CI: assert test-lib exit status in the wolfBoot host-smoke job

[dgarske]

The host-smoke job has been failing on every branch since wolfBoot 2e918de2 ("propagate the verify result from wolfBoot_start to the exit code") landed on wolfBoot master: test-lib now exits 255 for a rejected image instead of always exiting 0, so the tamper run's $(...) capture trips set -e and aborts the step at the assignment, before the output is printed or any assertion runs -- which is why the log ends with the golden run's "Firmware Valid" followed by exit 255 and looks like a golden-path failure. This scopes errexit around the two deliberately-non-zero invocations using the same set +e / capture $? / set -e idiom wolfBoot adopted in its own test-library.yml in that same commit, and takes the opportunity to assert the exit status on both paths (golden must exit 0, tamper must exit non-zero) in addition to the existing output checks, so the two workflows stay in step. Verified locally by building wolfBoot master's test-lib and reproducing both cases exactly (golden "Firmware Valid" / exit 0, tamper "Failure -1: Hdr 1, Hash 0, Sig 0" / exit 255), confirming the current step body fails identically to CI against that binary, confirming the new body passes, and negative-testing all four assertions with stubs to prove they actually fail when they should.

[Copilot]

Pull request overview

Updates the wolfBoot integration CI workflow so the host-smoke job correctly captures and asserts test-lib’s exit status (now meaningful on wolfBoot master), preventing set -e from aborting the step before logs and assertions run.

Changes:

• Scope errexit off/on around test-lib command substitutions to safely capture output and $?.
• Add explicit exit-status assertions: golden path must exit 0, tamper path must exit non-zero.
• Expand step comments to document the behavioral change and why the set +e/$? pattern is required.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753