Merge remote-tracking branch 'upstream/master' into remove-insufficie…

…nt-privilege

.github/workflows/build.yaml

@@ -391,7 +391,7 @@ jobs:
                           #   use that on Darwin.
                           # * the "host clang" build, which uses the pigweed
                           #   clang.
-                          "default") GN_ARGS='target_os="all" is_asan=true enable_host_clang_build=false enable_host_gcc_mbedtls_build=false';;
+                          "default") GN_ARGS='target_os="all" is_asan=true enable_host_clang_build=false';;
                           "python_lib") GN_ARGS='enable_rtti=true enable_pylib=true';;
                       esac
                       BUILD_TYPE=$BUILD_TYPE scripts/build/gn_gen.sh --args="$GN_ARGS" --export-compile-commands

.github/workflows/cirque.yaml

@@ -110,10 +110,11 @@ jobs:
                     chip_build_tests=false \
                     chip_enable_wifi=false \
                     chip_im_force_fabric_quota_check=true \
+                    enable_default_builds=false \
                     enable_host_gcc_build=true \
-                    enable_host_gcc_mbedtls_build=false \
-                    enable_host_clang_build=false \
-                    enable_fake_tests=false
+                    enable_standalone_chip_tool_build=true \
+                    enable_linux_all_clusters_app_build=true \
+                    enable_linux_lighting_app_build=true
             - name: Run Tests
               timeout-minutes: 25
               run: |

.github/workflows/docker_img.yaml

@@ -65,9 +65,3 @@ jobs:
               run: |
                   cd integrations/docker/images/chip-build${{ matrix.img }}
                   ./build.sh --latest
-            - name: Scan for vulnerabilities
-              uses: crazy-max/docker-scan-action@master
-              with:
-                  # NOTE: This task validates the images built previously with latest tag
-                  image: connectedhomeip/chip-build${{ matrix.img }}:latest
-                  annotations: true

BUILD.gn

@@ -235,7 +235,11 @@ if (current_toolchain != "${dir_pw_toolchain}/default:default") {
     enable_host_gcc_build = enable_default_builds && host_os != "win"
 
     # Enable building chip with gcc & mbedtls.
-    enable_host_gcc_mbedtls_build = enable_default_builds && host_os != "win"
+    enable_host_gcc_mbedtls_build = false
+
+    # Enable limited testing with gcc & mbedtls.
+    enable_host_gcc_mbedtls_crypto_tests =
+        enable_default_builds && host_os != "win"
 
     # Build the chip-cert tool.
     enable_standalone_chip_cert_build =
@@ -349,6 +353,15 @@ if (current_toolchain != "${dir_pw_toolchain}/default:default") {
     builds += [ ":host_gcc_mbedtls" ]
   }
 
+  if (enable_host_gcc_mbedtls_crypto_tests) {
+    chip_build("host_gcc_mbedtls_crypto_tests") {
+      test_group = "//src:crypto_tests"
+      toolchain = "${chip_root}/config/mbedtls/toolchain:${host_os}_${host_cpu}_gcc_mbedtls"
+    }
+
+    builds += [ ":host_gcc_mbedtls_crypto_tests" ]
+  }
+
   if (enable_android_builds) {
     chip_build("android_arm") {
       toolchain = "${build_root}/toolchain/android:android_arm"
@@ -376,6 +389,7 @@ if (current_toolchain != "${dir_pw_toolchain}/default:default") {
 
   if (enable_fake_tests) {
     chip_build("fake_platform") {
+      test_group = "//src:fake_platform_tests"
       toolchain = "${build_root}/toolchain/fake:fake_${host_cpu}_gcc"
     }
 

build/chip/chip_build.gni

@@ -20,11 +20,21 @@ template("chip_build") {
   _build_name = target_name
   _toolchain = invoker.toolchain
 
+  if (defined(invoker.test_group) && chip_build_tests) {
+    _build_target = invoker.test_group
+    _check_target = get_label_info(invoker.test_group, "dir") + ":" +
+                    get_label_info(invoker.test_group, "name") + "_run"
+  } else {
+    _build_target = ":default"
+    _check_target = ":check"
+    not_needed(invoker, [ "test_group" ])
+  }
+
   group("${_build_name}") {
-    deps = [ ":default(${_toolchain})" ]
+    deps = [ "${_build_target}(${_toolchain})" ]
   }
 
   group("check_${_build_name}") {
-    deps = [ ":check(${_toolchain})" ]
+    deps = [ "${_check_target}(${_toolchain})" ]
   }
 }

build/chip/chip_test_group.gni

@@ -60,8 +60,8 @@ template("chip_test_group") {
     }
   }
 
-  if (chip_link_tests) {
-    group("${_test_group_name}_run") {
+  group("${_test_group_name}_run") {
+    if (chip_link_tests) {
       deps = []
       foreach(_test, invoker.deps) {
         deps += [ get_label_info(_test, "label_no_toolchain") + "_run" ]

examples/bridge-app/bridge-common/bridge-app.matter

@@ -420,11 +420,19 @@ server cluster BridgedActions = 37 {
 
   readonly attribute ActionStruct actionList[] = 0;
   readonly attribute EndpointListStruct endpointList[] = 1;
+  readonly attribute long_char_string<512> setupUrl = 2;
   readonly attribute command_id generatedCommandList[] = 65528;
   readonly attribute command_id acceptedCommandList[] = 65529;
   readonly attribute attrib_id attributeList[] = 65531;
   readonly attribute bitmap32 featureMap = 65532;
   readonly attribute int16u clusterRevision = 65533;
+
+  request struct InstantActionRequest {
+    INT16U actionID = 0;
+    optional INT32U invokeID = 1;
+  }
+
+  command InstantAction(InstantActionRequest): DefaultSuccess = 0;
 }
 
 server cluster Basic = 40 {
@@ -1722,6 +1730,7 @@ endpoint 1 {
   server cluster BridgedActions {
     callback attribute actionList;
     callback attribute endpointList;
+    ram      attribute setupUrl default = "https://example.com";
     callback attribute generatedCommandList;
     callback attribute acceptedCommandList;
     callback attribute attributeList;