ci: align hardware dependency for development checks

.github/workflows/build.yml

@@ -10,7 +10,7 @@ on:
       hardware_tag:
         description: Hardware version to pair with this CLI
         required: true
-        default: v0.1.10
+        default: v0.1.11
       hardware_run_id:
         description: Optional hardware workflow run providing the tested wheel before its first release
         required: false
@@ -24,16 +24,31 @@ jobs:
   package:
     runs-on: ubuntu-24.04
     env:
-      HARDWARE_TAG: ${{ inputs.hardware_tag || 'v0.1.10' }}
+      HARDWARE_TAG: ${{ inputs.hardware_tag || 'v0.1.11' }}
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
+      # Hardware 0.1.11 is required by the CLI but has not been released yet.
+      # Development checks use a fixed upstream revision until it is published.
+      - name: Check out pinned hardware source for development checks
+        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_type == 'branch')
+        uses: actions/checkout@v4
+        with:
+          repository: OrchardLinux/hardware
+          ref: ae1457edee7d2e52213e4d979aee02dbbeb90ce0
+          path: out/hardware-source
+          persist-credentials: false
+      - name: Build the pinned hardware wheel for development checks
+        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_type == 'branch')
+        run: |
+          python -m pip install build
+          python -m build --wheel --outdir "$PWD/out/hardware" out/hardware-source
       - name: Download pinned released hardware dependency
-        if: inputs.hardware_run_id == ''
+        if: github.event_name != 'pull_request' && (github.event_name != 'push' || github.ref_type != 'branch') && inputs.hardware_run_id == ''
         env:
           GH_TOKEN: ${{ github.token }}
         run: |

docs/releases.md

@@ -4,7 +4,7 @@ The bootstrap installs `releases/latest/download/requirements.txt`. This file se
 
 ## GitHub Actions
 
-`.github/workflows/build.yml` tests on Python 3.9 and 3.12 for pull requests and `main`. It downloads a published hardware wheel and verifies its release checksums; no sibling source checkout is used. The default hardware tag is explicit in the workflow and must be updated with the package dependency when selecting a new pair. Manual dispatch also lets you choose a hardware tag.
+`.github/workflows/build.yml` tests on Python 3.9 and 3.12 for pull requests and `main`. Until hardware 0.1.11 is published, those development checks build its wheel from a pinned hardware source revision. That source wheel does not include the prebuilt loaders in a published hardware wheel. Tag and manual builds use a published hardware wheel with verified release checksums, or an explicitly selected hardware workflow artifact. They default to hardware v0.1.11, which must be published before a release build can use it. Manual dispatch also lets you choose a hardware tag.
 
 A version tag matching `pyproject.toml` creates a **draft** release containing the wheel, sdist, hashed `requirements.txt` and `SHA256SUMS`. Manual builds only retain workflow artifacts for seven days. The hardware release must be published first; cross-repository drafts are not public dependency URLs. Nothing publishes automatically or operates a device.
 

tests/test_manifests.py

@@ -29,7 +29,8 @@ def rejects(self, document):
     def test_all_fixtures_validate_with_local_receipts(self):
         paths = list(DISTRO.glob('*.toml')) + list(MINIMAL.glob('*.toml'))
         paths += list((CLI / 'tests/fixtures/developer').glob('*.toml'))
-        paths += [device_path('j71b')]
+        # An installed package may be reached through a virtualenv lib64 link.
+        paths += [device_path('j71b').resolve()]
         for path in paths:
             with self.subTest(path=path):
                 verify_local_receipts(load(path), path.parent)

tests/test_package_boundaries.py

@@ -11,7 +11,7 @@
 from unittest.mock import Mock, patch
 
 from orchard_cli import firmware
-from orchard_cli.apple import usb, ipsw
+from orchard_cli.apple import usb
 from orchard_cli.progress import Clock
 from orchard_cli.state import DeviceState
 
@@ -35,11 +35,11 @@ def find_spec(self, name, path=None, target=None):
 sys.meta_path.insert(0, NoBoard())
 from orchard_cli import downloads, firmware, http, integrity
 from orchard_cli.transports import ssh
-from orchard_cli.apple import adt_tree, adt_capture, macho, osserialize, ipsw, usb, boot
+from orchard_cli.apple import adt_tree, adt_capture, macho, osserialize, remote_ipsw, udif, apfs, lzfse, usb, boot
 from orchard_hardware.apple import adt
 from orchard_cli.command import main
 sys.argv=['orchard','distros'];main()
-sys.argv=['orchard','resolve',MANIFEST];main()
+sys.argv=['orchard','resolve',MANIFEST,'--profile','j71b'];main()
 '''.replace('MANIFEST', repr(str(FIXTURE.resolve())))
         with tempfile.TemporaryDirectory() as store:
             result = subprocess.run([sys.executable, '-I', '-c', script], cwd=store,

tests/test_runtime.py

@@ -308,7 +308,7 @@ def guard(event, args):
 
 sys.addaudithook(guard)
 from orchard_cli.command import main
-sys.argv = ['orchard', 'resolve', INPUT]
+sys.argv = ['orchard', 'resolve', INPUT, '--profile', 'j71b']
 main()
 '''.replace('BLOCKED', repr([str(path) for path in blocked])).replace('INPUT', repr(str(inputs / 'index.toml')))
         env = {**os.environ, 'ORCHARD_HOME': str(self.root / 'isolated-store'), 'PYTHONDONTWRITEBYTECODE': '1'}