From b20bffbe5734c2f921657e78171c3922ebb91a7f Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Sun, 23 Nov 2025 04:01:39 -0800
Subject: [PATCH 1/9] chore(dev): revise CI workflows

This is just an update to address common security concerns about GitHub Actions syntax.
Most changes were the reesult of concerns raised by [zizmor].
Since the majority of this repo is for reusable CI workflows, I add a linter workflow to have [zizmor] check any YAML files in ".github/*" directory.

[zizmor]: https://docs.zizmor.sh/

# Summary

- Do not persist git credentials when they are not needed (eg. no `git push` done)
- Pin third-party actions to their SHA instead of a rolling major tag. Any `actions/*` is officially maintained by GitHub, so they are the exception here.
- Replace third-party actions with official GitHub actions where possible. This involves using gh-cli for uploading release assets.
- Rely more on env variable instead of template substitutions (ie. `${{ inputs.rf24_ref }}`)
- Move increment_version.py to .github/ directory and address various typing errors (raised by latest mypy version).
- Moved git-cliff config (cliff.toml) to .github/ directory and updated the config's template for the newer version of git-cliff (whitespace handling).
- Pin git-cliff version via pip requirements.txt constraint. This will be auto-updated by dependabot.
- Do no inherit default/global permissions for `secrets.GITHUB_TOKEN`. Instead, each job explicitly specifies what permissions shall be used with explanatory comments.
- Add to .gitattributes to ensure that all files checked in are using LF, not CRLF.
- Explicitly specify a cool-down period for when dependabot checks for updates.

> [!NOTE]
> CMake version v3.29 or newer is expected due to the new reliance on environment variables (instead of arguments in long-winded CMake commands). At this time, CMake v3.31 is provided by default.
>
> This does not apply to the install script, nor impose a (newer) minimum version of CMake on RF24* libs.
---
 .gitattributes                                |  11 +
 .github/{workflows => }/cliff.toml            |  14 +-
 .github/dependabot.yml                        |  15 +-
 .github/{workflows => }/increment_version.py  |  31 +--
 .github/requirements.txt                      |   1 +
 .github/workflows/arduino_size_deltas.yaml    |   2 +-
 .github/workflows/build_arduino.yaml          |  10 +-
 .github/workflows/build_docs.yaml             | 102 +++-----
 .github/workflows/build_linux_cmake.yaml      | 247 ++++++++++--------
 .github/workflows/build_pico_sdk.yaml         |  55 ++--
 .github/workflows/build_platformio.yaml       |  36 ++-
 .github/workflows/bump_version_release.yaml   |  54 ++--
 .github/workflows/cpp_lint.yaml               |  17 +-
 .github/workflows/lint_ci.yaml                |  29 ++
 .../workflows/validate_deploy_platformio.yaml |  36 ++-
 15 files changed, 388 insertions(+), 272 deletions(-)
 rename .github/{workflows => }/cliff.toml (94%)
 rename .github/{workflows => }/increment_version.py (90%)
 create mode 100644 .github/requirements.txt
 create mode 100644 .github/workflows/lint_ci.yaml

diff --git a/.gitattributes b/.gitattributes
index 9fa452f..a2dd1b0 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,3 +4,14 @@
 # Explicitly declare text files you want to always be normalized and converted
 # to native line endings on checkout.
 *.sh text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.toml text eol=lf
+*.py text eol=lf
+*.md text eol=lf
+*.txt text eol=lf
+*.scss text eol=lf
+*.html text eol=lf
+LICENSE text eol=lf
+.gitignore text eol=lf
+.gitattributes text eol=lf
diff --git a/.github/workflows/cliff.toml b/.github/cliff.toml
similarity index 94%
rename from .github/workflows/cliff.toml
rename to .github/cliff.toml
index acb66aa..c3edbe6 100644
--- a/.github/workflows/cliff.toml
+++ b/.github/cliff.toml
@@ -61,14 +61,14 @@ Full commit diff: [`{% if previous.version -%}
 {%- endif %}...{{ last_commit }}`][{{ this_version }}]
 {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
   ## New Contributors
-{%- endif -%}
+    {% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
+    - \\@{{ contributor.username }} made their first contribution
+        {%- if contributor.pr_number %} in \
+            [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
+        {%- endif %}
+    {%- endfor %}
+{% endif %}
 
-{% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-  * \\@{{ contributor.username }} made their first contribution
-    {%- if contributor.pr_number %} in \
-      [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-    {%- endif %}
-{%- endfor %}\n
 """
 # template for the changelog footer
 footer = """
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e21abd3..3b555f8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,8 +10,21 @@ updates:
     # default location of `.github/workflows`
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    cooldown:
+      default-days: 5
     groups:
       actions:
         patterns:
           - "*"
+  - package-ecosystem: "pip"
+    # recursively finds requirements.txt files from repo root
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 5
+    groups:
+      pip:
+        patterns:
+          - "*"
diff --git a/.github/workflows/increment_version.py b/.github/increment_version.py
similarity index 90%
rename from .github/workflows/increment_version.py
rename to .github/increment_version.py
index 98e1bc8..06144db 100644
--- a/.github/workflows/increment_version.py
+++ b/.github/increment_version.py
@@ -8,7 +8,7 @@
 from pathlib import Path
 import re
 import subprocess
-from typing import cast, Tuple, List, Sequence, Dict
+from typing import cast, Tuple, List, Set, Dict
 import sys
 from difflib import unified_diff
 
@@ -26,7 +26,7 @@ def get_version() -> Tuple[VERSION_TUPLE, str]:
         capture_output=True,
         check=True,
     )
-    tags: Sequence[VERSION_TUPLE] = set()  # using a set to avoid duplicates
+    tags: Set[VERSION_TUPLE] = set()  # using a set to avoid duplicates
     tag_pattern = re.compile(r"tag:\s+(?:RF24)?v?(\d+\.\d+\.?[A-Za-z0-9-_]*)")
     for line in result.stdout.decode(encoding="utf-8").splitlines():
         ver_tags = cast(List[str], tag_pattern.findall(line))
@@ -40,10 +40,11 @@ def get_version() -> Tuple[VERSION_TUPLE, str]:
                 print(ver_tag, "is an incomplete version spec; appending zero(s)")
                 ver_tuple += (0,) * (3 - len(ver_tuple))
             tags.add(cast(VERSION_TUPLE, ver_tuple))
-    tags = sorted(tags)  # sort by version & converts to a list
-    tags.reverse()  # to iterate from newest to oldest versions
+    sorted_tags = sorted(tags)  # sort by version & converts to a list
+    sorted_tags.reverse()  # to iterate from newest to oldest versions
+
     print("found version tags:")
-    for tag in tags:
+    for tag in sorted_tags:
         print("    v" + ".".join([str(t) for t in tag]), flush=True)
 
     # get current branch
@@ -63,17 +64,17 @@ def get_version() -> Tuple[VERSION_TUPLE, str]:
     # filter tags and find the appropriate latest tag according to current branch
     if branch.endswith("1.x"):
         print("filtering tags for branch", branch)
-        for tag in tags:
+        for tag in sorted_tags:
             if tag[0] == 1:
-                ver_tag = tag
+                ret_ver = tag
                 break
         else:
             raise RuntimeError(f"Found no v1.x tags for branch {branch}")
     else:
         print("treating branch", repr(branch), "as latest stable branch", flush=True)
-        ver_tag = tags[0]
+        ret_ver = sorted_tags[0]
     print("Current version:", ".".join([str(x) for x in ver_tag]), flush=True)
-    return ver_tag, branch
+    return ret_ver, branch
 
 
 def increment_version(version: VERSION_TUPLE, bump: str = "patch") -> VERSION_TUPLE:
@@ -84,7 +85,7 @@ def increment_version(version: VERSION_TUPLE, bump: str = "patch") -> VERSION_TU
     # zero out minor and patch components if needed
     for i in range(component + 1, len(COMPONENTS)):
         new_ver[i] = 0
-    return tuple(new_ver)
+    return (new_ver[0], new_ver[1], new_ver[2])
 
 
 def get_changelog(
@@ -108,7 +109,7 @@ def get_changelog(
     args = [exe_name, "--use-branch-tags", "--github-repo", f"nRF24/{Path.cwd().name}"]
     if not full:
         args.append("--unreleased")
-        output = str(RELEASE_NOTES)
+        output = RELEASE_NOTES
     env = {
         "FIRST_COMMIT": first_commit,
         "GIT_CLIFF_CONFIG": str(GIT_CLIFF_CONFIG),
@@ -155,14 +156,14 @@ def update_metadata_files(version: str) -> bool:
     if arduino_meta_file.exists():
         # simple search and replace
         ver_pattern = re.compile(r"version=(\d+\.\d+\.?\d*)")
-        data = arduino_meta_file.read_text(encoding="utf-8")
-        ver_match = ver_pattern.search(data)
+        ini_data = arduino_meta_file.read_text(encoding="utf-8")
+        ver_match = ver_pattern.search(ini_data)
         assert ver_match is not None, "could not find version in " + str(
             arduino_meta_file
         )
         if ver_match.group(1) != version:
-            data = ver_pattern.sub(f"version={version}", data)
-            arduino_meta_file.write_text(data, encoding="utf-8", newline="\n")
+            ini_data = ver_pattern.sub(f"version={version}", ini_data)
+            arduino_meta_file.write_text(ini_data, encoding="utf-8", newline="\n")
             made_changes = True
 
     return made_changes
diff --git a/.github/requirements.txt b/.github/requirements.txt
new file mode 100644
index 0000000..1d1e7ce
--- /dev/null
+++ b/.github/requirements.txt
@@ -0,0 +1 @@
+git-cliff==2.10.1
diff --git a/.github/workflows/arduino_size_deltas.yaml b/.github/workflows/arduino_size_deltas.yaml
index 40b52a5..d3d0b12 100644
--- a/.github/workflows/arduino_size_deltas.yaml
+++ b/.github/workflows/arduino_size_deltas.yaml
@@ -18,6 +18,6 @@ jobs:
           pattern: arduino-deltas-*
           path: ${{ inputs.reports-path }}
 
-      - uses: 2bndy5/arduino-report-size-deltas@v1
+      - uses: 2bndy5/arduino-report-size-deltas@5d226f8792e1cca65534f3697748af289138af25 # v1.0.4
         with:
           sketches-reports-source: ${{ inputs.reports-path }}
diff --git a/.github/workflows/build_arduino.yaml b/.github/workflows/build_arduino.yaml
index d29e142..4c68e36 100644
--- a/.github/workflows/build_arduino.yaml
+++ b/.github/workflows/build_arduino.yaml
@@ -73,15 +73,19 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       
-      - name: sketch reports
+      - name: Delta reports' artifact name
         if: inputs.enable-deltas-report
         id: delta-report-name
+        env:
+          FQBN: ${{ inputs.fqbn }}
         run: >-
-          echo "report-name=${{ inputs.fqbn }}" | tr : - >> "$GITHUB_OUTPUT"
+          echo "report-name=${FQBN}" | tr : - >> "${GITHUB_OUTPUT}"
 
       - name: Compile examples
-        uses: arduino/compile-sketches@main
+        uses: arduino/compile-sketches@8ac27e99289705c4abec832089575d687b859227 # v1.1.2
         with:
           # cli-version: '0.33.0'
           sketch-paths: ${{ inputs.sketch-paths }}
diff --git a/.github/workflows/build_docs.yaml b/.github/workflows/build_docs.yaml
index 026404d..c874561 100644
--- a/.github/workflows/build_docs.yaml
+++ b/.github/workflows/build_docs.yaml
@@ -11,123 +11,87 @@ on:
         type: string
         default: '1.9.6'
 
+permissions: {}
+
 jobs:
   get-info:
     runs-on: ubuntu-latest
     outputs:
       lib-version: ${{ steps.fetch-repo.outputs.release }}
-      lib-name: ${{ steps.fetch-repo.outputs.name }}
-      mk-sphinx: ${{ steps.fetch-repo.outputs.has-sphinx-docs }}
     steps:
       - name: Checkout repo w/o history
         if: endsWith(github.repository, 'RF24Gateway') == false
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Checkout repo w/ history
         if: endsWith(github.repository, 'RF24Gateway')
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: get latest release version number
         id: fetch-repo
         run: |
           if [[ -f library.properties ]]; then
-            echo "release=v$(awk -F "=" '/version/ {print $2}' library.properties)" >> $GITHUB_OUTPUT
+            echo "release=v$(awk -F "=" '/version/ {print $2}' library.properties)" >> "${GITHUB_OUTPUT}"
           else
-            echo "release=$(git describe --tags | grep -o -E 'v[0-9]+\.[0-9]+\.[0-9]+')" >> $GITHUB_OUTPUT
+            echo "release=$(git describe --tags | grep -o -E 'v[0-9]+\.[0-9]+\.[0-9]+')" >> "${GITHUB_OUTPUT}"
           fi
-          echo "name=$(echo ${{ github.repository }} | sed 's;.\+/;;')" >> $GITHUB_OUTPUT
-          echo "has-sphinx-docs=$(if [[ -d docs/sphinx ]]; then echo true; else echo false; fi)" >> $GITHUB_OUTPUT
 
-  build-doxygen:
+  build:
     runs-on: ubuntu-latest
     needs: [get-info]
     steps:
       # - name: install Doxygen static libclang deps
       #   run: sudo apt-get install libclang1-16 libclang-cpp16
 
-      - name: install doxygen from SF binary archives
+      - name: Install Doxygen
         env:
           DOXYGEN_VERSION: ${{ inputs.doxygen-version }}
-        run: |
+        run: |-
           mkdir .doxygen && cd .doxygen
-          curl -L https://sourceforge.net/projects/doxygen/files/rel-$DOXYGEN_VERSION/doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz > doxygen.tar.gz
+          curl -L "https://github.com/doxygen/doxygen/releases/download/Release_${DOXYGEN_VERSION//./_}/doxygen-${DOXYGEN_VERSION}.linux.bin.tar.gz" --output ${{ runner.temp }}/doxygen.tar.gz
+          cd ${{ runner.temp }}
           gunzip doxygen.tar.gz
           tar xf doxygen.tar
-          cd doxygen-$DOXYGEN_VERSION
+          cd "doxygen-${DOXYGEN_VERSION}"
           sudo make install
 
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
-      - name: overwrite doxygen tags
+      - name: Overwrite doxygen tags
         working-directory: docs
+        env:
+          LIB_VERSION: ${{ needs.get-info.outputs.lib-version }}
         run: |
           touch doxygenAction
-          echo "PROJECT_NUMBER = ${{ needs.get-info.outputs.lib-version }}" >> doxygenAction
+          echo "PROJECT_NUMBER = ${LIB_VERSION}" >> doxygenAction
           echo -e "\n@INCLUDE = doxygenAction" >> Doxyfile
 
       - run: doxygen
         working-directory: docs
 
-      - name: Save doxygen docs as artifact
-        uses: actions/upload-artifact@v5
+      - name: Upload github pages artifact
+        uses: actions/upload-pages-artifact@v4
         with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_docs
+          name: ${{ github.event.repository.name }}_doxygen_docs
           path: ${{ github.workspace }}/docs/html
 
-      - name: Save doxygen XML as artifact
-        if: needs.get-info.outputs.mk-sphinx == 'true'
-        uses: actions/upload-artifact@v5
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_xml
-          path: ${{ github.workspace }}/docs/sphinx/xml
-
-  build-sphinx:
-    needs: [get-info, build-doxygen]
-    if: needs.get-info.outputs.mk-sphinx == 'true'
+  deploy:
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/setup-python@v6
-        with:
-          python-version: 3.x
-
-      - uses: actions/checkout@v6
-
-      - name: download XML artifact
-        uses: actions/download-artifact@v6
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_xml
-          path: ${{ github.workspace }}/docs/sphinx/xml
-
-      - name: Install sphinx deps
-        run: python -m pip install -r docs/sphinx/requirements.txt
-
-      - name: build docs with Sphinx
-        working-directory: docs
-        run: sphinx-build sphinx _build
-
-      - name: Save sphinx docs as artifact
-        uses: actions/upload-artifact@v5
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_sphinx_docs
-          path: ${{ github.workspace }}/docs/_build
-
-  deploy-docs:
-    runs-on: ubuntu-latest
-    needs: [get-info, build-doxygen]
+    needs: [build]
     if: inputs.deploy-gh-pages
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write # to deploy to Pages
+      id-token: write # to verify the deployment originates from an appropriate source
     steps:
-      - name: get repo info
-        id: lib-info
-        run: echo "name=$(echo ${{ github.repository }} | sed 's;.\+/;;')" >> $GITHUB_OUTPUT
-
-      - name: downlod artifact
-        uses: actions/download-artifact@v6
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_docs
-          path: docs
-
-      - name: upload to github pages
-        uses: peaceiris/actions-gh-pages@v4
+      - uses: actions/deploy-pages@v4
+        id: deployment
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./docs
+          artifact_name: ${{ github.event.repository.name }}_doxygen_docs
diff --git a/.github/workflows/build_linux_cmake.yaml b/.github/workflows/build_linux_cmake.yaml
index 016846d..20f6d95 100644
--- a/.github/workflows/build_linux_cmake.yaml
+++ b/.github/workflows/build_linux_cmake.yaml
@@ -40,78 +40,85 @@ on:
         default: master
         description: git ref of the RF24Mesh lib dependency
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
     env:
       RF24_DRIVER: ${{ inputs.driver }}
       # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
-      BUILD_TYPE: Release
+      # This env var is supported by CMake as of v3.22+
+      CMAKE_BUILD_TYPE: Release
     steps:
-      # - name: provide toolchain (for x86_64)
+      # - name: Provide toolchain (for x86_64)
       #   if: ${{ inputs.compiler == 'x86_64' }}
       #   run: |
       #     sudo apt-get update
       #     sudo apt-get install gcc-x86-64-linux-gnux32 g++-x86-64-linux-gnux32
 
-      # - name: provide toolchain (for i686)
+      # - name: Provide toolchain (for i686)
       #   if: ${{ inputs.compiler == 'i686' }}
       #   run: |
       #     sudo apt-get update
       #     sudo apt-get install gcc-i686-linux-gnu g++-i686-linux-gnu
 
-      - name: provide toolchain (for arm64)
+      - name: Provide toolchain (for arm64)
         if: ${{ inputs.compiler == 'arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
 
-      - name: provide toolchain (for armhf)
+      - name: Provide toolchain (for armhf)
         if: ${{ inputs.compiler == 'armhf' }}
         run: |
           sudo apt-get update
           sudo apt-get install gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf
 
-      - name: get repo info
+      - name: Get repo info
         id: lib-info
-        run: |
-          lib_name=$(echo ${{ github.repository }} | sed 's;.\+/;;')
-          echo "name=$lib_name" >> $GITHUB_OUTPUT
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: |-
           lib_deps=''
-          if [[ $lib_name == 'RF24Mesh' ]]; then
+          if [[ "${REPO_NAME}" == 'RF24Mesh' ]]; then
               lib_deps='RF24Network'
-          elif [[ $lib_name == 'RF24Gateway' ]]; then
+          elif [[ "${REPO_NAME}" == 'RF24Gateway' ]]; then
               lib_deps='RF24Network;RF24Mesh'
           fi
-          echo "deps=$lib_deps" >> $GITHUB_OUTPUT
+          echo "deps=$lib_deps" >> "${GITHUB_OUTPUT}"
 
-      - name: checkout RF24
+      - name: Checkout RF24
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24
           path: RF24
           ref: ${{ inputs.rf24-ref }}
 
-      - name: provide MRAA
+      - name: Provide MRAA
         if: inputs.driver == 'MRAA'
-        run: |
+        env:
+          # this env var is supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: ${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           git clone https://github.com/intel-iot-devkit/mraa.git
           cd mraa
           mkdir build
           cd build
-          cmake .. -D BUILDSWIGNODE=OFF \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake .. -D BUILDSWIGNODE=OFF
           sudo make install
 
-      - name: provide WiringPi
+      - name: Provide WiringPi
         if: inputs.driver == 'wiringPi' && inputs.compiler == 'default'
-        run: |
+        run: |-
           git clone https://github.com/WiringPi/WiringPi
           cd WiringPi
           ./build
 
-      # - name: provide WiringPi (with toolchain compilers)
+      # - name: Provide WiringPi (with toolchain compilers)
       #   if: inputs.driver == 'wiringPi' && inputs.compiler != 'default'
       #   env:
       #     CC: /usr/bin/${{ inputs.usr-dir }}-gcc
@@ -121,9 +128,14 @@ jobs:
       #     cd WiringPi
       #     ./build
 
-      - name: provide pigpio
+      - name: Provide pigpio
         if: inputs.driver == 'pigpio'
-        run: |
+        env:
+          # this env var is supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: ${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           git clone https://github.com/joan2937/pigpio.git
           cd pigpio
           git fetch --tags
@@ -131,173 +143,196 @@ jobs:
           git checkout $latestTag
           mkdir build
           cd build
-          cmake .. -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake .. 
           make
           sudo make install
 
-      - name: build & install RF24
+      - name: Build & install RF24
         if: endsWith(github.repository, 'RF24') == false
         working-directory: RF24
-        run: |
+        env:
+          # this env var is supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           mkdir build
           cd build
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake ..
           sudo make install
 
-      - name: checkout RF24Network
+      - name: Checkout RF24Network
         if: contains(steps.lib-info.outputs.deps, 'RF24Network') || endsWith(github.repository, 'RF24Network')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Network
           path: RF24Network
           ref: ${{ inputs.rf24network-ref }}
 
-      - name: build & install RF24Network
+      - name: Build & install RF24Network
         if: contains(steps.lib-info.outputs.deps, 'RF24Network')
         working-directory: RF24Network
-        run: |
+        env:
+          # these env vars are supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           mkdir build
           cd build
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake ..
           sudo make install
 
-      - name: checkout RF24Mesh repo
+      - name: Checkout RF24Mesh repo
         if: contains(steps.lib-info.outputs.deps, 'RF24Mesh') || endsWith(github.repository, 'RF24Mesh')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Mesh
           path: RF24Mesh
           ref: ${{ inputs.rf24mesh-ref }}
 
-      - name: build & install RF24Mesh
+      - name: Build & install RF24Mesh
         working-directory: RF24Mesh
         if: contains(steps.lib-info.outputs.deps, 'RF24Mesh')
-        run: |
+        env:
+          # these env vars are supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           mkdir build
           cd build
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake ..
           sudo make install
 
-      - name: checkout RF24Gateway repo
+      - name: Checkout RF24Gateway repo
         if: endsWith(github.repository, 'RF24Gateway')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Gateway
           fetch-depth: 0  # for version number fetching in cmake
           path: RF24Gateway
           ref: ${{ github.sha }}
 
-      - name: create CMake build environment
-        run: cmake -E make_directory ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
-
-      - name: configure lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
-        run: |
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
-
-      - name: build lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+      - name: Create CMake build environment
+        env:
+          BUILD_DIR: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        run: cmake -E make_directory "${BUILD_DIR}"
+
+      - name: Configure lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        env:
+          # these env vars are supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: cmake ..
+
+      - name: Build lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: cmake --build .
 
-      - name: install lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+      - name: Install lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: sudo cmake --install .
 
-      - name: package lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+      - name: Package lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: sudo cpack
 
       - name: Save artifact
         uses: actions/upload-artifact@v5
         with:
-          name: pkg_${{ steps.lib-info.outputs.name }}_${{ inputs.compiler }}_${{ inputs.driver }}
-          path: |
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/pkgs/*.deb
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/pkgs/*.rpm
+          name: pkg_${{ github.event.repository.name }}_${{ inputs.compiler }}_${{ inputs.driver }}
+          path: |-
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/pkgs/*.deb
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/pkgs/*.rpm
 
-      - name: Upload Release assets
-        if: inputs.deploy-release
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: "${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/pkgs/librf24*"
-
-      - name: clean build environment
+      - name: Clean build environment
         if: inputs.examples-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: sudo rm -r ./*
 
-      - name: provide ncurses
-        if: inputs.examples-path != ''
+      - name: Provide ncurses
+        # only done for native compilation because cross-compiling ncurses from
+        # source is prone to linker errors and takes a long time.
+        if: inputs.examples-path != '' && inputs.compiler == 'default'
         # This script assumes that any examples using ncurses reside in a 'ncurses' subdirectory
         # as is the case w/ RF24Mesh, RF24Gateway, and any new ncurses examples going forward.
-        run: |
-          if [[ -d ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/${{ inputs.examples-path }}/ncurses ]]; then
-            if [[ ${{ inputs.compiler }} == 'default' ]]; then
-              sudo apt-get install libncurses5-dev
-            else
-              echo "skipping the ncurses examples for cross-compiled builds"
-
-              # avoid cross-compiling linker problems in CI; this works locally but takes a while to build
-              # curl -L https://invisible-island.net/datafiles/release/ncurses.tar.gz > ncurses.tar.gz
-              # gunzip ncurses.tar.gz
-              # tar xf ncurses.tar
-              # cd ncurses-*
-              # ./configure --prefix=/usr/${{ inputs.usr-dir }} --build=${{ inputs.usr-dir }}
-              # make
-              # sudo make install
-            fi
+        env:
+          EXAMPLES_PATH: ${{ github.workspace }}/${{ github.event.repository.name }}/${{ inputs.examples-path }}/ncurses
+        run: |-
+          if [[ -d "${EXAMPLES_PATH}" ]]; then
+            sudo apt-get install libncurses5-dev
           else
             echo "ncurses is not needed for these examples"
           fi
 
-      - name: configure examples
+      - name: Configure examples
         if: inputs.examples-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
-        run: |
-          cmake ../${{ inputs.examples-path }} \
-          -D CMAKE_TOOLCHAIN_FILE=../cmake/toolchains/${{ inputs.compiler }}.cmake
-
-      - name: build examples
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        env:
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+          EXAMPLES_PATH: ../${{ inputs.examples-path }}
+        run: cmake "${EXAMPLES_PATH}"
+
+      - name: Build examples
         if: inputs.examples-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         # doesn't build the RF24Mesh_Ncurses_Master example because we haven't cross-compiled it in this workflow
         run: cmake --build .
 
-      - name: provide python wrapper prerequisites
+      - name: Provide python wrapper prerequisites
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
         # python3-rpi.gpio is only required for physical hardware (namely the IRQ example)
         run: sudo apt-get install python3-dev libboost-python-dev python3-setuptools
 
-      - name: create alias symlink to libboost_python3*.so
+      - name: Create alias symlink to libboost_python3*.so
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
         id: symlink-boost-python
-        run: |
+        run: |-
           arch=$(ls /usr/lib/gcc | tail -1)
           arch_libs=/usr/lib/$arch
           boost_python_so=$(ls $arch_libs/libboost_python3*.so | tail -1)
           py_ver=$(echo $boost_python_so | sed -E 's/.*libboost_python([0-9])([0-9]+)\.so/\1.\2/')
-          echo "python version used by boost.pytrhon is $py_ver"
-          echo "python-version=$py_ver" >> $GITHUB_OUTPUT
+          echo "python version used by boost.python is $py_ver"
+          echo "python-version=$py_ver" >> "${GITHUB_OUTPUT}"
           sudo ln -s $boost_python_so $arch_libs/libboost_python3.so
 
-      # cross-compiling a python C extension is better done with pypa/cibuildwheel action
       - name: Set up Python version used by boost.python
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
         uses: actions/setup-python@v6
         with:
           python-version: ${{ steps.symlink-boost-python.outputs.python-version }}
 
-      - name: install python wrapper
+      - name: Install python wrapper
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/${{ inputs.py-wrapper-path }}
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/${{ inputs.py-wrapper-path }}
         run: python3 -m pip install .
+
+  upload-release-assets:
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: inputs.deploy-release
+    permissions:
+      # allow uploading release assets
+      contents: write
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v5
+        with:
+          pattern: pkg_${{ github.event.repository.name }}_*
+          path: ./artifacts
+          merge-multiple: true
+
+      - name: Upload Release assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}          
+        run: |-
+          files=$(ls artifacts/*.deb artifacts/*.rpm)
+          gh release upload "${TAG}" ${files}
diff --git a/.github/workflows/build_pico_sdk.yaml b/.github/workflows/build_pico_sdk.yaml
index 026bec0..e7a4255 100644
--- a/.github/workflows/build_pico_sdk.yaml
+++ b/.github/workflows/build_pico_sdk.yaml
@@ -27,54 +27,66 @@ on:
         default: examples_pico
         description: The path to the Pico SDK examples. Defaults to `examples_pico`.
 
+permissions: {}
 
 jobs:
   build:
     runs-on: ubuntu-latest
     env:
       # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
-      BUILD_TYPE: Release
+      # this env var is supported by CMake as of v3.22+
+      CMAKE_BUILD_TYPE: Release
 
     steps:
-      - name: get repo info
+      - name: Get repo info
         id: lib-info
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          lib_name=$(echo ${{ github.repository }} | sed 's;.\+/;;')
-          echo "name=$lib_name" >> $GITHUB_OUTPUT
+          echo "name=${REPO_NAME}" >> "${GITHUB_OUTPUT}"
           lib_deps=''
-          if [[ $lib_name == 'RF24Mesh' ]]; then
+          if [[ "${REPO_NAME}" == 'RF24Mesh' ]]; then
               lib_deps='RF24Network'
           fi
-          echo "deps=$lib_deps" >> $GITHUB_OUTPUT
+          echo "deps=${lib_deps}" >> "${GITHUB_OUTPUT}"
 
-      - name: checkout RF24 lib
+      - name: Checkout RF24 lib
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24
           path: RF24
           ref: ${{ inputs.rf24-ref }}
 
-      - name: checkout RF24Network lib
+      - name: Checkout RF24Network lib
         if: contains(steps.lib-info.outputs.deps, 'RF24Network') || endsWith(github.repository, 'RF24Network')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Network
           path: RF24Network
           ref: ${{ inputs.rf24network-ref }}
 
-      - name: checkout RF24Mesh lib
+      - name: Checkout RF24Mesh lib
         if: endsWith(github.repository, 'RF24Mesh')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           path: RF24Mesh
           ref: ${{ inputs.rf24mesh-ref }}
 
       - name: Install toolchain
-        run: sudo apt update && sudo apt install gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential
+        run: >-
+          sudo apt update &&
+          sudo apt install
+          gcc-arm-none-eabi
+          libnewlib-arm-none-eabi
+          build-essential
 
       - name: Clone pico-sdk
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: raspberrypi/pico-sdk
           # master branch is latest stable release
           path: pico-sdk
@@ -86,28 +98,31 @@ jobs:
         run: git submodule update --init
 
       - name: Create Build Environment
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}
         env:
           PICO_SDK_PATH: ${{ github.workspace }}/pico-sdk
-        run: cmake -E make_directory ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+          BUILD_DIR: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        run: cmake -E make_directory "${BUILD_DIR}"
 
       - name: Configure CMake
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         env:
           PICO_SDK_PATH: ${{ github.workspace }}/pico-sdk
-        run: cmake ../${{ inputs.examples-path }} -DCMAKE_BUILD_TYPE=$BUILD_TYPE -DPICO_BOARD=${{ inputs.board-id }}
+          EXAMPLES_PATH: ../${{ inputs.examples-path }}
+          PICO_BOARD: ${{ inputs.board-id }}
+        run: cmake "${EXAMPLES_PATH}" -D PICO_BOARD="${PICO_BOARD}"
 
       - name: Build
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         # Execute the build. You can specify a specific target with "--target <NAME>"
-        run: cmake --build . --config $BUILD_TYPE
+        run: cmake --build . --config "${CMAKE_BUILD_TYPE}"
 
       - name: Save artifact
         uses: actions/upload-artifact@v5
         with:
           name: examples_pico_${{ inputs.board-id }}
           path: |
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.uf2
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.elf
-          # ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.hex
-          # ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.bin
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.uf2
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.elf
+          # ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.hex
+          # ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.bin
diff --git a/.github/workflows/build_platformio.yaml b/.github/workflows/build_platformio.yaml
index 79d7fb9..f99c59f 100644
--- a/.github/workflows/build_platformio.yaml
+++ b/.github/workflows/build_platformio.yaml
@@ -34,6 +34,7 @@ on:
         default: master
         description: git ref of the RF24Mesh lib dependency
 
+permissions: {}
 
 jobs:
   run_pio:
@@ -44,8 +45,7 @@ jobs:
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
+          restore-keys: ${{ runner.os }}-pip-
 
       # - name: Cache PlatformIO
       #   uses: actions/cache@v4
@@ -61,18 +61,21 @@ jobs:
           python-version: 3.x
 
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
-      - name: get lib info
+      - name: Get lib info
         id: lib-info
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          lib_name=$(echo ${{ github.repository }} | sed -e 's;.\+/;;')
           rf24_deps=''
-          if [[ $lib_name == 'RF24Mesh' ]]; then
+          if [[ "${REPO_NAME}" == 'RF24Mesh' ]]; then
             rf24_deps=RF24Network
-          elif [[ $lib_name == 'RF24Ethernet' ]]; then
+          elif [[ "${REPO_NAME}" == 'RF24Ethernet' ]]; then
             rf24_deps='RF24Network;RF24Mesh'
           fi
-          echo "rf24-deps=$rf24_deps" >> $GITHUB_OUTPUT
+          echo "rf24-deps=$rf24_deps" >> "${GITHUB_OUTPUT}"
 
       - name: Install PlatformIO
         run: |
@@ -81,21 +84,30 @@ jobs:
 
       - name: Install extra dependencies
         if: inputs.lib-deps != ''
-        run: pio pkg install -g ${{ inputs.lib-deps }}
+        env:
+          LIB_DEPS: ${{ inputs.lib-deps }}
+        run: pio pkg install -g ${LIB_DEPS}
 
       - name: Install RF24Mesh library dependency
         if: contains(steps.lib-info.outputs.rf24-deps, 'RF24Mesh') && !endsWith(github.repository, 'RF24Mesh')
-        run: pio pkg install -g -f --skip-dependencies -l 'https://github.com/nRF24/RF24Mesh.git#${{ inputs.rf24mesh-ref }}'
+        env:
+          RF24MESH_REF: ${{ inputs.rf24mesh-ref }}
+        run: pio pkg install -g -f --skip-dependencies -l "https://github.com/nRF24/RF24Mesh.git#${RF24MESH_REF}"
 
       - name: Install RF24Network library dependency
         if: contains(steps.lib-info.outputs.rf24-deps, 'RF24Network') && !endsWith(github.repository, 'RF24Network')
-        run: pio pkg install -g -f --skip-dependencies -l 'https://github.com/nRF24/RF24Network.git#${{ inputs.rf24network-ref }}'
+        env:
+          RF24NETWORK_REF: ${{ inputs.rf24network-ref }}
+        run: pio pkg install -g -f --skip-dependencies -l "https://github.com/nRF24/RF24Network.git#${RF24NETWORK_REF}"
 
       - name: Install RF24 library dependency
         if: endsWith(github.repository, 'RF24') == false
-        run: pio pkg install -g -f --skip-dependencies -l 'https://github.com/nRF24/RF24.git#${{ inputs.rf24-ref }}'
+        env:
+          RF24_REF: ${{ inputs.rf24-ref }}
+        run: pio pkg install -g -f --skip-dependencies -l "https://github.com/nRF24/RF24.git#${RF24_REF}"
 
       - name: Run PlatformIO
-        run: pio ci --lib="." --board=${{ inputs.board-id }}
         env:
           PLATFORMIO_CI_SRC: ${{ inputs.example-path }}
+          BOARD: ${{ inputs.board-id }}
+        run: pio ci --lib="." --board="${BOARD}"
diff --git a/.github/workflows/bump_version_release.yaml b/.github/workflows/bump_version_release.yaml
index 51e85a7..03abb14 100644
--- a/.github/workflows/bump_version_release.yaml
+++ b/.github/workflows/bump_version_release.yaml
@@ -36,62 +36,72 @@ on:
 
 run-name: Deploying ${{ inputs.repo }} ${{ inputs.branch }}
 
+permissions: {}
+
 jobs:
   release-version-bump:
     runs-on: ubuntu-latest
+    # permissions required for secrets.BUMP_N_RELEASE token:
+    #   contents: write # to `git push` and create releases
+    #   pull-requests: read # to read PR info when regenerating the changelog
     steps:
-      - name: checkout ${{ inputs.repo }}
+      - name: Checkout ${{ inputs.repo }}
         uses: actions/checkout@v6
         with:
+          persist-credentials: true # needed for `git push`
           repository: nRF24/${{ inputs.repo }}
           ref: ${{ inputs.branch }}
           fetch-depth: 0
           path: ${{ inputs.repo }}
           token: ${{ secrets.BUMP_N_RELEASE }}
 
-      - name: checkout org repo
+      - name: Checkout org repo
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           path: org-repo
 
       - uses: actions/setup-python@v6
         with:
-          # here we need v3.10+
-          python-version: 3.x
-
-      - run: rustup update --no-self-update
-
-      - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@main
+          python-version: ">=3.10"
 
       - name: Install git-cliff
-        run: cargo binstall -y git-cliff --install-path org-repo
+        run: pip install -r org-repo/.github/requirements.txt
 
-      - name: increment version
+      - name: Increment version
         working-directory: ${{ inputs.repo }}
         id: inc-ver
+        env:
+          # needed by git-cliff to regenerate changelog
+          GITHUB_TOKEN: ${{ secrets.BUMP_N_RELEASE }}
+          BUMP_COMPONENT: ${{ inputs.bump-component }}
         run: >-
-          python "../org-repo/.github/workflows/increment_version.py"
-          --bump=${{ inputs.bump-component }}
+          python "../org-repo/.github/increment_version.py"
+          --bump="${BUMP_COMPONENT}"
           --update-metadata
 
-      - name: push metadata changes
+      - name: Push metadata changes
         working-directory: ${{ inputs.repo }}
         if: steps.inc-ver.outputs.made-changes == 'true'
+        env:
+          TAG: v${{ steps.inc-ver.outputs.new-version }}
         run: |-
           git config --global user.name "${GITHUB_ACTOR}"
           git config --global user.email "${GITHUB_ACTOR_ID}+${GITHUB_ACTOR}@users.noreply.github.com"
           git add --all
-          git commit -m "bump version to v${{ steps.inc-ver.outputs.new-version }}"
+          git commit -m "bump version to ${TAG}"
           git push
 
-      - name: publish release
+      - name: Publish release
         env:
           GH_TOKEN: ${{ secrets.BUMP_N_RELEASE }}
+          REPO: nRF24/${{ inputs.repo }}
+          BRANCH: ${{ inputs.branch }}
+          TAG: v${{ steps.inc-ver.outputs.new-version }}
+          NOTES: ${{ steps.inc-ver.outputs.release-notes }}
         run: >-
-          gh release create
-          v${{ steps.inc-ver.outputs.new-version }}
-          --notes-file ${{ steps.inc-ver.outputs.release-notes }}
-          --repo nRF24/${{ inputs.repo }}
-          --target ${{ inputs.branch }}
-          --title v${{ steps.inc-ver.outputs.new-version }}
+          gh release create "${TAG}"
+          --notes-file "${NOTES}"
+          --repo "${REPO}"
+          --target "${BRANCH}"
+          --title "${TAG}"
diff --git a/.github/workflows/cpp_lint.yaml b/.github/workflows/cpp_lint.yaml
index f8d2dd8..3c4c14d 100644
--- a/.github/workflows/cpp_lint.yaml
+++ b/.github/workflows/cpp_lint.yaml
@@ -12,11 +12,20 @@ on:
         type: string
         default: c,h,cpp,hpp
 
+permissions: {}
+
 jobs:
   cpp_linter:
     runs-on: ubuntu-latest
+    permissions:
+      # allow cpp-linter to post suggestions in PR reviews
+      pull-requests: write
+      # allow cpp-linter to detect which files changed
+      contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6
         with:
           python-version: 3.x
@@ -24,18 +33,20 @@ jobs:
         run: sudo apt-get install clang-format-14
       - name: Install linter python package
         run: python3 -m pip install 'cpp-linter>=1.7.1'
-      - name: run linter as a python package
+      - name: Run cpp-linter (python package)
         id: linter
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IGNORE: ${{ inputs.ignore }}
+          EXTENSIONS: ${{ inputs.extensions }}
         run: >-
           cpp-linter
           --version=14
           --style=file
           --tidy-checks='-*'
           --lines-changed-only=true
-          --extensions=${{ inputs.extensions }}
-          --ignore='${{ inputs.ignore }}'
+          --extensions=${EXTENSIONS}
+          --ignore="${IGNORE}"
           --format-review=true
           --file-annotations=false
           --step-summary=true
diff --git a/.github/workflows/lint_ci.yaml b/.github/workflows/lint_ci.yaml
new file mode 100644
index 0000000..b6327bf
--- /dev/null
+++ b/.github/workflows/lint_ci.yaml
@@ -0,0 +1,29 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  lint-ci:
+    name: CI Workflows
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: 3.x
+
+      - name: Run zizmor
+        env:
+          # only used to relaxed rate limits; no special permissions needed
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: pipx run zizmor --format github ./
diff --git a/.github/workflows/validate_deploy_platformio.yaml b/.github/workflows/validate_deploy_platformio.yaml
index a3ca1ec..9ba9e64 100644
--- a/.github/workflows/validate_deploy_platformio.yaml
+++ b/.github/workflows/validate_deploy_platformio.yaml
@@ -1,4 +1,5 @@
 name: Validate and deploy PlatformIO
+
 on:
   workflow_call:
     inputs:
@@ -9,18 +10,23 @@ on:
       PLATFORMIO_AUTH_TOKEN:
         required: false
 
+permissions: {}
+
 jobs:
   validate_lib_json:
     runs-on: ubuntu-latest
-
+    permissions:
+      # needed to upload release assets
+      contents: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: get lib info
         id: lib-info
-        run: |
-          echo "name=$(echo ${{ github.repository }} | sed -e 's;.\+/;;')" >> $GITHUB_OUTPUT
-          echo "release=$(awk -F "=" '/version/ {print $2}' library.properties)" >> $GITHUB_OUTPUT
+        run: |-
+          echo "release=$(awk -F "=" '/version/ {print $2}' library.properties)" >> "${GITHUB_OUTPUT}"
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -28,27 +34,31 @@ jobs:
           python-version: 3.x
 
       - name: Install PlatformIO
-        run: |
+        run: |-
           python -m pip install --upgrade pip
           pip install --upgrade platformio
 
       - name: package lib
-        run: pio package pack -o PlatformIO-${{ steps.lib-info.outputs.name }}-${{ steps.lib-info.outputs.release }}.tar.gz
+        env:
+          PIO_PKG_NAME: PlatformIO-${{ github.event.repository.name }}-${{ steps.lib-info.outputs.release }}.tar.gz
+        run: pio package pack -o "${PIO_PKG_NAME}"
 
       - name: Save artifact
         uses: actions/upload-artifact@v5
         with:
-          name: PIO_pkg_${{ steps.lib-info.outputs.name }}
+          name: PIO_pkg_${{ github.event.repository.name }}
           path: PlatformIO*.tar.gz
 
       - name: Upload Release assets
-        if: inputs.deploy-release
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: "PlatformIO*.tar.gz"
+        if: inputs.deploy-release && startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |- 
+          files=$(ls PlatformIO*.tar.gz)
+          gh release upload "${TAG}" ${files}
 
-      - name: upload package to PlatformIO Registry
+      - name: Upload package to PlatformIO Registry
         if: inputs.deploy-release
         # PIO lib packages cannot be re-published under the same tag
         env:

From 7c60957fb887d9fd0827245324dcfe16c59e96fc Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Mon, 24 Nov 2025 07:31:06 -0800
Subject: [PATCH 2/9] dry-run modified inc_ver.py script

---
 .github/cliff.toml           | 20 +++++++++++++++++++-
 .github/increment_version.py | 15 ++++++++-------
 .gitignore                   |  2 +-
 3 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/.github/cliff.toml b/.github/cliff.toml
index c3edbe6..8c13fcd 100644
--- a/.github/cliff.toml
+++ b/.github/cliff.toml
@@ -95,6 +95,7 @@ commit_preprocessors = [
 ]
 # regex for parsing and grouping commits
 commit_parsers = [
+    # The order of parsers matters. Put rules for PR labels first to prioritize PR labels.
     { field = "github.pr_labels", pattern = "breaking", group = "<!-- 0 --> 💥 Breaking changes" },
     { field = "github.pr_labels", pattern = "breaking-change", group = "<!-- 0 --> 💥 Breaking changes" },
     { field = "github.pr_labels", pattern = "feature", group = "<!-- 1 --> 🚀 Added" },
@@ -111,7 +112,24 @@ commit_parsers = [
     { field = "github.pr_labels", pattern = "skip-changelog", skip = true },
     { field = "github.pr_labels", pattern = "no-changelog", skip = true },
     { field = "github.pr_labels", pattern = "invalid", skip = true },
-    # The order of parsers matters. Put rules for PR labels first to prioritize PR labels.
+    # Here are rules that apply to conventional commits
+    { field = "group", pattern = "add", group = "<!-- 1 --> 🚀 Added" },
+    { field = "group", pattern = "feat", group = "<!-- 1 --> 🚀 Added" },
+    { field = "group", pattern = "fix", group = "<!-- 4 --> 🛠️ Fixed" },
+    { field = "group", pattern = "perf", group = "<!-- 13 --> ⚡ Performance" },
+    { field = "group", pattern = "build", group = "<!-- 6 --> 📦 Dependency updates" },
+    { field = "group", pattern = "test", group = "<!-- 7 --> 🚦 Tests" },
+    { field = "group", pattern = "docs", group = "<!-- 8 --> 📝 Documentation" },
+    { field = "group", pattern = "chore", group = "<!-- 9 --> 🗨️ Changed" },
+    { field = "group", pattern = "style", group = "<!-- 9 --> 🗨️ Changed" },
+    # This rule seems broken when unconventional commits are involved.
+    # { field = "breaking", pattern = true, group = "<!-- 0 --> 💥 Breaking changes" },
+    { field = "group", pattern = "remove", group = "<!-- 3 --> 🗑️ Removed" },
+    { field = "group", pattern = "deprecate", group = "<!-- 2 --> 🚫 Deprecated" },
+    { field = "group", pattern = "delete", group = "<!-- 3 --> 🗑️ Removed" },
+    { field = "group", pattern = "security", group = "<!-- 5 --> 🔐 Security" },
+    { field = "group", pattern = "refactor", group = "<!-- 9 --> 🗨️ Changed" },
+    # Here are rules that apply to unconventional commits
     { message = "^[a|A]dd", group = "<!-- 1 --> 🚀 Added" },
     { message = "^[s|S]upport", group = "<!-- 1 --> 🚀 Added" },
     { message = "^.*: support", group = "<!-- 1 --> 🚀 Added" },
diff --git a/.github/increment_version.py b/.github/increment_version.py
index 06144db..a2256d6 100644
--- a/.github/increment_version.py
+++ b/.github/increment_version.py
@@ -9,6 +9,7 @@
 import re
 import subprocess
 from typing import cast, Tuple, List, Set, Dict
+from shutil import which
 import sys
 from difflib import unified_diff
 
@@ -73,7 +74,7 @@ def get_version() -> Tuple[VERSION_TUPLE, str]:
     else:
         print("treating branch", repr(branch), "as latest stable branch", flush=True)
         ret_ver = sorted_tags[0]
-    print("Current version:", ".".join([str(x) for x in ver_tag]), flush=True)
+    print("Current version:", ".".join([str(x) for x in ret_ver]), flush=True)
     return ret_ver, branch
 
 
@@ -101,11 +102,9 @@ def get_changelog(
     if full:
         old = changelog.read_text(encoding="utf-8")
     output = changelog
-    exe_name = "git-cliff"
-    if environ.get("CI", "false") == "true":
-        exe_name = (
-            (GIT_CLIFF_CONFIG.parent.parent.parent / exe_name).resolve().as_posix()
-        )
+    exe_name = which("git-cliff")
+    assert exe_name is not None, "git-cliff executable not found in PATH"
+    exe_name = Path(exe_name).as_posix()
     args = [exe_name, "--use-branch-tags", "--github-repo", f"nRF24/{Path.cwd().name}"]
     if not full:
         args.append("--unreleased")
@@ -116,12 +115,14 @@ def get_changelog(
         "GIT_CLIFF_OUTPUT": str(output),
         "GIT_CLIFF_TAG": f"v{tag}",
     }
+    if "GITHUB_TOKEN" in environ:
+        env["GITHUB_TOKEN"] = environ["GITHUB_TOKEN"]
     if not full:
         env["GIT_CLIFF__CHANGELOG__HEADER"] = ""
     subprocess.run(args, env=env, check=True)
     if full:
         new = changelog.read_text(encoding="utf-8")
-        changes = list(unified_diff(old, new))
+        changes = list(unified_diff(old.splitlines(), new.splitlines()))
         return len(changes) != 0
     return False
 
diff --git a/.gitignore b/.gitignore
index b248363..12e8b25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
 
-.github/workflows/ReleaseNotes.md
+.github/ReleaseNotes.md

From 2ac88a8046b14d1ddac2ac5e14c7d85b4992e370 Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Mon, 24 Nov 2025 17:26:19 -0800
Subject: [PATCH 3/9] more review changes

---
 .github/workflows/build_linux_cmake.yaml |  2 +-
 .github/workflows/build_platformio.yaml  | 39 +++++++++++-------------
 2 files changed, 19 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/build_linux_cmake.yaml b/.github/workflows/build_linux_cmake.yaml
index 20f6d95..b398d3b 100644
--- a/.github/workflows/build_linux_cmake.yaml
+++ b/.github/workflows/build_linux_cmake.yaml
@@ -276,7 +276,7 @@ jobs:
         working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         env:
           # this env var is supported as of CMake v3.21+
-          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+          CMAKE_TOOLCHAIN_FILE: ../cmake/toolchains/${{ inputs.compiler }}.cmake
           EXAMPLES_PATH: ../${{ inputs.examples-path }}
         run: cmake "${EXAMPLES_PATH}"
 
diff --git a/.github/workflows/build_platformio.yaml b/.github/workflows/build_platformio.yaml
index f99c59f..e0ee491 100644
--- a/.github/workflows/build_platformio.yaml
+++ b/.github/workflows/build_platformio.yaml
@@ -40,30 +40,23 @@ jobs:
   run_pio:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       - name: Cache pip
         uses: actions/cache@v4
         with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
-
-      # - name: Cache PlatformIO
-      #   uses: actions/cache@v4
-      #   with:
-      #     path: |
-      #       ~/.cache/pip
-      #       ~/.platformio/.cache
-      #     key: ${{ runner.os }}-pio
+          path: |
+            ~/.cache/pip
+            ~/.platformio/.cache
+          key: ${{ runner.os }}-pio-${{ inputs.board-id }}-${{ inputs.example-path }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: 3.x
 
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
       - name: Get lib info
         id: lib-info
         env:
@@ -78,9 +71,7 @@ jobs:
           echo "rf24-deps=$rf24_deps" >> "${GITHUB_OUTPUT}"
 
       - name: Install PlatformIO
-        run: |
-          python -m pip install --upgrade pip
-          pip install --upgrade platformio
+        run: pip install --upgrade platformio
 
       - name: Install extra dependencies
         if: inputs.lib-deps != ''
@@ -92,19 +83,25 @@ jobs:
         if: contains(steps.lib-info.outputs.rf24-deps, 'RF24Mesh') && !endsWith(github.repository, 'RF24Mesh')
         env:
           RF24MESH_REF: ${{ inputs.rf24mesh-ref }}
-        run: pio pkg install -g -f --skip-dependencies -l "https://github.com/nRF24/RF24Mesh.git#${RF24MESH_REF}"
+        run: >-
+          pio pkg install -g -f --skip-dependencies
+          -l "https://github.com/nRF24/RF24Mesh.git#${RF24MESH_REF}"
 
       - name: Install RF24Network library dependency
         if: contains(steps.lib-info.outputs.rf24-deps, 'RF24Network') && !endsWith(github.repository, 'RF24Network')
         env:
           RF24NETWORK_REF: ${{ inputs.rf24network-ref }}
-        run: pio pkg install -g -f --skip-dependencies -l "https://github.com/nRF24/RF24Network.git#${RF24NETWORK_REF}"
+        run: >-
+          pio pkg install -g -f --skip-dependencies
+          -l "https://github.com/nRF24/RF24Network.git#${RF24NETWORK_REF}"
 
       - name: Install RF24 library dependency
         if: endsWith(github.repository, 'RF24') == false
         env:
           RF24_REF: ${{ inputs.rf24-ref }}
-        run: pio pkg install -g -f --skip-dependencies -l "https://github.com/nRF24/RF24.git#${RF24_REF}"
+        run: >-
+          pio pkg install -g -f --skip-dependencies
+          -l "https://github.com/nRF24/RF24.git#${RF24_REF}"
 
       - name: Run PlatformIO
         env:

From a18d4e424466f2162eac5cb77a496cacc751ea39 Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Mon, 24 Nov 2025 17:54:53 -0800
Subject: [PATCH 4/9] spelling review (check in cspell config).

---
 .cspell.config.yml                            | 28 +++++++++++++++++++
 .github/workflows/build_arduino.yaml          |  2 +-
 .github/workflows/build_platformio.yaml       |  2 +-
 .../workflows/validate_deploy_platformio.yaml | 10 +++----
 4 files changed, 35 insertions(+), 7 deletions(-)
 create mode 100644 .cspell.config.yml

diff --git a/.cspell.config.yml b/.cspell.config.yml
new file mode 100644
index 0000000..d8f11f9
--- /dev/null
+++ b/.cspell.config.yml
@@ -0,0 +1,28 @@
+version: "0.2"
+words:
+  - adafruit
+  - armhf
+  - bndy
+  - BUILDSWIGNODE
+  - CFLAGS
+  - cpack
+  - Doxyfile
+  - elif
+  - fqbn
+  - gnueabihf
+  - gnux
+  - libboost
+  - libclang
+  - libncurses
+  - mbed
+  - megaavr
+  - MQTT
+  - MRAA
+  - pigpio
+  - pipx
+  - pkgs
+  - samd
+  - Seeeduino
+  - setuptools
+  - SPIDEV
+  - zizmor
diff --git a/.github/workflows/build_arduino.yaml b/.github/workflows/build_arduino.yaml
index 4c68e36..035ac3c 100644
--- a/.github/workflows/build_arduino.yaml
+++ b/.github/workflows/build_arduino.yaml
@@ -30,7 +30,7 @@ on:
           - source-url: https://github.com/<owner>/<repo>.git
             version: <branch_name>
           ```
-          Otherwise, just the lib's name in the Arduino Lib Manager will suffic:
+          Otherwise, just the lib's name in the Arduino Lib Manager will suffice:
           ```yml
           - source-url: https://github.com/nRF24/RF24Network.git
             version: master
diff --git a/.github/workflows/build_platformio.yaml b/.github/workflows/build_platformio.yaml
index e0ee491..9e19dc7 100644
--- a/.github/workflows/build_platformio.yaml
+++ b/.github/workflows/build_platformio.yaml
@@ -15,7 +15,7 @@ on:
         description: |
           A space delimited string of lib names to install as extra dependencies.
           UPDATE: Each lib specified should be prefixed with a `-l ` like so: `-l <lib_spec>`.
-             This also allows for exra tools/frameworks/etc. See docs at
+             This also allows for extra tools/frameworks/etc. See docs at
              https://docs.platformio.org/en/latest/core/userguide/pkg/cmd_install.html
           NOTE: RF24 dependencies are automatically installed accordingly.
       rf24-ref:
diff --git a/.github/workflows/validate_deploy_platformio.yaml b/.github/workflows/validate_deploy_platformio.yaml
index 9ba9e64..db016f8 100644
--- a/.github/workflows/validate_deploy_platformio.yaml
+++ b/.github/workflows/validate_deploy_platformio.yaml
@@ -25,8 +25,10 @@ jobs:
 
       - name: get lib info
         id: lib-info
-        run: |-
-          echo "release=$(awk -F "=" '/version/ {print $2}' library.properties)" >> "${GITHUB_OUTPUT}"
+        run: >-
+          echo "release=$(awk
+          -F "=" '/version/ {print $2}'
+          library.properties)" >> "${GITHUB_OUTPUT}"
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -34,9 +36,7 @@ jobs:
           python-version: 3.x
 
       - name: Install PlatformIO
-        run: |-
-          python -m pip install --upgrade pip
-          pip install --upgrade platformio
+        run: pip install --upgrade platformio
 
       - name: package lib
         env:

From 1488599bfce25aa16bc0499de52f4db19a67ba7b Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Mon, 24 Nov 2025 18:36:57 -0800
Subject: [PATCH 5/9] separately deploy cpack artifacts

---
 .github/workflows/build_linux_cmake.yaml      | 26 ----------------
 .github/workflows/deploy_cpack_artifacts.yaml | 31 +++++++++++++++++++
 2 files changed, 31 insertions(+), 26 deletions(-)
 create mode 100644 .github/workflows/deploy_cpack_artifacts.yaml

diff --git a/.github/workflows/build_linux_cmake.yaml b/.github/workflows/build_linux_cmake.yaml
index b398d3b..e3f007d 100644
--- a/.github/workflows/build_linux_cmake.yaml
+++ b/.github/workflows/build_linux_cmake.yaml
@@ -18,9 +18,6 @@ on:
       examples-path:
         required: false
         type: string
-      deploy-release:
-        required: false
-        type: boolean
       py-wrapper-path:
         required: false
         type: string
@@ -313,26 +310,3 @@ jobs:
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
         working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/${{ inputs.py-wrapper-path }}
         run: python3 -m pip install .
-
-  upload-release-assets:
-    runs-on: ubuntu-latest
-    needs: [build]
-    if: inputs.deploy-release
-    permissions:
-      # allow uploading release assets
-      contents: write
-    steps:
-      - name: Download build artifacts
-        uses: actions/download-artifact@v5
-        with:
-          pattern: pkg_${{ github.event.repository.name }}_*
-          path: ./artifacts
-          merge-multiple: true
-
-      - name: Upload Release assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.ref_name }}          
-        run: |-
-          files=$(ls artifacts/*.deb artifacts/*.rpm)
-          gh release upload "${TAG}" ${files}
diff --git a/.github/workflows/deploy_cpack_artifacts.yaml b/.github/workflows/deploy_cpack_artifacts.yaml
new file mode 100644
index 0000000..76f694c
--- /dev/null
+++ b/.github/workflows/deploy_cpack_artifacts.yaml
@@ -0,0 +1,31 @@
+name: Upload release assets
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  upload-assets:
+    runs-on: ubuntu-latest
+    permissions:
+      # needed to upload release assets
+      contents: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v6
+        with:
+          # This pattern downloads any artifacts built for armhf or arm64 targets.
+          # However, it also downloads artifacts built against pigpio and MRAA drivers.
+          pattern: pkg_${{ github.event.repository.name }}_arm*
+          path: artifacts
+          merge-multiple: true
+
+      - name: Upload Release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        # Only upload artifacts that were built against RPi and SPIDEV drivers.
+        run: |-
+          files=$(ls artifacts/*RPi*.deb artifacts/*SPIDEV*.deb artifacts/*RPi*.rpm artifacts/*SPIDEV*.rpm)
+          gh release upload "${TAG}" ${files}

From d90b67b2b6e69dbe29d79eaace9545fd7c0afdf9 Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Mon, 24 Nov 2025 19:11:30 -0800
Subject: [PATCH 6/9] separately deploy PIO release asset

---
 .../workflows/deploy_platformio_artifact.yaml | 29 +++++++++++++++++++
 ...atformio.yaml => vaildate_platformio.yaml} | 25 ++++------------
 2 files changed, 34 insertions(+), 20 deletions(-)
 create mode 100644 .github/workflows/deploy_platformio_artifact.yaml
 rename .github/workflows/{validate_deploy_platformio.yaml => vaildate_platformio.yaml} (68%)

diff --git a/.github/workflows/deploy_platformio_artifact.yaml b/.github/workflows/deploy_platformio_artifact.yaml
new file mode 100644
index 0000000..4c44fb6
--- /dev/null
+++ b/.github/workflows/deploy_platformio_artifact.yaml
@@ -0,0 +1,29 @@
+name: Validate and deploy PlatformIO
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  deploy-platformio-asset:
+    runs-on: ubuntu-latest
+    permissions:
+      # needed to upload release assets
+      contents: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v6
+        with:
+          pattern: PlatformIO*.tar.gz
+          path: artifacts
+          merge-multiple: true
+
+      - name: Upload Release assets
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |- 
+          files=$(ls artifacts/PlatformIO*.tar.gz)
+          gh release upload "${TAG}" ${files}
diff --git a/.github/workflows/validate_deploy_platformio.yaml b/.github/workflows/vaildate_platformio.yaml
similarity index 68%
rename from .github/workflows/validate_deploy_platformio.yaml
rename to .github/workflows/vaildate_platformio.yaml
index db016f8..85439c6 100644
--- a/.github/workflows/validate_deploy_platformio.yaml
+++ b/.github/workflows/vaildate_platformio.yaml
@@ -1,11 +1,7 @@
-name: Validate and deploy PlatformIO
+name: Package PlatformIO
 
 on:
   workflow_call:
-    inputs:
-      deploy-release:
-        required: false
-        type: boolean
     secrets:
       PLATFORMIO_AUTH_TOKEN:
         required: false
@@ -13,11 +9,8 @@ on:
 permissions: {}
 
 jobs:
-  validate_lib_json:
+  package:
     runs-on: ubuntu-latest
-    permissions:
-      # needed to upload release assets
-      contents: write
     steps:
       - uses: actions/checkout@v6
         with:
@@ -49,18 +42,10 @@ jobs:
           name: PIO_pkg_${{ github.event.repository.name }}
           path: PlatformIO*.tar.gz
 
-      - name: Upload Release assets
-        if: inputs.deploy-release && startsWith(github.ref, 'refs/tags/')
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.ref_name }}
-        run: |- 
-          files=$(ls PlatformIO*.tar.gz)
-          gh release upload "${TAG}" ${files}
-
       - name: Upload package to PlatformIO Registry
-        if: inputs.deploy-release
-        # PIO lib packages cannot be re-published under the same tag
+        # This step does not require any special github.token permissions.
+        # PIO lib packages cannot be re-published under the same tag.
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           PLATFORMIO_AUTH_TOKEN: ${{ secrets.PLATFORMIO_AUTH_TOKEN }}
         run: pio package publish --owner nrf24 --non-interactive

From d52527701513dbd12eb63efd568f6f3bb690bfe2 Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Mon, 24 Nov 2025 19:24:45 -0800
Subject: [PATCH 7/9] separately deploy docs to gh-pages

---
 .github/workflows/build_docs.yaml  | 19 -------------------
 .github/workflows/deploy_docs.yaml | 21 +++++++++++++++++++++
 2 files changed, 21 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/deploy_docs.yaml

diff --git a/.github/workflows/build_docs.yaml b/.github/workflows/build_docs.yaml
index c874561..946e9f9 100644
--- a/.github/workflows/build_docs.yaml
+++ b/.github/workflows/build_docs.yaml
@@ -3,9 +3,6 @@ name: Build Docs
 on:
   workflow_call:
     inputs:
-      deploy-gh-pages:
-        required: false
-        type: boolean
       doxygen-version:
         required: false
         type: string
@@ -79,19 +76,3 @@ jobs:
         with:
           name: ${{ github.event.repository.name }}_doxygen_docs
           path: ${{ github.workspace }}/docs/html
-
-  deploy:
-    runs-on: ubuntu-latest
-    needs: [build]
-    if: inputs.deploy-gh-pages
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    permissions:
-      pages: write # to deploy to Pages
-      id-token: write # to verify the deployment originates from an appropriate source
-    steps:
-      - uses: actions/deploy-pages@v4
-        id: deployment
-        with:
-          artifact_name: ${{ github.event.repository.name }}_doxygen_docs
diff --git a/.github/workflows/deploy_docs.yaml b/.github/workflows/deploy_docs.yaml
new file mode 100644
index 0000000..9f48b2d
--- /dev/null
+++ b/.github/workflows/deploy_docs.yaml
@@ -0,0 +1,21 @@
+name: Deploy Docs
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write # to deploy to Pages
+      id-token: write # to verify the deployment originates from an appropriate source
+    steps:
+      - uses: actions/deploy-pages@v4
+        id: deployment
+        with:
+          artifact_name: ${{ github.event.repository.name }}_doxygen_docs

From a564bd4c6aee2eb34fb08ce40da923fea119c10f Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Wed, 26 Nov 2025 04:33:39 -0800
Subject: [PATCH 8/9] Another code review

---
 .github/workflows/build_docs.yaml        | 2 +-
 .github/workflows/build_linux_cmake.yaml | 2 +-
 .github/workflows/build_platformio.yaml  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build_docs.yaml b/.github/workflows/build_docs.yaml
index 946e9f9..0c75ed7 100644
--- a/.github/workflows/build_docs.yaml
+++ b/.github/workflows/build_docs.yaml
@@ -63,7 +63,7 @@ jobs:
         working-directory: docs
         env:
           LIB_VERSION: ${{ needs.get-info.outputs.lib-version }}
-        run: |
+        run: |-
           touch doxygenAction
           echo "PROJECT_NUMBER = ${LIB_VERSION}" >> doxygenAction
           echo -e "\n@INCLUDE = doxygenAction" >> Doxyfile
diff --git a/.github/workflows/build_linux_cmake.yaml b/.github/workflows/build_linux_cmake.yaml
index e3f007d..96c2f58 100644
--- a/.github/workflows/build_linux_cmake.yaml
+++ b/.github/workflows/build_linux_cmake.yaml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Provide toolchain (for armhf)
         if: ${{ inputs.compiler == 'armhf' }}
-        run: |
+        run: |-
           sudo apt-get update
           sudo apt-get install gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf
 
diff --git a/.github/workflows/build_platformio.yaml b/.github/workflows/build_platformio.yaml
index 9e19dc7..9b83040 100644
--- a/.github/workflows/build_platformio.yaml
+++ b/.github/workflows/build_platformio.yaml
@@ -47,7 +47,7 @@ jobs:
       - name: Cache pip
         uses: actions/cache@v4
         with:
-          path: |
+          path: |-
             ~/.cache/pip
             ~/.platformio/.cache
           key: ${{ runner.os }}-pio-${{ inputs.board-id }}-${{ inputs.example-path }}
@@ -61,7 +61,7 @@ jobs:
         id: lib-info
         env:
           REPO_NAME: ${{ github.event.repository.name }}
-        run: |
+        run: |-
           rf24_deps=''
           if [[ "${REPO_NAME}" == 'RF24Mesh' ]]; then
             rf24_deps=RF24Network

From 0af7d4ca44b16669815690ef7db8ced2adc30b8b Mon Sep 17 00:00:00 2001
From: Brendan <2bndy5@gmail.com>
Date: Thu, 27 Nov 2025 01:30:12 -0800
Subject: [PATCH 9/9] conform deployed artifacts' name

Makes sure the saved artifacts' names/paths match the names/paths of the artifacts being deployed (in separate workflows
---
 .github/workflows/deploy_platformio_artifact.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/deploy_platformio_artifact.yaml b/.github/workflows/deploy_platformio_artifact.yaml
index 4c44fb6..d247ec6 100644
--- a/.github/workflows/deploy_platformio_artifact.yaml
+++ b/.github/workflows/deploy_platformio_artifact.yaml
@@ -15,9 +15,8 @@ jobs:
       - name: Download artifacts
         uses: actions/download-artifact@v6
         with:
-          pattern: PlatformIO*.tar.gz
+          name: PIO_pkg_${{ github.event.repository.name }}
           path: artifacts
-          merge-multiple: true
 
       - name: Upload Release assets
         if: startsWith(github.ref, 'refs/tags/')