name: phase0-ci

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: phase0-ci-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  build-and-audit:
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    container:
      image: ubuntu:26.04@sha256:651ba3fe3a830441e3deaf70fafac40d808a6bd2800a6f2c43130055159f23e6
    steps:
      - name: Install build tools
        run: >-
          apt-get update && apt-get install -y --no-install-recommends
          ca-certificates
          bsdextrautils
          clang-18
          clang-format-18
          clang-tidy-18
          cmake
          curl
          git
          lld-18
          llvm-18-dev
          ninja-build
          nodejs
          python3
          unzip

      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0

      - name: Host build and policy tests
        run: |
          cmake -S . -B build/host -G Ninja -DCMAKE_C_COMPILER=clang-18 -DCHIMERA_GFX_ENABLE_CLANG_TIDY=ON -DCHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS=OFF -DBUILD_TESTING=ON
          cmake --build build/host
          ctest --test-dir build/host --output-on-failure

      - name: Fetch and verify locked public PS5 SDK
        run: |
          curl -fL --retry 3 --output /tmp/ps5-payload-sdk.zip https://github.com/ps5-payload-dev/sdk/releases/download/v0.41/ps5-payload-sdk.zip
          echo "ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984  /tmp/ps5-payload-sdk.zip" | sha256sum --check --strict
          unzip -q /tmp/ps5-payload-sdk.zip -d /opt

      - name: Compile all safe Phase-0 PS5 targets
        env:
          LLVM_CONFIG: /usr/bin/llvm-config-18
        run: |
          cmake -S . -B build/ps5 -G Ninja -DCMAKE_TOOLCHAIN_FILE=/opt/ps5-payload-sdk/toolchain/prospero.cmake -DCHIMERA_GFX_BUILD_PS5_PROBE=ON -DCHIMERA_GFX_PS5_ALLOWED_FIRMWARE=NONE -DBUILD_TESTING=OFF
          cmake --build build/ps5