Trezor Suite: CKB ecdsa review code

.depcheckrc.json

@@ -9,6 +9,7 @@
         "worker-loader",
         "process",
         "rimraf",
+        "rollup-plugin-dts",
         "tslib",
         "buffer",
         "node-gyp",

.github/actions/check-pr-size/action.yml

@@ -0,0 +1,38 @@
+# .github/actions/check-pr-size/action.yml
+name: "Check PR Size"
+description: >
+  Determines whether a PR is small enough for LLM test selection.
+  Small PR = max 7 changed files and max 500 total lines changed.
+inputs:
+  changed-files:
+    description: "Number of changed files (github.event.pull_request.changed_files)"
+    required: true
+  additions:
+    description: "Number of line additions (github.event.pull_request.additions)"
+    required: true
+  deletions:
+    description: "Number of line deletions (github.event.pull_request.deletions)"
+    required: true
+outputs:
+  is_small_pr:
+    description: "'true' if the PR is small enough for LLM analysis, 'false' otherwise"
+    value: ${{ steps.check.outputs.is_small_pr }}
+runs:
+  using: "composite"
+  steps:
+    - name: Check PR size
+      id: check
+      shell: bash
+      env:
+        CHANGED_FILES: ${{ inputs.changed-files }}
+        ADDITIONS: ${{ inputs.additions }}
+        DELETIONS: ${{ inputs.deletions }}
+      run: |
+        TOTAL_CHANGES=$(( ADDITIONS + DELETIONS ))
+        if [ "$CHANGED_FILES" -le 7 ] && [ "$TOTAL_CHANGES" -le 500 ]; then
+          echo "is_small_pr=true" >> "$GITHUB_OUTPUT"
+          echo "Small PR: $CHANGED_FILES changed files, $TOTAL_CHANGES lines changed"
+        else
+          echo "is_small_pr=false" >> "$GITHUB_OUTPUT"
+          echo "Large PR, skipping LLM test selector: $CHANGED_FILES changed files, $TOTAL_CHANGES lines changed"
+        fi

.github/actions/determine-test-strategy/action.yml

@@ -0,0 +1,61 @@
+name: "Determine E2E Test Strategy"
+description: >
+  Classifies PR changes into one of three strategies:
+  specific-tests (only e2e test files changed),
+  run-everything (e2e framework or mixed changes),
+  or analyze (non-e2e code changed → LLM analysis needed).
+outputs:
+  strategy:
+    description: "specific-tests | run-everything | analyze"
+    value: ${{ steps.classify.outputs.strategy }}
+  spec-list:
+    description: "Comma-separated list of test file paths (only set when strategy=specific-tests)"
+    value: ${{ steps.classify.outputs.spec-list }}
+runs:
+  using: "composite"
+  steps:
+    - name: Classify changed files
+      id: classify
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        # Use the PR base ref SHA from GitHub context — the current HEAD of the base
+        # branch, used as the diff base for this PR. Fetching just that one commit is enough;
+        BASE_SHA="${{ github.event.pull_request.base.sha }}"
+        git fetch origin "$BASE_SHA" --depth=1
+
+        CHANGED=$(git diff "$BASE_SHA" HEAD --name-only)
+        echo "Changed files:"
+        echo "$CHANGED"
+
+        if [[ -z "$CHANGED" ]]; then
+          echo "No changed files detected. Running everything."
+          echo "strategy=run-everything" >> "$GITHUB_OUTPUT"
+          echo "spec-list=" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        # Check if any file is outside suite/e2e/ entirely (production code)
+        OUTSIDE_E2E=$(echo "$CHANGED" | grep -v '^suite/e2e/' || true)
+        if [[ -n "$OUTSIDE_E2E" ]]; then
+          echo "Production code changed — proceeding to LLM analysis."
+          echo "strategy=analyze" >> "$GITHUB_OUTPUT"
+          echo "spec-list=" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        # All files are under suite/e2e/ — check if any are outside tests/
+        OUTSIDE_TESTS=$(echo "$CHANGED" | grep '^suite/e2e/' | grep -v '^suite/e2e/tests/' || true)
+        if [[ -n "$OUTSIDE_TESTS" ]]; then
+          echo "E2E framework files changed — running everything."
+          echo "strategy=run-everything" >> "$GITHUB_OUTPUT"
+          echo "spec-list=" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        # All changed files are under suite/e2e/tests/ — run only those
+        TEST_FILES=$(echo "$CHANGED" | grep '^suite/e2e/tests/' | tr '\n' ',' | sed 's/,$//')
+        echo "Only test files changed. Running: $TEST_FILES"
+        echo "strategy=specific-tests" >> "$GITHUB_OUTPUT"
+        echo "spec-list=$TEST_FILES" >> "$GITHUB_OUTPUT"

.github/actions/llm-test-selector/action.yml

@@ -0,0 +1,50 @@
+name: "LLM Test Selector"
+description: >
+  Runs the LLM-based test selector against the PR diff.
+  SECURITY: The calling job must check out the trusted develop branch and
+  fetch the PR head as 'pr-head' before invoking this action.
+  Only code from the trusted checkout is installed and executed.
+inputs:
+  claude-api-key:
+    description: "Anthropic API key for the LLM test selector"
+    required: true
+outputs:
+  spec-list:
+    description: "Comma-separated list of recommended test file paths (repo-root-relative)"
+    value: ${{ steps.parse.outputs.spec-list }}
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+      with:
+        node-version-file: ".nvmrc"
+        cache: yarn
+
+    - name: Cache node_modules
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      with:
+        path: node_modules
+        key: node_modules-${{ hashFiles('yarn.lock') }}
+        restore-keys: node_modules-
+
+    - name: Install dependencies
+      shell: bash
+      run: yarn workspaces focus @trezor/e2e-utils
+
+    - name: Run LLM test selector
+      shell: bash
+      env:
+        CLAUDE_API_KEY: ${{ inputs.claude-api-key }}
+      run: |
+        yarn workspace @trezor/e2e-utils select-tests-llm --head-ref pr-head > llm-selection.json
+        echo "LLM test selector output:"
+        cat llm-selection.json
+
+    - name: Parse spec list from LLM output
+      id: parse
+      shell: bash
+      run: |
+        SPEC_LIST=$(jq -r '[.recommendations[].test] | join(",")' llm-selection.json)
+        echo "spec-list=$SPEC_LIST" >> "$GITHUB_OUTPUT"
+        echo "Spec list: $SPEC_LIST"

.github/actions/minimal-yarn-install/action.yml

@@ -23,17 +23,18 @@ runs:
         restore-keys: |
           yarn-cache-folder-
 
-    - name: Modify .yarnrc.yml to disable scripts
-      shell: bash
-      run: |
-        echo -e "\nenableScripts: false" >> .yarnrc.yml
-
     # We don't need to run in hardened mode because it's enough to run hardened install only in "Setup and Cache Dependencies" step
     - name: Modify .yarnrc.yml to disable hardened mode
       shell: bash
       run: |
         echo -e "\nenableHardenedMode: false" >> .yarnrc.yml
 
+    - name: Install Socket Firewall
+      uses: SocketDev/action@2d3f25590c6ed6ba11a9a14c064d962a3a04698f # v1.3.1
+      with:
+        mode: firewall-free
+        job-summary: errors
+
     - name: Install dependencies using Yarn
       shell: bash
-      run: yarn --immutable
+      run: sfw --silent yarn --immutable

.github/actions/post-llm-analysis/action.yml

@@ -0,0 +1,121 @@
+name: "Post LLM Analysis to PR"
+description: >
+  Reads llm-selection.json from the workspace and overwrites the
+  LLM test recommendation section in the PR description.
+inputs:
+  selection-file:
+    description: "Path to the llm-selection.json file"
+    required: false
+    default: "llm-selection.json"
+  trezor-bot-app-id:
+    description: "Trezor Bot GitHub App ID"
+    required: true
+  trezor-bot-private-key:
+    description: "Trezor Bot GitHub App private key"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Generate GitHub App token
+      id: trezor-bot-token
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+      with:
+        app-id: ${{ inputs.trezor-bot-app-id }}
+        private-key: ${{ inputs.trezor-bot-private-key }}
+
+    - name: Update PR description with LLM test selection
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      with:
+        github-token: ${{ steps.trezor-bot-token.outputs.token }}
+        script: |
+          const fs = require('fs');
+          const selectionFile = '${{ inputs.selection-file }}';
+          const result = JSON.parse(fs.readFileSync(selectionFile, 'utf8'));
+
+          const priorityEmoji = { high: '🔴', medium: '🟡', low: '🟢' };
+          const priorityOrder = ['high', 'medium', 'low'];
+
+          const START_MARKER = '<!-- LLM-TEST-SELECTOR:START -->';
+          const END_MARKER   = '<!-- LLM-TEST-SELECTOR:END -->';
+          const HEADING_START = '<!-- LLM-TEST-SELECTOR:HEADING:START -->';
+          const HEADING_END   = '<!-- LLM-TEST-SELECTOR:HEADING:END -->';
+          const headingBlock  = `${HEADING_START}\n## 🤖 LLM Test Recommendations\n${HEADING_END}`;
+
+          const lines = [];
+
+          lines.push(`**Summary:** ${result.summary}`);
+          lines.push('');
+
+          if (result.changed_files && result.changed_files.length > 0) {
+            lines.push(`<details><summary><b>Changed files (${result.changed_files.length})</b></summary>`);
+            lines.push('');
+            result.changed_files.forEach(f => lines.push(`- \`${f}\``));
+            lines.push('');
+            lines.push('</details>');
+            lines.push('');
+          }
+
+          if (result.recommendations && result.recommendations.length > 0) {
+            lines.push(`**Recommended tests (${result.recommendations.length})**`);
+            lines.push('');
+            for (const priority of priorityOrder) {
+              const recs = result.recommendations.filter(r => r.priority === priority);
+              if (recs.length === 0) continue;
+              const label = priority.charAt(0).toUpperCase() + priority.slice(1);
+              lines.push(`<details><summary>${priorityEmoji[priority]} <b>${label} priority (${recs.length})</b></summary>`);
+              lines.push('');
+              for (const rec of recs) {
+                lines.push(`- \`${rec.test}\` — ${rec.reasoning}`);
+              }
+              lines.push('');
+              lines.push('</details>');
+              lines.push('');
+            }
+          } else {
+            lines.push('_No test recommendations found._');
+            lines.push('');
+          }
+
+          if (result.uncovered_changes && result.uncovered_changes.length > 0) {
+            lines.push(`⚠️ **Changes with no test coverage (${result.uncovered_changes.length})**`);
+            result.uncovered_changes.forEach(f => lines.push(`- \`${f}\``));
+            lines.push('');
+          }
+
+          lines.push(`_Updated: ${new Date().toISOString()}_`);
+
+          const newSection = START_MARKER + '\n' + lines.join('\n') + '\n' + END_MARKER;
+
+          const pr = await github.rest.pulls.get({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            pull_number: context.payload.pull_request.number,
+          });
+
+          let body = pr.data.body || '';
+
+          // Ensure the heading block exists (written only once).
+          if (!body.includes(HEADING_START)) {
+            const sep = body.endsWith('\n\n') ? '' : body.endsWith('\n') ? '\n' : '\n\n';
+            body = body + sep + headingBlock;
+          }
+
+          // Update the section in-place or insert it right after the heading block.
+          let newBody;
+          if (body.includes(START_MARKER) && body.includes(END_MARKER)) {
+            const before = body.slice(0, body.indexOf(START_MARKER));
+            const after  = body.slice(body.indexOf(END_MARKER) + END_MARKER.length);
+            newBody = before + newSection + after;
+          } else {
+            const insertAt = body.indexOf(HEADING_END) + HEADING_END.length;
+            newBody = body.slice(0, insertAt) + '\n\n' + newSection + body.slice(insertAt);
+          }
+
+          await github.rest.pulls.update({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            pull_number: context.payload.pull_request.number,
+            body: newBody,
+          });
+
+          console.log('PR description updated with LLM test recommendations.');

.github/actions/release-connect-npm/action.yml

@@ -2,10 +2,11 @@ name: "NPM Connect Deploy Action"
 description: "Releases to NPM any Connect package or Trezor dependency"
 inputs:
   deploymentType:
-    description: "Specifies the deployment type for the npm package. Choose 'beta' for pre-release versions that are not ready for production use, and 'production' for stable versions intended for end-users."
+    description: "Specifies the deployment type for the npm package. Use 'alpha' for early prereleases, 'beta' for prereleases close to production, and 'latest' for stable versions intended for end-users."
     required: true
     type: choice
     options:
+      - alpha
       - beta
       - latest
   packageName:
@@ -31,6 +32,7 @@ inputs:
       - crypto-utils
       - device-utils
       - device-authenticity
+      - coins-solana
       - connect
       - connect-web
       - connect-webextension
@@ -54,9 +56,15 @@ runs:
         node-version-file: ".nvmrc"
         cache: yarn
 
+    - name: Install Socket Firewall
+      uses: SocketDev/action@2d3f25590c6ed6ba11a9a14c064d962a3a04698f # v1.3.1
+      with:
+        mode: firewall-free
+        job-summary: errors
+
     - name: Install dependencies
       shell: bash
-      run: yarn install --immutable
+      run: sfw --silent yarn install --immutable
 
     - name: Check version
       shell: bash
@@ -65,6 +73,10 @@ runs:
     - name: Publish to NPM
       shell: bash
       run: |
-        cd ./packages/${{ inputs.packageName }}
+        if [[ "${{ inputs.packageName }}" == coins-* ]]; then
+          cd ./coins/${{ inputs.packageName }}
+        else
+          cd ./packages/${{ inputs.packageName }}
+        fi
         yarn build:lib
         yarn npm publish --tag ${{ inputs.deploymentType }} --access public

.github/actions/release-connect/action.yml

@@ -63,11 +63,16 @@ runs:
         node-version-file: ".nvmrc"
         cache: yarn
 
+    - name: Install Socket Firewall
+      uses: SocketDev/action@2d3f25590c6ed6ba11a9a14c064d962a3a04698f # v1.3.1
+      with:
+        mode: firewall-free
+        job-summary: errors
+
     - name: Install dependencies
       shell: bash
       run: |
-        echo -e "\nenableScripts: false" >> .yarnrc.yml
-        yarn install --immutable # focus install is not used here to make sure that all global patches are applied for the release.
+        sfw --silent yarn install --immutable # focus install is not used here to make sure that all global patches are applied for the release.
 
     - name: Build connect-explorer-theme
       shell: bash

.github/actions/upload-test-logs/action.yml

@@ -16,6 +16,7 @@ runs:
       run: |
         docker cp docker-trezor-user-env-unix-1:/trezor-user-env/logs/debugging.log trezor-user-env-debugging.log || true
         docker cp docker-trezor-user-env-unix-1:/trezor-user-env/logs/emulator_bridge.log tenv-emulator-bridge-debugging.log || true
+        docker cp trezor-user-env.unix:/trezor-user-env/logs/tropic_model.log "$LOG_DIR/trezor-user-env-tropic_model.log" || true
         docker cp docker-trezor-user-env-unix-1:/trezor-user-env/docker/version.txt trezor-user-env-version.txt || true
         docker logs docker-electrum-regtest-1 > electrum-regtest.txt 2>&1 || true
         docker logs docker-quota-db-1 > quota-db.log 2>&1 || true
@@ -28,6 +29,7 @@ runs:
         path: |
           trezor-user-env-debugging.log
           tenv-emulator-bridge-debugging.log
+          trezor-user-env-tropic_model.log
           trezor-user-env-version.txt
           electrum-regtest.txt
           quota-db.log