Relying on tests/setup_script.sh and not using a special docker test image

.github/workflows/Dockerfile

@@ -1,31 +1,41 @@
 # An image derived from ledgerhq/speculos but also containing the bitcoin-core binaries
-# compiled from the master branch
 
-FROM ghcr.io/ledgerhq/speculos:latest
-
-# install git and curl
-RUN apt update -y && apt install -y git curl
-
-# install autotools bitcoin-core build dependencies
-RUN apt install -y bsdmainutils build-essential cmake pkg-config ccache git libboost-dev libboost-filesystem-dev libboost-system-dev libboost-test-dev libevent-dev libminiupnpc-dev libnatpmp-dev libqt5gui5 libqt5core5a libqt5dbus5 libsqlite3-dev libtool libzmq3-dev pkg-config python3 qttools5-dev qttools5-dev-tools qtwayland5 systemtap-sdt-dev
-
-# clone bitcoin-core from github and compile it
-RUN cd / && \
-    git clone --depth=1 https://github.com/bitcoin/bitcoin.git && \
-    cd bitcoin && \
+# ==========================================
+# STAGE 1: Builder
+# ==========================================
+FROM ghcr.io/ledgerhq/speculos:latest AS builder
+
+# 1. Combine apt commands, prevent interactive prompts, and skip recommended bloatware.
+RUN apt-get update -y && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    build-essential cmake pkg-config ccache git curl bsdmainutils \
+    libboost-dev libboost-filesystem-dev libboost-system-dev libboost-test-dev \
+    libevent-dev libminiupnpc-dev libnatpmp-dev libqt5gui5 libqt5core5a \
+    libqt5dbus5 libsqlite3-dev libtool libzmq3-dev python3 qttools5-dev \
+    qttools5-dev-tools qtwayland5 systemtap-sdt-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+# 2. Clone and compile. Use -j to build using all available CPU cores!
+RUN git clone --depth=1 https://github.com/bitcoin/bitcoin.git /bitcoin && \
+    cd /bitcoin && \
     cmake -B build -DENABLE_IPC=OFF && \
-    cmake --build build && \
+    cmake --build build -j"$(nproc)" && \
     cmake --install build
 
-
+# ==========================================
+# STAGE 2: Runtime
+# ==========================================
 FROM ghcr.io/ledgerhq/speculos:latest
-COPY --from=0 /usr/local/bin/ /usr/local/bin/
 
-# install essential tools
-RUN apt update -y && apt install -y build-essential curl git
+# Copy the compiled binaries from Stage 1
+COPY --from=builder /usr/local/bin/ /usr/local/bin/
 
-# install runtime dependencies for bitcoind
-RUN apt install -y libminiupnpc-dev libminiupnpc-dev libnatpmp-dev libevent-dev libzmq3-dev
+# 3. Clean up the runtime dependencies, but KEEP build-essential for pip!
+RUN apt-get update -y && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    curl git libminiupnpc-dev libnatpmp-dev libevent-dev libzmq3-dev \
+    build-essential python3-dev && \
+    rm -rf /var/lib/apt/lists/*
 
 # Add bitcoin binaries to path
-ENV PATH=/usr/local/bin/:$PATH
+ENV PATH="/usr/local/bin/:${PATH}"

.github/workflows/build_and_functional_tests.yml

@@ -20,14 +20,28 @@ on:
         options:
           - 'Raise an error (default)'
           - 'Open a PR'
+      simulate_schedule:
+        type: boolean
+        description: 'Simulate the weekly schedule (Builds custom container)'
+        default: false
   push:
     branches:
       - master
       - main
       - develop
   pull_request:
+  schedule:
+    # Runs at 2:00 AM CET every Monday
+    - cron: '0 1 * * 1'
 
 jobs:
+  build_container:
+    name: Build and push speculos-bitcoin docker image
+    # Runs on the Monday cron OR if the manual checkbox is ticked
+    if: github.event_name == 'schedule' || inputs.simulate_schedule == true
+    uses: ./.github/workflows/builder-image-workflow.yml
+    secrets: inherit
+
   build_application:
     name: Build application using the reusable workflow
     uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_build.yml@v1
@@ -37,11 +51,19 @@ jobs:
 
   ragger_tests:
     name: Run ragger tests using the reusable workflow
-    needs: build_application
+    needs: [build_application, build_container]
+
+    # Ensures we still run if the container build was skipped (e.g., standard PRs)
+    if: |
+      always() &&
+      needs.build_application.result == 'success' &&
+      (needs.build_container.result == 'success' || needs.build_container.result == 'skipped')
+
     uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_ragger_tests.yml@v1
     with:
       download_app_binaries_artifact: "compiled_app_binaries"
-      container_image: "ghcr.io/ledgerhq/app-bitcoin-new/speculos-bitcoin:latest"
-      # when merging a PR, we run the tests with the --enable_slow_tests parameter
+      # If scheduled or ticked-> use the custom bitcoin speculos image.
+      # Otherwise -> pass an empty string to use Ledger's default image.
+      container_image: ${{ (github.event_name == 'schedule' || inputs.simulate_schedule == true) && 'ghcr.io/ledgerhq/app-bitcoin-new/speculos-bitcoin:latest' || '' }}
       test_options: ${{ github.event_name == 'push' && '--enable_slow_tests' || '' }}
       regenerate_snapshots: ${{ github.event_name == 'workflow_dispatch' && inputs.golden_run == 'Open a PR' }}

.github/workflows/builder-image-workflow.yml

@@ -6,25 +6,37 @@ on:
     branches:
       - master
       - develop
+  workflow_call: # This makes the workflow "reusable"
 
 jobs:
   build:
     name: Build and push ledger-app-builder image
     runs-on: ubuntu-latest
     permissions:
-      packages: write
+      contents: read
+      packages: write # Required to push to ghcr.io
 
     steps:
     - name: Clone
       uses: actions/checkout@v4
 
-    - name: Build and push speculos-bitcoin to GitHub Packages
-      uses: docker/build-push-action@v1
+    - name: Log in to GitHub Container Registry
+      uses: docker/login-action@v3
       with:
-        dockerfile: .github/workflows/Dockerfile
-        repository: ledgerhq/app-bitcoin-new/speculos-bitcoin
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-        tag_with_sha: true
-        tags: latest
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build and push speculos-bitcoin
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        file: .github/workflows/Dockerfile
+        push: true
+        # We tag with 'latest' for the schedule, and the SHA for debugging history
+        tags: |
+          ghcr.io/ledgerhq/app-bitcoin-new/speculos-bitcoin:latest
+          ghcr.io/ledgerhq/app-bitcoin-new/speculos-bitcoin:${{ github.sha }}

.github/workflows/codespell.yml

@@ -0,0 +1,18 @@
+name: Misspellings CI
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+      - main
+      - develop
+  pull_request:
+
+jobs:
+  misspell:
+    name: Check misspellings
+    uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_spell_check.yml@v1
+    with:
+      src_path: src, bitcoin_client, bitcoin_client_js, bitcoin_client_rs, doc
+      ignore_words_list: usig,Bu,fpr