maszyna/.github/workflows/build.yml

# .github/workflows/build.yml
# UNTRUSTED CONTEXT. This workflow runs fork-authored code.
# It must never reference `secrets.*` (other than the default GITHUB_TOKEN,
# which is read-only here). Do not add SONAR_TOKEN to this file.

name: Build

on:
  push:
    branches:
      - master
  pull_request:
    types: [ opened, reopened, synchronize ]

permissions: {}

jobs:
  build:
    name: Build under Build Wrapper
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      BUILD_WRAPPER_OUT_DIR: bw-output
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Set up Python 3.14
        uses: actions/setup-python@v6
        with:
          python-version: '3.14'

      - name: Install build dependencies
        run: |
          sudo apt-get update -y
          sudo apt-get install -y \
            build-essential ninja-build wget lsb-release software-properties-common gnupg \
            libgl1-mesa-dev libglew-dev libglfw3-dev \
            libpng-dev libopenal-dev libluajit-5.1-dev \
            libserialport-dev libsndfile1-dev \
            xorg-dev libxkbcommon-dev libwayland-dev wayland-protocols

      - name: Install LLVM/Clang 22
        run: |
          # Noble ships Clang 18, whose C++20 module support is not good enough
          # for this tree; apt.llvm.org has current releases.
          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
          chmod +x /tmp/llvm.sh
          sudo /tmp/llvm.sh 22
          sudo apt-get install -y clang-tools-22   # clang-scan-deps, needed to scan modules

      - name: Build current OpenAL Soft
        run: |
          git clone --depth 1 --branch 1.24.2 https://github.com/kcat/openal-soft.git /tmp/openal-soft
          cmake -S /tmp/openal-soft -B /tmp/openal-soft/build \
            -DCMAKE_BUILD_TYPE=Release -DALSOFT_EXAMPLES=OFF -DALSOFT_UTILS=OFF
          cmake --build /tmp/openal-soft/build -j"$(nproc)"
          sudo cmake --install /tmp/openal-soft/build
          sudo ldconfig

      - name: Install SonarQube Cloud Build Wrapper
        uses: SonarSource/sonarqube-scan-action/install-build-wrapper@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0

      - name: Configure (CMake)
        env:
          CC: clang-22
          CXX: clang++-22
        run: |
          cmake -S . -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DWITH_BETTER_RENDERER=OFF \
            -DWITH_ZMQ=OFF -DWITH_OPENVR=OFF -DUSE_LTO=OFF \
            -DCMAKE_CXX_FLAGS="-Wno-attributes" \
            -DPython3_EXECUTABLE="$(which python3)"

      - name: Build under Build Wrapper
        run: |
          build-wrapper-linux-x86-64 \
            --out-dir "${BUILD_WRAPPER_OUT_DIR}" \
            cmake --build build --config Release -j"$(nproc)"

      # Metadata the trusted workflow needs to identify the PR.
      # Treated as UNVERIFIED input there and re-checked against the API.
      - name: Record event metadata
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          COMMIT_SHA: ${{ github.sha }}
        run: |
          mkdir -p .sonar-meta
          printf '%s\n' "$EVENT_NAME"   > .sonar-meta/event
          printf '%s\n' "$PR_NUMBER"    > .sonar-meta/pr_number
          printf '%s\n' "$PR_HEAD_SHA"  > .sonar-meta/head_sha
          printf '%s\n' "$COMMIT_SHA"   > .sonar-meta/sha

      # The C/C++ analyzer needs the sources AND the build-wrapper output.
      # compile_commands.json holds absolute paths, so the trusted workflow must
      # unpack this at the same $GITHUB_WORKSPACE path — same repo, so it matches.
      - name: Pack analysis input
        run: |
          tar -czf /tmp/workspace.tar.gz \
            --exclude='./build/CMakeFiles' \
            --exclude='*.o' \
            --exclude='*.a' \
            --exclude='*.so' \
            -C "$GITHUB_WORKSPACE" .

      - name: Upload analysis input
        uses: actions/upload-artifact@v4
        with:
          name: sonar-input
          path: /tmp/workspace.tar.gz
          retention-days: 1
          if-no-files-found: error