+          # v1 (exec slot): confirmed so MCUboot boots it directly.
+          ${IMGTOOL} sign --key ${KEY} \
+            --header-size 0x200 --align 4 --slot-size 0x76000 \
+            --version 1.0.0 --pad --confirm \
+            build_app/zephyr/zephyr.bin slot0.bin
+          # v2 (staging slot): pending upgrade, trailer magic from --pad.
+          ${IMGTOOL} sign --key ${KEY} \
+            --header-size 0x200 --align 4 --slot-size 0x76000 \
+            --version 2.0.0 --pad \
+            build_app/zephyr/zephyr.bin slot1.bin
+
+          # Revert scenario images: no --pad/--confirm, so neither slot
+          # carries trailer state; the profile's update_trigger writes the
+          # post-upgrade-unconfirmed trailer that starts a revert.
+          ${IMGTOOL} sign --key ${KEY} \
+            --header-size 0x200 --align 4 --slot-size 0x76000 \
+            --version 1.0.0 \
+            build_app/zephyr/zephyr.bin slot0_plain.bin
+          ${IMGTOOL} sign --key ${KEY} \
+            --header-size 0x200 --align 4 --slot-size 0x76000 \
+            --version 2.0.0 \
+            build_app/zephyr/zephyr.bin slot1_plain.bin
+
+          ls -la slot0.bin slot1.bin slot0_plain.bin slot1_plain.bin
+
+      - name: Fetch pinned platform description
+        working-directory: repos
+        run: |
+          set -euo pipefail
+          mkdir -p platforms
+          python3 -c "import urllib.request; urllib.request.urlretrieve(
+              'https://raw.githubusercontent.com/neilberkman/tardigrade/${TARDIGRADE_REF}/platforms/cortex_m4_flash_fast.repl',
+              'platforms/cortex_m4_flash_fast.repl')"
+          head -3 platforms/cortex_m4_flash_fast.repl
+
+      - name: Write canary profiles
+        working-directory: repos
+        run: |
+          cat > ota_upgrade_profile.yaml << 'YAML'
+          schema_version: 1
+          name: mcuboot_swap_move_upgrade_canary
+          description: >
+            Post-merge OTA resilience canary for MCUboot swap-using-move on
+            nrf52840dk. Upgrade scenario: exec has confirmed v1, staging has
+            pending v2. After the swap, exec should contain the v2 image at
+            every power-loss fault point.
+
+          platform: platforms/cortex_m4_flash_fast.repl
+          flash_backend: faultFlash
+          bootloader:
+            elf: build_boot/zephyr/zephyr.elf
+            entry: 0x00000000
+          memory:
+            sram: { start: 0x20000000, end: 0x20040000 }
+            write_granularity: 4
+            slots:
+              exec: { base: 0x0000C000, size: 0x76000 }
+              staging: { base: 0x00082000, size: 0x76000 }
+          images:
+            exec: slot0.bin
+            staging: slot1.bin
+          success_criteria:
+            vtor_in_slot: exec
+            image_hash: true
+            expected_image: staging
+          fault_sweep:
+            mode: runtime
+            evaluation_mode: execute
+            max_writes: auto
+            max_writes_cap: 200000
+            run_duration: "5.0"
+            max_step_limit: 50000000
+            sweep_hash_bypass_symbols: ["bootutil_img_validate"]
+          expect:
+            should_find_issues: false
+          YAML
+
+          cat > ota_revert_profile.yaml << 'YAML'
+          schema_version: 1
+          name: mcuboot_swap_move_revert_canary
+          description: >
+            Post-merge OTA resilience canary for MCUboot swap-using-move on
+            nrf52840dk. Revert scenario: an upgrade to v2 completed but was
+            never confirmed, so the next boot reverts to v1. Power loss at
+            any point of the revert, including inside the trailer fixup,
+            must still end with v1 restored in exec. Covers the failure
+            class of issue #1966 (PR #2100).
+
+          platform: platforms/cortex_m4_flash_fast.repl
+          flash_backend: faultFlash
+          bootloader:
+            elf: build_boot/zephyr/zephyr.elf
+            entry: 0x00000000
+          memory:
+            sram: { start: 0x20000000, end: 0x20040000 }
+            write_granularity: 4
+            slots:
+              exec: { base: 0x0000C000, size: 0x76000 }
+              staging: { base: 0x00082000, size: 0x76000 }
+          images:
+            exec: slot1_plain.bin
+            staging: slot0_plain.bin
+          update_trigger:
+            type: mcuboot_trailer_magic
+            slot: exec
+            copy_done: 1
+          success_criteria:
+            vtor_in_slot: exec
+            image_hash: true
+            expected_image: staging
+          fault_sweep:
+            mode: runtime
+            evaluation_mode: execute
+            max_writes: auto
+            max_writes_cap: 200000
+            run_duration: "20.0"
+            phase1_time_slice: "0.10"
+            max_step_limit: 20000000
+            sweep_hash_bypass_symbols: ["bootutil_img_validate"]
+          expect:
+            should_find_issues: false
+          YAML
+
+          sed -i 's/^          //' ota_upgrade_profile.yaml ota_revert_profile.yaml
+          cat ota_upgrade_profile.yaml ota_revert_profile.yaml
+
+      - name: Run upgrade resilience sweep
+        id: ota_upgrade
+        uses: neilberkman/tardigrade@64840d247635c1e02588c0b12a42e289aede19f5
+        with:
+          profile: repos/ota_upgrade_profile.yaml
+          asset-root: repos
+          quick: "false"
+          workers: "2"
+
+      - name: Run revert resilience sweep
+        id: ota_revert
+        if: always() && contains(fromJSON('["success", "failure"]'), steps.ota_upgrade.conclusion)
+        uses: neilberkman/tardigrade@64840d247635c1e02588c0b12a42e289aede19f5
+        with:
+          profile: repos/ota_revert_profile.yaml
+          asset-root: repos
+          quick: "false"
+          workers: "2"
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ota-resilience-swap-move
+          if-no-files-found: ignore
+          path: |
+            repos/ota_upgrade_profile.yaml
+            repos/ota_revert_profile.yaml
+            ${{ steps.ota_upgrade.outputs.report-path }}
+            ${{ steps.ota_revert.outputs.report-path }}