ci: narrow tardigrade workflow into mainline canary

Author: neilberkman

.github/workflows/tardigrade.yaml

@@ -1,17 +1,36 @@
-name: tardigrade
+name: OTA resilience canary
 
 on:
-  pull_request:
   push:
-    branches: [main]
+    branches:
+      - main
+    paths:
+      - .github/workflows/tardigrade.yaml
+      - boot/**
+      - scripts/**
+      - zephyr/**
+      - root-rsa-2048.pem
+  schedule:
+    - cron: '0 8 * * 1'
   workflow_dispatch:
+    inputs:
+      zephyr_ref:
+        description: 'Which Zephyr ref should be used?'
+        required: true
+        default: 'main'
+
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  ZEPHYR_VERSION: main
+
 jobs:
-  swap-move:
+  swap-move-canary:
     runs-on: ubuntu-24.04
     container:
       image: zephyrprojectrtos/ci-base:v0.28.4
@@ -22,11 +41,16 @@ jobs:
         shell: bash
 
     steps:
+      - name: Set Zephyr version for manual runs
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "ZEPHYR_VERSION=${{ github.event.inputs.zephyr_ref }}" >> $GITHUB_ENV
+
       - name: Checkout Zephyr
         uses: actions/checkout@v4
         with:
           repository: zephyrproject-rtos/zephyr
-          ref: main
+          ref: ${{ env.ZEPHYR_VERSION }}
           path: repos/zephyr
 
       - name: Install Zephyr Python requirements
@@ -42,7 +66,7 @@ jobs:
           west-project-filter: -.*,+cmsis,+cmsis_6,+hal_nordic,+mbedtls,+mcuboot,+tinycrypt,+zcbor
           ccache-max-size: 256MB
 
-      - name: Checkout MCUboot (PR HEAD)
+      - name: Checkout MCUboot
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
@@ -91,7 +115,7 @@ jobs:
 
           ls -la slot0.bin slot1.bin
 
-      - name: Write tardigrade profile
+      - name: Write canary profile
         working-directory: repos
         run: |
           BOOT_ELF="$(realpath build_boot/zephyr/zephyr.elf)"
@@ -100,11 +124,11 @@ jobs:
 
           cat > tardigrade_profile.yaml << YAML
           schema_version: 1
-          name: mcuboot_swap_move_ci
+          name: mcuboot_swap_move_canary
           description: >
-            MCUboot swap-using-move on nrf52840dk, built from PR HEAD.
-            Upgrade scenario: slot0 has confirmed v1, slot1 has pending v2.
-            After swap, exec slot should contain the v2 image.
+            Post-merge OTA resilience canary for MCUboot swap-using-move on
+            nrf52840dk. Upgrade scenario: slot0 has confirmed v1, slot1 has
+            pending v2. After swap, exec slot should contain the v2 image.
 
           platform: platforms/cortex_m4_flash_fast.repl
           bootloader:
@@ -139,9 +163,9 @@ jobs:
           sed -i 's/^          //' tardigrade_profile.yaml
           cat tardigrade_profile.yaml
 
-      - name: Run tardigrade fault injection
+      - name: Run OTA resilience sweep
         id: tardigrade
-        uses: neilberkman/tardigrade@v1
+        uses: neilberkman/tardigrade@052e70add7c987f667cf4de9ea22e54d7ac7bddf
         with:
           profile: repos/tardigrade_profile.yaml
           quick: "false"
@@ -151,7 +175,8 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: tardigrade-swap-move
+          name: ota-resilience-swap-move
+          if-no-files-found: ignore
           path: |
             repos/tardigrade_profile.yaml
             ${{ steps.tardigrade.outputs.report-path }}