refactor(ota): split OTA into Manager, Client, and FirmwareCDN

.changeset/clever-foxes-build.md

@@ -0,0 +1,9 @@
+---
+'firmware': patch
+---
+
+refactor: Split OTA update system into Manager, Client, and FirmwareCDN modules
+
+- **OtaUpdateManager**: Watcher task with WiFi event handling, periodic update checks, and firmware lifecycle management (boot type, validation, rollback)
+- **OtaUpdateClient**: Single-shot update execution — fetches release metadata, flashes filesystem and app partitions, reboots into new firmware
+- **FirmwareCDN**: HTTP client for the firmware CDN — version checks, board listings, binary hash fetching, and release info assembly

.env

@@ -1,5 +1,5 @@
 OPENSHOCK_API_DOMAIN=api.openshock.app
-OPENSHOCK_FW_CDN_DOMAIN=firmware.openshock.org
+OPENSHOCK_REPO_DOMAIN=repo.openshock.org
 OPENSHOCK_FW_HOSTNAME=OpenShock
 OPENSHOCK_FW_AP_PREFIX=OpenShock-
 OPENSHOCK_URI_BUFFER_SIZE=256

.github/actions/repo-publish-version/action.yml

@@ -0,0 +1,63 @@
+name: repo-publish-version
+description: Publishes firmware version metadata to the repository server
+inputs:
+  repo-server-url:
+    description: Repository server base URL
+    required: true
+  repo-admin-token:
+    description: Admin authentication token
+    required: true
+  fw-version:
+    description: Firmware semantic version
+    required: true
+  release-channel:
+    description: Release channel (stable, beta, develop)
+    required: true
+  commit-hash:
+    description: Git commit hash
+    required: true
+  release-url:
+    description: GitHub release URL (optional)
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Publish version metadata to repository server
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        REPO_URL="${{ inputs.repo-server-url }}"
+        VERSION="${{ inputs.fw-version }}"
+        RELEASE_URL="${{ inputs.release-url }}"
+
+        REQUEST_BODY=$(jq -n \
+          --arg channel "${{ inputs.release-channel }}" \
+          --arg commitHash "${{ inputs.commit-hash }}" \
+          --arg releaseUrl "$RELEASE_URL" \
+          '{
+            "channel": $channel,
+            "releaseDate": (now | strftime("%Y-%m-%dT%H:%M:%SZ")),
+            "commitHash": $commitHash,
+            "releaseUrl": (if $releaseUrl == "" then null else $releaseUrl end),
+            "releaseNotes": []
+          }')
+
+        echo "Publishing version $VERSION to repository server..."
+
+        HTTP_CODE=$(curl -s -o /tmp/repo-response.txt -w "%{http_code}" \
+          -X PUT \
+          -H "Content-Type: application/json" \
+          -H "Authorization: ${{ inputs.repo-admin-token }}" \
+          -d "$REQUEST_BODY" \
+          "${REPO_URL}/v2/firmware/admin/versions/${VERSION}")
+
+        if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+          echo "Successfully published version $VERSION (HTTP $HTTP_CODE)"
+        else
+          echo "Failed to publish version $VERSION (HTTP $HTTP_CODE)"
+          cat /tmp/repo-response.txt
+          exit 1
+        fi

.github/actions/repo-upload-board/action.yml

@@ -0,0 +1,75 @@
+name: repo-upload-board
+description: Uploads firmware binaries for a single board to the repository server
+inputs:
+  repo-server-url:
+    description: Repository server base URL
+    required: true
+  repo-admin-token:
+    description: Admin authentication token
+    required: true
+  fw-version:
+    description: Firmware semantic version
+    required: true
+  board:
+    description: Board name
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download static filesystem partition
+      uses: actions/download-artifact@v4
+      with:
+        name: firmware_staticfs
+        path: upload_staging
+
+    - name: Download firmware build
+      uses: actions/download-artifact@v4
+      with:
+        name: firmware_build_${{ inputs.board }}
+        path: upload_staging
+
+    - name: Download merged firmware binary
+      uses: actions/download-artifact@v4
+      with:
+        name: firmware_merged_${{ inputs.board }}
+        path: upload_staging
+
+    - name: Rename merged binary
+      shell: bash
+      run: |
+        cd upload_staging
+        if ls OpenShock_*.bin 1>/dev/null 2>&1; then
+          mv OpenShock_*.bin firmware.bin
+        fi
+
+    - name: Upload artifacts to repository server
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        REPO_URL="${{ inputs.repo-server-url }}"
+        CURL_ARGS=(-s -w "\n%{http_code}" \
+          -X PUT \
+          -H "Authorization: ${{ inputs.repo-admin-token }}" \
+          "${REPO_URL}/v2/firmware/admin/versions/${{ inputs.fw-version }}/boards/${{ inputs.board }}/upload")
+
+        # Add file fields based on what exists
+        [ -f upload_staging/app.bin ] && CURL_ARGS+=(-F "app=@upload_staging/app.bin")
+        [ -f upload_staging/staticfs.bin ] && CURL_ARGS+=(-F "staticfs=@upload_staging/staticfs.bin")
+        [ -f upload_staging/firmware.bin ] && CURL_ARGS+=(-F "merged=@upload_staging/firmware.bin")
+        [ -f upload_staging/bootloader.bin ] && CURL_ARGS+=(-F "bootloader=@upload_staging/bootloader.bin")
+        [ -f upload_staging/partitions.bin ] && CURL_ARGS+=(-F "partitions=@upload_staging/partitions.bin")
+
+        RESPONSE=$(curl "${CURL_ARGS[@]}")
+        HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+        BODY=$(echo "$RESPONSE" | sed '$d')
+
+        if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+          echo "Successfully uploaded artifacts for board ${{ inputs.board }} (HTTP $HTTP_CODE)"
+          echo "$BODY" | jq . 2>/dev/null || echo "$BODY"
+        else
+          echo "Failed to upload artifacts for board ${{ inputs.board }} (HTTP $HTTP_CODE)"
+          echo "$BODY"
+          exit 1
+        fi