# The quick check on every push to the working branch: each board's image builds, and the v4
# tests pass. A pull request into master is gated by acceptance.yml, the full acceptance protocol;
# master itself is not checked again after a merge -- its content is what acceptance just passed.
# Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots,
# the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the
# documents to Nexus).
name: Build

on:
  push:
    branches: [StarForth-v4.0.0]   # not master: what reaches it has just passed acceptance (#119)
    paths-ignore: ['site/**']        # the websites (site/) build nothing here; each run is ~17 min on
                                     # the server the wikis share (Captain Bob, 2026-11-07)
  workflow_dispatch:

concurrency:
  group: qemu                     # every workflow shares this one group (Captain Bob, 2026-11-07: a
  cancel-in-progress: false       # runner-image rebuild blocks other jobs, always): one run at a time

jobs:
  image:
    name: Image ${{ matrix.board }}
    runs-on: ubuntu-latest
    container:
      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2   # ci/runner-image (#120)
      credentials:                # the registry refuses anonymous pulls
        username: rajames
        password: ${{ secrets.PACKAGES_TOKEN }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:                  # boards/<dir>/board.mk; Pi 4 has no port yet (#26)
          - { board: PC,    arch: amd64,   dir: pc,    image: lithos-pc.img }
          - { board: RASPI, arch: aarch64, dir: raspi, image: lithos-raspi.img }
          - { board: MILKV, arch: riscv64, dir: milkv, image: lithos-milkv.img }
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # the SBOM's version is git describe
          lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither

      - name: The capsule-signing key
        env:
          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
          if [ -n "$KEY" ]; then
            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
            (umask 077; printf '%s\n' "$KEY" > "$f")
            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
          else
            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
          fi

      - name: Boot image
        run: make boot_image TARGET=${{ matrix.board }}

      - name: Compress           # the PC image is a 2 GiB stick, nearly all empty
        run: xz -T0 -6 build/boards/${{ matrix.dir }}/${{ matrix.image }}

      - name: Keep the image and its SBOM
        uses: actions/upload-artifact@v3
        with:
          name: image-${{ matrix.dir }}-${{ github.run_number }}
          path: |
            build/boards/${{ matrix.dir }}/${{ matrix.image }}.xz
            build/boards/${{ matrix.dir }}/*.spdx*

  v4-tests:
    name: v4 tests (32- and 64-bit cells)
    runs-on: ubuntu-latest
    container:
      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2   # ci/runner-image (#120)
      credentials:                # the registry refuses anonymous pulls
        username: rajames
        password: ${{ secrets.PACKAGES_TOKEN }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: false

      - name: The capsule-signing key
        env:
          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
          if [ -n "$KEY" ]; then
            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
            (umask 077; printf '%s\n' "$KEY" > "$f")
            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
          else
            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
          fi

      - name: make -C v4 test
        run: make -C v4 test