ci: clone coldcard repo only once

Co-authored-by: GPT-5 (Preview) <gpt5@example.com>

Author: Sjors

.github/workflows/ci.yml

@@ -118,11 +118,14 @@ jobs:
       # Trezor T binaries don't need this.
       runs-on: ubuntu-22.04
 
+  coldcard-firmware-seed:
+    uses: ./.github/workflows/coldcard-firmware-seed.yml
+
+  # Use the coldcard-specialized builder (downloads the seeded artifact)
   sim-builder-coldcard:
-    needs: prepare-sim-matrices
-    uses: ./.github/workflows/sim-builder.yml
+    needs: [prepare-sim-matrices, coldcard-firmware-seed]
+    uses: ./.github/workflows/sim-builder-coldcard.yml
     with:
-      sim: coldcard
       include: ${{ needs.prepare-sim-matrices.outputs.coldcard }}
       runs-on: ubuntu-22.04
 

.github/workflows/coldcard-firmware-seed.yml

@@ -0,0 +1,33 @@
+name: Coldcard Firmware Seed
+on:
+  workflow_call:
+
+jobs:
+  seed:
+    name: Seed Coldcard firmware (once per run)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Clone Coldcard firmware (with submodules)
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p test/work
+          git clone --recursive https://github.com/Coldcard/firmware.git test/work/firmware
+          git -C test/work/firmware submodule sync --recursive
+          git -C test/work/firmware -c protocol.version=2 submodule update --init --recursive --jobs 8
+
+      - name: Apply HWI patch
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config --global user.email "ci@ci.com"
+          git config --global user.name "ci"
+          git -C test/work/firmware am ../../data/coldcard-multisig.patch
+
+      - name: Upload seeded repo as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: coldcard-firmware-src
+          path: test/work/firmware

.github/workflows/sim-builder-coldcard.yml

@@ -0,0 +1,30 @@
+name: Coldcard Simulator Builder
+on:
+  workflow_call:
+    inputs:
+      include:
+        required: true
+        type: string
+      runs-on:
+        required: false
+        type: string
+        default: ubuntu-22.04
+
+jobs:
+  build-simulator:
+    name: coldcard sim builder
+    runs-on: ${{ inputs.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(inputs.include) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download seeded Coldcard firmware
+        uses: actions/download-artifact@v4
+        with:
+          name: coldcard-firmware-src
+          path: test/work/firmware
+
+      - uses: ./.github/actions/build-sim

test/setup_environment.sh

@@ -149,14 +149,15 @@ if [[ -n ${build_coldcard} ]]; then
             coldcard_setup_needed=true
         fi
     fi
-    # Apply patch to make simulator work in linux environments
-    git am ../../data/coldcard-multisig.patch
 
     # Build the simulator. This is cached, but it is also fast
     poetry run pip install -r requirements.txt
     pip install -r requirements.txt
     cd unix
     if [ "$coldcard_setup_needed" == true ] ; then
+        # Apply patch to make simulator work in linux environments
+        git am ../../../data/coldcard-multisig.patch
+
         pushd ../external/micropython/mpy-cross/
         make
         popd