bfe-core1106-sdk/.github/workflows/ci.yml

# warden-sdk CI.
#
# Policy (mirrors flare-edge): only GitHub-owned actions get the repo token; the one
# third-party helper (taiki-e/install-action) is pinned and never handed a token.
# Host-testable jobs run on GitHub-hosted runners; only the heavy kernel build uses
# the self-hosted [self-hosted, warden-sdk] runner on bfe-mpc-0640 (added in P5).
name: ci

on:
  push:
    paths-ignore: ['.github/badges/**']
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# Least privilege by default: every job gets a read-only token; only `badges`
# (which commits rendered SVGs) overrides this with contents: write below.
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    outputs:
      passed: ${{ steps.result.outputs.passed }}
      coverage: ${{ steps.result.outputs.coverage }}
    steps:
      - uses: actions/checkout@v4
      - name: cargo test (all crates)
        run: |
          set -o pipefail
          : > /tmp/test.log
          for d in sim tools/config-lint; do
            echo "== cargo test in $d ==" | tee -a /tmp/test.log
            ( cd "$d" && cargo test --locked ) 2>&1 | tee -a /tmp/test.log
          done
      - name: coverage (cargo-llvm-cov on sim)
        run: rustup component add llvm-tools-preview
      - uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7
        with:
          tool: cargo-llvm-cov
      - name: run coverage
        working-directory: sim
        run: cargo llvm-cov --locked --json --summary-only --output-path /tmp/cov.json
      - name: parse results
        id: result
        run: |
          passed=$(grep -oE '[0-9]+ passed' /tmp/test.log | awk '{s+=$1} END{print s+0}')
          pct=$(python3 -c 'import json;print("%.0f"%json.load(open("/tmp/cov.json"))["data"][0]["totals"]["lines"]["percent"])')
          echo "passed=$passed" >> "$GITHUB_OUTPUT"
          echo "coverage=$pct" >> "$GITHUB_OUTPUT"
          echo "tests passed: $passed | sim line coverage: ${pct}%"

  mcdc:
    # 100% MC/DC (condition coverage) enforced on every Tier-1 driver harness.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: install gcc-14
        run: sudo apt-get update -qq && sudo apt-get install -y -qq gcc-14
      - name: enforce 100% MC/DC on drivers/*/test
        run: |
          fail=0; ran=0
          for t in drivers/*/test; do
            [ -f "$t/Makefile" ] || continue
            ran=1
            echo "== MC/DC: $t =="
            make -C "$t" check CC=gcc-14 GCOV=gcov-14 || fail=1
          done
          [ "$ran" = 1 ] || { echo "no driver MC/DC harnesses found"; exit 1; }
          exit $fail

  bench:
    # Smoke-run the sim micro-benchmarks and emit the ns/op trend JSON. Regression
    # gating against stored history is future work (no flare-edge pattern to copy).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: run sim benchmarks
        working-directory: sim
        run: |
          cargo bench --locked --bench sim_bench 1> bench.txt 2> bench.json
          echo "== timings =="; cat bench.txt
          echo "== trend json =="; grep '"bench"' bench.json

  patches-apply:
    # The RV1106 series must apply cleanly onto pristine linux-6.18.46.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: cache pristine kernel tarball
        uses: actions/cache@v4
        with:
          path: ~/linux-6.18.46.tar.xz
          key: linux-6.18.46-tarball
      - name: fetch + verify pristine
        run: |
          [ -f ~/linux-6.18.46.tar.xz ] || \
            curl -fSL https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.46.tar.xz -o ~/linux-6.18.46.tar.xz
          echo "$(cat build/linux-6.18.46.tar.xz.sha256)  $HOME/linux-6.18.46.tar.xz" | sha256sum -c -
      - name: apply the series in order
        run: |
          tar -C /tmp -xf ~/linux-6.18.46.tar.xz
          for p in patches/*.patch; do
            git -C /tmp/linux-6.18.46 apply --whitespace=nowarn "$GITHUB_WORKSPACE/$p" \
              && echo "applied $p" || { echo "FAILED to apply $p"; exit 1; }
          done
          echo "full series applied cleanly onto pristine 6.18.46"

  kernel-build:
    # Full hermetic build on the warden-sdk self-hosted runner (bfe-mpc-0640,
    # ADR-0004). Manual-dispatch by design — a full kernel build is too heavy to run
    # on every push; trigger it via `gh workflow run ci.yml` / the Actions UI.
    if: github.event_name == 'workflow_dispatch'
    runs-on: [self-hosted, warden-sdk]
    steps:
      - uses: actions/checkout@v4
      - name: provision `python` (SDK quirk — build calls bare python)
        run: |
          mkdir -p "$RUNNER_TEMP/bin"
          ln -sf "$(command -v python3)" "$RUNNER_TEMP/bin/python"
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
      - name: build zImage + rv1106-warden.dtb
        env:
          # WORK must be OUTSIDE the repo checkout: build-kernel.sh applies the patch
          # series with `git apply`, which silently ignores out-of-subdir paths when
          # run inside another git repo (issue #1). $RUNNER_TEMP is outside the checkout.
          WORK: ${{ runner.temp }}/kbuild-out
          JOBS: 4   # belt-and-braces bound in addition to the runner's cgroup cap
          # The kernel is freestanding; use the stable generic arm cross toolchain
          # (Debian gcc-arm-linux-gnueabihf on the runner) rather than depending on
          # the ephemeral Luckfox SDK checkout path.
          CROSS_COMPILE: arm-linux-gnueabihf-
        run: bash build/build-kernel.sh
      - uses: actions/upload-artifact@v4
        with:
          name: kernel-rv1106
          path: |
            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
            ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
          retention-days: 14

  badges:
    needs: [test]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: install cloc
        run: sudo apt-get update -qq && sudo apt-get install -y -qq cloc
      - name: render badges
        env:
          PASSED: ${{ needs.test.outputs.passed }}
          COVERAGE: ${{ needs.test.outputs.coverage }}
        run: |
          mkdir -p .github/badges
          loc=$(cloc --quiet --json --exclude-dir=target,build,build-target,patches,data,docs . \
                | python3 -c 'import sys,json; print(json.load(sys.stdin)["SUM"]["code"])')
          col=orange; [ "${COVERAGE:-0}" -ge 60 ] && col=yellow; [ "${COVERAGE:-0}" -ge 80 ] && col=brightgreen
          curl -fsSL "https://img.shields.io/badge/lines%20of%20code-${loc}-blue" -o .github/badges/loc.svg
          curl -fsSL "https://img.shields.io/badge/tests-${PASSED}%20passing-brightgreen" -o .github/badges/tests.svg
          curl -fsSL "https://img.shields.io/badge/coverage-${COVERAGE}%25-${col}" -o .github/badges/coverage.svg
      - name: commit badges
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .github/badges/loc.svg .github/badges/tests.svg .github/badges/coverage.svg
          if ! git diff --cached --quiet; then
            git commit -m "ci: update loc/tests/coverage badges [skip ci]"
            git push
          fi