ci(core): fix Docker build errors on CI

[romanz]

Also, collect secmon fingerprint.

[github-actions]

en main(all)

model	device_test	click_test	persistence_test
T2T1	test(all) main(all)	test(all) main(all)	test(all) main(all)
T3B1	test(all) main(all)	test(all) main(all)	test(all) main(all)
T3T1	test(all) main(all)	test(all) main(all)	test(all) main(all)
T3W1	test(all) main(all)	test(all) main(all)	test(all) main(all)

Latest CI run: 19765302574

[mmilata]

Suspicious that it always fails for T3*1 models. Is this becuase we're building secmon? Got any clues at which particular point does this happen?

[mmilata]

du -sh core/build

• T2T1 1G
• T2B1 1G
• T3B1 1.2G
• T3W1 1.5G

[romanz]

IIUC, since we build all the targets inside one docker run command, the storage is not being reclaimed until the docker run finishes.

[romanz]

Suspicious that it always fails for T3*1 models. Is this becuase we're building secmon?

IIUC, we build secmon only for T3W1 and D002:

trezor-firmware/core/SConscript.secmon

Lines 240 to 247 in 9d4223c

	if TREZOR_MODEL not in ['T3W1', 'D002']:
	# Skipping build and creating empty secmon.bin
	secmon_bin = env.Command(
	target='secmon.bin',
	source=[],
	action=Touch('$TARGET')
	)
	Return()

[romanz]

Got any clues at which particular point does this happen?

It fails during the following cp 👀
https://github.com/trezor/trezor-firmware/actions/runs/19740721662/job/56563676033

[romanz]

@matejcik @mmilata We shouldn't probably copy everything from build/ dir, right?

trezor-firmware/build-docker.sh

Line 287 in 7150fb1

cp -r build/* /build

[mmilata]

IIRC it was useful when debugging why the build differs on two machines. But we can copy just the firmware images if it helps fixing CI.

[mmilata]

For consideration: building all targets in parallel brings down the pipeline time to ~12m: 316e7b8 https://github.com/trezor/trezor-firmware/actions/runs/19743054813. Fast but certainly the least efficient wrt total CPU time, also we'd have to combine the artifacts in another job probably.

[romanz]

Tested using a manual CI run: https://github.com/trezor/trezor-firmware/actions/runs/19765314523/job/56636556733.

[romanz]

Build durations: