ci: Build ESP-IDF smoke app on v6.0.2 (esp32p4) alongside v5.5.4

.github/workflows/test.yml

@@ -31,13 +31,23 @@ jobs:
         run: make test
 
   esp-idf:
-    name: ESP-IDF component build
+    name: ESP-IDF ${{ matrix.idf }} build (${{ matrix.target }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # v5.5.x uses plain mbedtls; v6.x (mbedTLS v4) exercises the
+        # mbedtls_compat shim path. esp32p4 is Kern's target on IDF 6.
+        include:
+          - idf: v5.5.4
+            target: esp32
+          - idf: v6.0.2
+            target: esp32p4
     steps:
       - uses: actions/checkout@v4
-      - name: Build smoke-test app for esp32
+      - name: Build smoke-test app
         uses: espressif/esp-idf-ci-action@v1
         with:
-          esp_idf_version: v5.5.4
-          target: esp32
+          esp_idf_version: ${{ matrix.idf }}
+          target: ${{ matrix.target }}
           path: 'tests/esp-idf-smoke'

tests/esp-idf-smoke/components/cUR/CMakeLists.txt

@@ -11,10 +11,19 @@ file(GLOB CUR_SRCS
     "${CUR_REPO_ROOT}/src/types/*.c"
 )
 
+# Mirror the repo-root CMakeLists.txt: mbedTLS v4 (ESP-IDF >= 6.0) needs the
+# mbedtls_compat header shim (vendored next to this component for the smoke
+# build; real consumers like Kern bring their own).
+if(IDF_VERSION_MAJOR GREATER_EQUAL 6)
+    set(CUR_SMOKE_REQUIRES mbedtls mbedtls_compat)
+else()
+    set(CUR_SMOKE_REQUIRES mbedtls)
+endif()
+
 idf_component_register(
     SRCS ${CUR_SRCS}
     INCLUDE_DIRS "${CUR_REPO_ROOT}/src"
-    REQUIRES mbedtls
+    REQUIRES ${CUR_SMOKE_REQUIRES}
 )
 
 target_compile_definitions(${COMPONENT_LIB} PUBLIC UR_USE_MBEDTLS_SHA256)

tests/esp-idf-smoke/components/mbedtls_compat/CMakeLists.txt

@@ -0,0 +1,10 @@
+# Minimal vendored copy of the Kern project's mbedtls_compat shim, trimmed
+# to SHA-256 (the only mbedTLS API cUR uses). mbedTLS v4 (ESP-IDF >= 6.0)
+# moved the crypto headers from mbedtls/ to mbedtls/private/; this
+# header-only component redirects #include <mbedtls/sha256.h> so
+# src/sha256/sha256_compat.h keeps working. Real consumers on IDF >= 6
+# (e.g. Kern) provide their own copy — see the repo-root CMakeLists.txt.
+idf_component_register(
+    INCLUDE_DIRS "."
+    REQUIRES mbedtls
+)

tests/esp-idf-smoke/components/mbedtls_compat/mbedtls/sha256.h

@@ -0,0 +1,5 @@
+// Compatibility shim (vendored from Kern): mbedTLS v4 moved sha256.h to
+// mbedtls/private/. MBEDTLS_ALLOW_PRIVATE_ACCESS keeps the context struct
+// fields reachable through the private header.
+#define MBEDTLS_ALLOW_PRIVATE_ACCESS
+#include "mbedtls/private/sha256.h"