Add QMP6988 telemetry sensor type

.coderabbit.yaml

@@ -0,0 +1,15 @@
+language: en-US
+reviews:
+  profile: chill
+  high_level_summary: true
+  poem: false
+  auto_review:
+    enabled: true
+    drafts: false
+    skip_author:
+      - renovate
+      - renovate[bot]
+  abort_on_close: true
+
+  path_filters:
+    - "!/packages/**"

.github/workflows/create_tag.yml

@@ -1,7 +1,8 @@
 name: Create tag
 
+# Least privilege: default read-only, each job grants only what it needs.
 permissions:
-  contents: write
+  contents: read
 
 on:
   workflow_dispatch:
@@ -18,10 +19,14 @@ on:
 jobs:
   increment_version:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the release + tag
+    outputs:
+      new_version: ${{ steps.version.outputs.NEW_VERSION }}
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - id: version
@@ -57,16 +62,32 @@ jobs:
           generateReleaseNotes: true
           token: ${{ github.token }}
 
-      - name: Setup Buf
-        uses: bufbuild/buf-action@v1.2.0
-        with:
-          version: 1.71.0 # renovate: datasource=github-releases depName=bufbuild/buf
-          github_token: ${{ github.token }}
-          token: ${{ secrets.BUF_TOKEN }}
-          setup_only: true
+      # The Buf schema-registry push previously lived here. It now runs in
+      # publish.yml's push-buf-registry job (invoked below), so keeping it
+      # here too would push the same tag to Buf twice per release.
 
-      - name: Push to schema registry
-        env:
-          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
-        run: |
-          buf push --tag ${{ steps.version.outputs.NEW_VERSION }}
+  # The tag above is created with GITHUB_TOKEN, which by design does NOT fire
+  # the `push: tags` trigger on the publish workflows (GitHub's recursion
+  # guard). Before this, publishing depended on someone manually dispatching
+  # each publish workflow — and when that was missed, an artifact silently
+  # lagged its tag (org.meshtastic:protobufs sat at 2.7.25 while v2.7.26 was
+  # tagged). Invoke the publishers directly instead so every tag publishes
+  # every package. publish.yml also owns the Buf schema-registry push.
+  publish-npm:
+    needs: increment_version
+    permissions:
+      contents: write # create-release + upload assets
+      id-token: write # JSR OIDC / npm provenance
+    uses: ./.github/workflows/publish.yml
+    with:
+      version: ${{ needs.increment_version.outputs.new_version }}
+    secrets: inherit
+
+  publish-kmp:
+    needs: increment_version
+    permissions:
+      contents: read
+    uses: ./.github/workflows/publish-kmp.yml
+    with:
+      version: ${{ needs.increment_version.outputs.new_version }}
+    secrets: inherit

.github/workflows/kmp-pull-request.yml

@@ -10,24 +10,37 @@ on:
 permissions:
   contents: read
 
+env:
+  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
+  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
+  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
+
 jobs:
   build-kmp:
     runs-on: macos-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: "21"
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Cache Konan (Kotlin/Native toolchain)
+        uses: actions/cache@v6
+        with:
+          path: ~/.konan
+          key: konan-${{ runner.os }}-${{ hashFiles('packages/kmp/build.gradle.kts', 'packages/kmp/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            konan-${{ runner.os }}-
 
       - name: Build KMP package
         run: packages/kmp/gradlew --no-daemon -p packages/kmp build -PVERSION_NAME=0.0.0-pr

.github/workflows/publish-kmp.yml

@@ -15,10 +15,29 @@ on:
         required: false
         type: boolean
         default: false
+  # Called by create_tag.yml right after a release tag is cut. Tags created
+  # with GITHUB_TOKEN do not fire the `push: tags` trigger above (GitHub's
+  # recursion guard), so the release flow invokes this workflow directly.
+  workflow_call:
+    inputs:
+      version:
+        description: "Version to publish (e.g. v1.2.3)."
+        required: true
+        type: string
+      dry_run:
+        description: "Dry run mode - build and publish to Maven Local only"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
 
+env:
+  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
+  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
+  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
+
 jobs:
   build-kmp:
     runs-on: macos-latest
@@ -27,7 +46,7 @@ jobs:
       tag: ${{ steps.version.outputs.TAG }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -48,16 +67,24 @@ jobs:
           echo "TAG=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: "21"
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Cache Konan (Kotlin/Native toolchain)
+        uses: actions/cache@v6
+        with:
+          path: ~/.konan
+          key: konan-${{ runner.os }}-${{ hashFiles('packages/kmp/build.gradle.kts', 'packages/kmp/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            konan-${{ runner.os }}-
 
       - name: Build KMP package
         run: packages/kmp/gradlew --no-daemon -p packages/kmp clean build -PVERSION_NAME=${{ steps.version.outputs.VERSION }}
@@ -71,21 +98,29 @@ jobs:
     if: ${{ !inputs.dry_run }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: "21"
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Cache Konan (Kotlin/Native toolchain)
+        uses: actions/cache@v6
+        with:
+          path: ~/.konan
+          key: konan-${{ runner.os }}-${{ hashFiles('packages/kmp/build.gradle.kts', 'packages/kmp/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            konan-${{ runner.os }}-
 
       - name: Publish to Maven Central
         env:

.github/workflows/publish.yml

@@ -15,6 +15,20 @@ on:
         required: false
         type: boolean
         default: false
+  # Called by create_tag.yml right after a release tag is cut. Tags created
+  # with GITHUB_TOKEN do not fire the `push: tags` trigger above (GitHub's
+  # recursion guard), so the release flow invokes this workflow directly.
+  workflow_call:
+    inputs:
+      version:
+        description: "Version to publish (e.g. v1.2.3)."
+        required: true
+        type: string
+      dry_run:
+        description: "Dry run mode - generate artifacts without publishing"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: write
@@ -28,7 +42,7 @@ jobs:
       tag: ${{ steps.version.outputs.TAG }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -88,7 +102,7 @@ jobs:
         run: cp LICENSE README.md packages/ts/
 
       - name: Upload TypeScript code
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ts_code
           path: packages/ts
@@ -98,7 +112,7 @@ jobs:
     needs: codegen
     steps:
       - name: Download TypeScript code
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ts_code
 
@@ -111,7 +125,7 @@ jobs:
           echo "=== lib/ contents ==="
           ls -la lib/ || echo "lib folder not found"
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
 
@@ -127,7 +141,7 @@ jobs:
           ls -la
           ls -la dist/
       - name: Upload built NPM package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: npm_package
           path: |
@@ -136,7 +150,7 @@ jobs:
             LICENSE
             README.md
       - name: Upload JSR package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: jsr_package
           path: |
@@ -150,13 +164,13 @@ jobs:
     needs: [codegen, build-typescript]
     steps:
       - name: Download NPM package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: npm_package
           path: npm_package
 
       - name: Download JSR package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: jsr_package
           path: jsr_package
@@ -166,7 +180,7 @@ jobs:
           cd npm_package && zip -r ../meshtastic-protobufs-npm.zip . && cd ..
           cd jsr_package && zip -r ../meshtastic-protobufs-jsr.zip . && cd ..
       - name: Upload release zips
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release_zips
           path: |
@@ -178,12 +192,12 @@ jobs:
     if: ${{ !inputs.dry_run }}
     steps:
       - name: Download release zips
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: release_zips
 
       - name: Upload assets to GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ needs.codegen.outputs.tag }}
           files: |
@@ -195,7 +209,7 @@ jobs:
     if: ${{ !inputs.dry_run }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Buf
         uses: bufbuild/buf-setup-action@v1.50.0
@@ -213,12 +227,12 @@ jobs:
     if: ${{ !inputs.dry_run }}
     steps:
       - name: Download NPM package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: npm_package
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -237,12 +251,12 @@ jobs:
       id-token: write
     steps:
       - name: Download JSR package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: jsr_package
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
 

.github/workflows/pull_request.yml

@@ -11,12 +11,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Buf PR Checks
-        uses: bufbuild/buf-action@v1.2.0
+        uses: bufbuild/buf-action@v1.4.0
         with:
-          version: 1.71.0 # renovate: datasource=github-releases depName=bufbuild/buf
+          version: 1.72.0 # renovate: datasource=github-releases depName=bufbuild/buf
           github_token: ${{ github.token }}
           token: ${{ secrets.BUF_TOKEN }}
           format: true