maszyna/.github/workflows/build.yml

# .github/workflows/build.yml
# UNTRUSTED CONTEXT. This workflow runs fork-authored code.
# It must never reference `secrets.*` (other than the default GITHUB_TOKEN,
# which is read-only here). Do not add SONAR_TOKEN to this file.

name: Build

on:
  push:
    branches:
      - master
  pull_request:
    types: [ opened, reopened, synchronize ]

permissions:
  contents: read

jobs:
  build:
    name: Build under Build Wrapper
    runs-on: ubuntu-24.04
    env:
      BUILD_WRAPPER_OUT_DIR: bw-output
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Set up Python 3.14
        uses: actions/setup-python@v6
        with:
          python-version: '3.14'

      - name: Install build dependencies
        run: |
          sudo apt-get update -y
          sudo apt-get install -y \
            build-essential \
            libgl1-mesa-dev libglew-dev libglfw3-dev \
            libpng-dev libopenal-dev libluajit-5.1-dev \
            libserialport-dev libsndfile1-dev \
            xorg-dev libxkbcommon-dev libwayland-dev wayland-protocols

      - name: Build current OpenAL Soft
        run: |
          git clone --depth 1 --branch 1.24.2 https://github.com/kcat/openal-soft.git /tmp/openal-soft
          cmake -S /tmp/openal-soft -B /tmp/openal-soft/build \
            -DCMAKE_BUILD_TYPE=Release -DALSOFT_EXAMPLES=OFF -DALSOFT_UTILS=OFF
          cmake --build /tmp/openal-soft/build -j"$(nproc)"
          sudo cmake --install /tmp/openal-soft/build
          sudo ldconfig

      # A little bit of magic for unbreaking GCC. Not an issue for Clang and MSVC.
      # Fix for specific hard-errors for a combo of: varargs and always_inline
      - name: Patch GLM for GCC
        run: |
          sed -i 's/GLM_FUNC_QUALIFIER std::string format(const char\* message, \.\.\.)/inline std::string format(const char* message, ...)/' \
            ref/glm/glm/gtx/string_cast.inl
          grep -n "std::string format(const char\* message" ref/glm/glm/gtx/string_cast.inl

      - name: Install SonarQube Cloud Build Wrapper
        uses: SonarSource/sonarqube-scan-action/install-build-wrapper@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0

      - name: Configure (CMake)
        run: |
          cmake -S . -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DWITH_BETTER_RENDERER=OFF \
            -DWITH_ZMQ=OFF -DWITH_OPENVR=OFF -DUSE_LTO=OFF \
            -DCMAKE_CXX_FLAGS="-Wno-attributes -fno-inline-functions-called-once" \
            -DPython3_EXECUTABLE="$(which python3)"

      - name: Build under Build Wrapper
        run: |
          build-wrapper-linux-x86-64 \
            --out-dir "${BUILD_WRAPPER_OUT_DIR}" \
            cmake --build build --config Release -j"$(nproc)"

      # Metadata the trusted workflow needs to identify the PR.
      # Treated as UNVERIFIED input there and re-checked against the API.
      - name: Record event metadata
        run: |
          mkdir -p .sonar-meta
          echo "${{ github.event_name }}"                     > .sonar-meta/event
          echo "${{ github.event.pull_request.number }}"       > .sonar-meta/pr_number
          echo "${{ github.event.pull_request.head.sha }}"     > .sonar-meta/head_sha
          echo "${{ github.event.pull_request.base.ref }}"     > .sonar-meta/base_ref
          echo "${{ github.event.pull_request.head.ref }}"     > .sonar-meta/head_ref
          echo "${{ github.sha }}"                             > .sonar-meta/sha

      # The C/C++ analyzer needs the sources AND the build-wrapper output.
      # compile_commands.json holds absolute paths, so the trusted workflow must
      # unpack this at the same $GITHUB_WORKSPACE path — same repo, so it matches.
      - name: Pack analysis input
        run: |
          tar -czf /tmp/workspace.tar.gz \
            --exclude='./build/CMakeFiles' \
            --exclude='*.o' \
            --exclude='*.a' \
            --exclude='*.so' \
            -C "$GITHUB_WORKSPACE" .

      - name: Upload analysis input
        uses: actions/upload-artifact@v4
        with:
          name: sonar-input
          path: /tmp/workspace.tar.gz
          retention-days: 1
          if-no-files-found: error