# This is a basic workflow to help you get started with Actions

name: ports_arch_check

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the master branch
on:
  pull_request:
    # dev is included as well as master. The check only ever ran against master,
    # so eight months of port fixes merged into dev without it, and the ports
    # drifted from ports_arch unnoticed.
    branches: [ master, dev ]
    paths:
      - ".github/workflows/ports_arch_check.yml"
      - 'common/**'
      - 'common_modules/**'
      - 'common_smp/**'
      - 'ports/**'
      - 'ports_modules/**'
      - 'ports_smp/**'
      - 'ports_arch/**'

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # Check ports for cortex-m
  cortex-m:
    # The type of runner that the job will run on
    runs-on: ubuntu-24.04

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    # No token input: secrets are not available to pull requests from forks, so
    # passing one made this job fail at checkout with "Input required and not
    # supplied: token" and the check never evaluated anything. The default
    # GITHUB_TOKEN is enough to check out a public repository, and the
    # repository has no submodules.
    # Actions are pinned to a commit SHA, with the version in the trailing
    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
    # code ran in CI" answerable from the repository. Dependabot moves these
    # pins and rewrites the comment with them -- see .github/dependabot.yml.
    - name: Checkout sources
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    # Check the port trees: the generated ports must be reproducible from
    # ports_arch, and no port header may be left unbalanced or carrying code
    # outside a function. The same script runs locally, so a contributor sees
    # exactly what CI sees.
    - name: Check ports
      run: scripts/check_ports.sh

  cortex-a:
    # Check ports for cortex-a. This ran on Windows because the A profile
    # tooling was PowerShell only; update.sh beside each update.ps1 means it
    # runs on the same image as every other job now.
    runs-on: ubuntu-24.04

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    # No token input: secrets are not available to pull requests from forks, so
    # passing one made this job fail at checkout with "Input required and not
    # supplied: token" and the check never evaluated anything. The default
    # GITHUB_TOKEN is enough to check out a public repository, and the
    # repository has no submodules.
    - name: Checkout sources
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    # Regenerate the A profile ports and fail if anything changed, which means
    # a generated port was edited directly instead of ports_arch.
    - name: Check the Cortex-A ports
      run: |
        (cd ports_arch/ARMv7-A && ./update.sh --port-sets tx \
            --copy-common-files --copy-port-files --copy-example --patch-files)
        (cd ports_arch/ARMv8-A && ./update.sh --port-sets tx,tx_smp \
            --copy-common-files --copy-port-files --copy-example --patch-files)
        if [[ -n $(git status --porcelain -uno) ]]; then
          echo "The Cortex-A ports are not reproducible from ports_arch:"
          git status --porcelain -uno
          exit 1
        fi