name: clang_check

# Builds the Arm ports with Arm Toolchain for Embedded, which is LLVM based and
# is the successor to Arm Compiler 6. The gnu ports are otherwise only ever
# built with GNU tooling, and GNU as accepts several non-canonical forms that
# LLVM's assembler rejects; this catches those before they accumulate.
on:
  pull_request:
    branches: [ master, dev ]
    paths:
      - ".github/workflows/clang_check.yml"
      - "scripts/check_clang.sh"
      # CMakeLists.txt, cmake/ and common_smp/ were missing until 26 Aug 2026,
      # so this check did not run when the files it reads changed. The
      # ports_smp example builds compile common_smp/src and the CMake stage
      # reads the toolchain file and the top-level project. utility/ is
      # deliberately absent: the FreeRTOS and POSIX layers under it are not
      # enabled by any target this workflow builds. Keep this list and
      # gcc_check.yml's the same.
      - "CMakeLists.txt"
      - "cmake/**"
      - "common/**"
      # common_modules/ holds the portable module manager that the module
      # manager stage compiles once per Arm module port -- the larger half of
      # what that stage builds. Without it a change there leaves the stage
      # unrun, which is the same "absent from the count reads as covered" the
      # stage exists to close.
      - "common_modules/**"
      - "common_smp/**"
      - "ports/**"
      - "ports_arch/**"
      - "ports_module/**"
      - "ports_smp/**"

jobs:
  atfe:
    runs-on: ubuntu-24.04

    env:
      # Pinned deliberately, as the runner image is: a toolchain upgrade should
      # be a reviewable commit rather than something that changes underneath the
      # ports. Releases: https://github.com/arm/arm-toolchain/releases
      ATFE_VERSION: 22.1.0

    steps:
    # Actions are pinned to a commit SHA, with the version in the trailing
    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
    # code ran in CI" answerable from the repository. Dependabot moves these
    # pins and rewrites the comment with them -- see .github/dependabot.yml.
    - name: Checkout sources
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    - name: Cache Arm Toolchain for Embedded
      id: cache-atfe
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: atfe
        key: atfe-${{ env.ATFE_VERSION }}-linux-x86_64

    - name: Install Arm Toolchain for Embedded
      if: steps.cache-atfe.outputs.cache-hit != 'true'
      run: |
        set -eu
        base="https://github.com/arm/arm-toolchain/releases/download/release-${ATFE_VERSION}-ATfE"
        archive="ATfE-${ATFE_VERSION}-Linux-x86_64.tar.xz"
        mkdir -p atfe && cd atfe
        curl -fsSLO "$base/$archive"
        curl -fsSLO "$base/$archive.sha256"
        sha256sum -c "$archive.sha256"
        tar xf "$archive"
        rm -f "$archive"

    - name: Build the Arm ports with clang
      run: scripts/check_clang.sh --clang "atfe/ATfE-${ATFE_VERSION}-Linux-x86_64/bin/clang"