ec: Add EC test build to CI

[kurtjd]

This adds a job to build the ec test apps (ec-test-tui and ec-test-cli) for Windows on ARM.

It then uploads them as assets to the rolling latest pre-release (https://github.com/OpenDevicePartnership/odp-platform-common/releases/tag/latest) for consumption by downstream users (specifically, so the platform-qemu repo can automatically pull them and package them into an OS build in this job: https://github.com/OpenDevicePartnership/odp-platform-qemu-arm-virt/blob/main/.github/workflows/build-os.yml).

This follows the same idea of how odp-windows-drivers packages drivers for consumption by platform repos (see: https://github.com/OpenDevicePartnership/odp-windows-drivers/blob/cfa32e262d7c03cf5d03d07e5e1ae0f1ea97747b/.github/workflows/build_drivers.yml#L98)

Note: We don't package and build the KMDF driver needed for acpi/local source since the goal is to move that over to the drivers repo (see: OpenDevicePartnership/odp-windows-drivers#5).

Related: OpenDevicePartnership/odp-platform-qemu-arm-virt#118

[Copilot]

Pull request overview

Adds a dedicated GitHub Actions workflow to build Windows-on-ARM64 EC test deliverables and (on main/manual runs) publish them as rolling assets on the latest pre-release for downstream consumption.

Changes:

• Introduces a new Build EC Test workflow triggered on ec/** changes (and manual dispatch).
• Builds ARM64 Rust apps (ec-test-cli, ec-test-tui) and uploads a zipped bundle to the latest GitHub Release.
• Builds the ARM64 KMDF driver (ectest.sys plus .inf/.cat) and uploads the packaged driver zip to the same release.

Suppressed comments (1)

.github/workflows/build_ec_test.yml:93

• This job requests contents: write even on pull_request runs, but the release upload step is gated to push/workflow_dispatch. Consider keeping the build job read-only and moving the upload logic into a separate job that is conditioned to publishing events and granted contents: write.

  build-driver:
    name: Build Driver (ARM64)
    runs-on: windows-2022
    permissions:
      contents: write
    steps:

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/build_ec_test.yml:40

• Both jobs request contents: write for the entire job even though only the release-upload step needs it. On pull_request runs, the workflow checks out and builds untrusted PR code; granting write-scoped GITHUB_TOKEN to the whole job increases blast radius (a build script could use the token even though the explicit upload step is skipped).

Consider splitting publishing into a separate publish job that runs only on push to main / workflow_dispatch (and is the only job with contents: write). The build jobs can keep contents: read and upload their zips as workflow artifacts, which the publish job then downloads and uploads to the release.

    permissions:
      contents: write
    steps:

.github/workflows/build_ec_test.yml:65

• Publishing directly from each build job means latest can end up partially updated if one job succeeds and the other fails (or is retried), leaving downstream consumers with mismatched app/driver versions.

A more reliable pattern is: (1) both build jobs produce artifacts, (2) a single publish job with needs: [build-apps, build-driver] uploads both assets to the release only after both builds succeed.

      - name: Package and upload apps
        if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch'
        shell: pwsh

.github/workflows/build_ec_test.yml:32

• cancel-in-progress: true grouped by github.ref means pushes to main will cancel an in-flight publish run. Because the apps and driver upload in separate jobs, cancellation/failure can leave the latest release with only one asset updated (apps from a newer commit, driver from an older commit) until the next successful run.

Aligning concurrency with the existing check.yml pattern avoids canceling main runs while still canceling superseded PR builds.

This issue also appears on line 63 of the same file.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/build_ec_test.yml:55

• The PR description says this workflow also builds and publishes the ectest.sys driver needed for the local/ACPI source, but this workflow only builds and uploads the Rust apps (ec-test-cli / ec-test-tui). Either add steps to build/package/upload ectest.sys as part of this job, or update the PR description to match what’s actually being shipped.

      - name: Build test apps
        working-directory: ec
        run: cargo build --release --locked --target aarch64-pc-windows-msvc -p ec-test-cli -p ec-test-tui