fix(ci): Fix CodeQL warnings

Author: lucasssvaz

.github/workflows/tests_hw_wokwi.yml

@@ -302,7 +302,7 @@ jobs:
 
       - name: Trigger GitLab Pipeline and Download Artifacts
         if: ${{ steps.check-tests.outputs.enabled == 'true' }}
-        uses: digital-blueprint/gitlab-pipeline-trigger-action@v1.3.0
+        uses: digital-blueprint/gitlab-pipeline-trigger-action@20e77989b24af658ba138a0aa5291bdc657f1505 # v1.3.0
         id: gitlab-trigger
         with:
           host: ${{ secrets.GITLAB_URL }}

.github/workflows/tests_results.yml

@@ -141,12 +141,16 @@ jobs:
       - name: Clean up caches
         if: always()
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          ORIGINAL_REF: ${{ needs.get-artifacts.outputs.original_ref }}
+          ORIGINAL_EVENT: ${{ needs.get-artifacts.outputs.original_event }}
+          ORIGINAL_ACTION: ${{ needs.get-artifacts.outputs.original_action }}
         with:
           script: |
-            const ref = '${{ needs.get-artifacts.outputs.original_ref }}';
+            const ref = process.env.ORIGINAL_REF;
             const key_prefix = 'test-' + ref + '-';
 
-            if ('${{ needs.get-artifacts.outputs.original_event }}' == 'pull_request' && '${{ needs.get-artifacts.outputs.original_action }}' != 'closed') {
+            if (process.env.ORIGINAL_EVENT == 'pull_request' && process.env.ORIGINAL_ACTION != 'closed') {
               console.log('Skipping cache cleanup for open PR');
               return;
             }
@@ -172,16 +176,19 @@ jobs:
       - name: Report conclusion
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         if: always()
+        env:
+          ORIGINAL_EVENT: ${{ needs.get-artifacts.outputs.original_event }}
+          ORIGINAL_SHA: ${{ needs.get-artifacts.outputs.original_sha }}
         with:
           script: |
             const owner = '${{ github.repository_owner }}';
             const repo = '${{ github.repository }}'.split('/')[1];
-            const sha = '${{ needs.get-artifacts.outputs.original_sha }}';
+            const sha = process.env.ORIGINAL_SHA;
             core.debug(`owner: ${owner}`);
             core.debug(`repo: ${repo}`);
             core.debug(`sha: ${sha}`);
             const { context: name, state } = (await github.rest.repos.createCommitStatus({
-              context: `Runtime Tests / Report results (${{ needs.get-artifacts.outputs.original_event }} -> workflow_run -> workflow_run)`,
+              context: `Runtime Tests / Report results (${process.env.ORIGINAL_EVENT} -> workflow_run -> workflow_run)`,
               owner: owner,
               repo: repo,
               sha: sha,

.gitlab/scripts/gen_hw_jobs.py

@@ -5,20 +5,21 @@
 import yaml
 import os
 import sys
-from pathlib import Path
 import copy
+import traceback
+from pathlib import Path
 
-# Resolve repository root from this script location: .gitlab/scripts -> esp32 root
+# Resolve repository root from this script location
 SCRIPT_DIR = Path(__file__).resolve().parent
 REPO_ROOT = SCRIPT_DIR.parent.parent
+TESTS_ROOT = REPO_ROOT / "tests"
 
 # Ensure we run from repo root so relative paths work consistently
 try:
     os.chdir(REPO_ROOT)
-except Exception:
-    pass
-
-TESTS_ROOT = REPO_ROOT / "tests"
+except Exception as e:
+    sys.stderr.write(f"[WARN] Failed to chdir to repo root '{REPO_ROOT}': {e}\n")
+    sys.stderr.write(traceback.format_exc() + "\n")
 
 
 class PrettyDumper(yaml.SafeDumper):
@@ -35,7 +36,9 @@ def read_json(p: Path):
     try:
         with p.open("r", encoding="utf-8") as f:
             return json.load(f)
-    except Exception:
+    except Exception as e:
+        sys.stderr.write(f"[WARN] Failed to parse JSON file '{p}': {e}\n")
+        sys.stderr.write(traceback.format_exc() + "\n")
         return {}
 
 
@@ -155,7 +158,9 @@ def sdk_meets_requirements(sdkconfig: Path, ci_json: dict) -> bool:
             if not ok:
                 return False
         return True
-    except Exception:
+    except Exception as e:
+        sys.stderr.write(f"[WARN] Failed to evaluate requirements against '{sdkconfig}': {e}\n")
+        sys.stderr.write(traceback.format_exc() + "\n")
         return False
 
 
@@ -166,13 +171,13 @@ def parse_list_arg(s: str) -> list[str]:
     if txt.startswith("[") and txt.endswith("]"):
         try:
             return [str(x).strip() for x in json.loads(txt)]
-        except Exception:
-            # Attempt single-quote JSON -> replace with double quotes
+        except Exception as e:
+            sys.stderr.write(f"[WARN] Failed to parse JSON list '{txt}': {e}. Retrying with quote normalization.\n")
             try:
                 fixed = txt.replace("'", '"')
                 return [str(x).strip() for x in json.loads(fixed)]
-            except Exception:
-                pass
+            except Exception as e2:
+                sys.stderr.write(f"[WARN] Failed to parse JSON list after normalization: {e2}. Falling back to CSV parsing.\n")
     # Fallback: comma-separated
     return [part.strip() for part in txt.split(",") if part.strip()]