1 files changed, 74 insertions, 0 deletions
diff --git a/.github/workflows/clang_check.yml b/.github/workflows/clang_check.yml
new file mode 100644
index 00000000..53b60bfe
--- /dev/null
+++ b/.github/workflows/clang_check.yml
@@ -0,0 +1,74 @@
+name: clang_check
+
+# Builds the Arm ports with Arm Toolchain for Embedded, which is LLVM based and
+# is the successor to Arm Compiler 6. The gnu ports are otherwise only ever
+# built with GNU tooling, and GNU as accepts several non-canonical forms that
+# LLVM's assembler rejects; this catches those before they accumulate.
+on:
+  pull_request:
+    branches: [ master, dev ]
+    paths:
+      - ".github/workflows/clang_check.yml"
+      - "scripts/check_clang.sh"
+      # CMakeLists.txt, cmake/ and common_smp/ were missing until 26 Aug 2026,
+      # so this check did not run when the files it reads changed. The
+      # ports_smp example builds compile common_smp/src and the CMake stage
+      # reads the toolchain file and the top-level project. utility/ is
+      # deliberately absent: the FreeRTOS and POSIX layers under it are not
+      # enabled by any target this workflow builds. Keep this list and
+      # gcc_check.yml's the same.
+      - "CMakeLists.txt"
+      - "cmake/**"
+      - "common/**"
+      # common_modules/ holds the portable module manager that the module
+      # manager stage compiles once per Arm module port -- the larger half of
+      # what that stage builds. Without it a change there leaves the stage
+      # unrun, which is the same "absent from the count reads as covered" the
+      # stage exists to close.
+      - "common_modules/**"
+      - "common_smp/**"
+      - "ports/**"
+      - "ports_arch/**"
+      - "ports_module/**"
+      - "ports_smp/**"
+
+jobs:
+  atfe:
+    runs-on: ubuntu-24.04
+
+    env:
+      # Pinned deliberately, as the runner image is: a toolchain upgrade should
+      # be a reviewable commit rather than something that changes underneath the
+      # ports. Releases: https://github.com/arm/arm-toolchain/releases
+      ATFE_VERSION: 22.1.0
+
+    steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
+    - name: Checkout sources
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Cache Arm Toolchain for Embedded
+      id: cache-atfe
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: atfe
+        key: atfe-${{ env.ATFE_VERSION }}-linux-x86_64
+
+    - name: Install Arm Toolchain for Embedded
+      if: steps.cache-atfe.outputs.cache-hit != 'true'
+      run: |
+        set -eu
+        base="https://github.com/arm/arm-toolchain/releases/download/release-${ATFE_VERSION}-ATfE"
+        archive="ATfE-${ATFE_VERSION}-Linux-x86_64.tar.xz"
+        mkdir -p atfe && cd atfe
+        curl -fsSLO "$base/$archive"
+        curl -fsSLO "$base/$archive.sha256"
+        sha256sum -c "$archive.sha256"
+        tar xf "$archive"
+        rm -f "$archive"
+
+    - name: Build the Arm ports with clang
+      run: scripts/check_clang.sh --clang "atfe/ATfE-${ATFE_VERSION}-Linux-x86_64/bin/clang"