ci: MemBrowse Integration

[michael-membrowse]

Re-opening of #18774, which was closed and could not be reopened because the branch was rebased onto a newer apache/nuttx:master. Same content as before, rebased on current master.

Summary

Integrates MemBrowse memory footprint tracking into NuttX CI to automatically report firmware memory footprint across a representative set of boards on every PR and push to master.

• Adds .github/membrowse-targets.json: tracks 9 boards spanning all supported architectures
  • ARM Cortex-M/A
  • AVR
  • MIPS
  • RISC-V
  • RX
  • SPARC
  • x86_64
  • Xtensa
• Adds membrowse-report.yml: builds NuttX on the above targets and runs membrowse-action to generate and upload the reports
• Adds membrowse-comment.yml: posts a memory-diff comment on PRs after the report workflow finishes
• Adds membrowse-onboard.yml: manual workflow to backfill the last N commits per target
• Adds a MemBrowse badge to README.md for easy access to the MemBrowse NuttX dashboard

Setup

To view the memory dashboard and receive PR comments:

1. Create an account and a project at https://membrowse.com.
2. Copy the project's API key.
3. In the MemBrowse project settings set the dashboard as publicly available.
4. In the GitHub repo, add it as a secret named MEMBROWSE_API_KEY.

Testing

The integration has been running on a fork. See the live dashboard here:
https://membrowse.com/public/michael-membrowse/nuttx

[michael-membrowse]

reopening the PR, by request of @xiaoxiang781216 and @acassis

[lupyuen]

MemBrowse failed to start. That's because ASF Infra Team has disallowed Third Party GitHub Actions, to prevent supply-chain attacks: https://github.com/apache/nuttx/actions/runs/25633744705

The actions dorny/paths-filter@v3 and membrowse/membrowse-action@v1 are not allowed in apache/nuttx because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns...

Update: Now checking whether we are legally allowed to accept MemBrowse's Terms Of Service: #18862 (comment)

[michael-membrowse]

@lupyuen Pushed a change - calling the membrowse python package directly, instead of using an action. Should work now.
Please create an account on membrowse.com, create a project and set a github secret: MEMBROWSE_API_KEY to the generated api key.

[lupyuen]

Please create an account on membrowse.com, create a project and set a github secret: MEMBROWSE_API_KEY to the generated api key.

@hartmannathan Are we legally allowed to accept MemBrowse's Terms Of Service, on behalf of the Apache NuttX Project?

• https://membrowse.com/terms

[acassis]

Please create an account on membrowse.com, create a project and set a github secret: MEMBROWSE_API_KEY to the generated api key.

@hartmannathan Are we legally allowed to accept MemBrowse's Terms Of Service, on behalf of the Apache NuttX Project?

* https://membrowse.com/terms

ping @hartmannathan

[lupyuen]

Hmmm LLM says that a NuttX PMC Member can't accept MemBrowse's Terms Of Service, if we believe the LLM:

• https://docs.google.com/document/d/1PT3X-42p85b18FRlZ0UogB0CVk3kGZRx8V__0EJHoMU/edit?usp=sharing

[michael-membrowse]

Hmmm LLM says that a NuttX PMC Member can't accept MemBrowse's Terms Of Service, if we believe the LLM:

• https://docs.google.com/document/d/1PT3X-42p85b18FRlZ0UogB0CVk3kGZRx8V__0EJHoMU/edit?usp=sharing

@lupyuen I've made a separate terms agreement for Open Source Software. I think this should work with the Apache Foundation requirements.

https://membrowse.com/terms-oss

[lupyuen]

I've made a separate terms agreement for Open Source Software. I think this should work with the Apache Foundation requirements https://membrowse.com/terms-oss

Sorry @hartmannathan would we need ASF to review the MemBrowse OSS Agreement before we accept it? Thanks

[acassis]

ping @hartmannathan

[michael-membrowse]

Following a discussion with @acassis, I'm suggesting a workaround to bypass the terms signing. I'm creating a project myself on the MemBrowse platform and give the maintainers the API key that they will set in the GitHub secrets. The dashboard will be with public access so anyone will be able to see it.

[acassis]

Following a discussion with @acassis, I'm suggesting a workaround to bypass the terms signing. I'm creating a project myself on the MemBrowse platform and give the maintainers the API key that they will set in the GitHub secrets. The dashboard will be with public access so anyone will be able to see it.

I just opened an internal ticket to Apache INFRA to add the secret key for us.

[hartmannathan]

ping @hartmannathan

@acassis Hi, sorry I missed the pings and your question about the license. I just saw it now. Unfortunately I don't know the answer. If this question is still relevant, you could try asking legal.

[acassis]

ping @hartmannathan

@acassis Hi, sorry I missed the pings and your question about the license. I just saw it now. Unfortunately I don't know the answer. If this question is still relevant, you could try asking legal.

Hi Nathan, don't worry, no problem.
I like that suggestion that Michael came up, this way we are not forced to assign to their Term of Use, the drawback is that the dashboard is public. Actually I think it is not an issue, it should be public anyway.