ci.yml

name: CI

# Every branch push and PR; tags belong to release.yml.
# `'**'`, not `'*'`: only the doubled form matches the `/` in task branch names.
# Trap: a push naming only tags or tags-ignore never fires for branches.
on:
  push:
    branches:
      - '**'
  pull_request:

# Cancels a superseded push; the push/PR pair lands in different groups.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

defaults:
  run:
    # Explicit, since the default is bash -e without pipefail.
    shell: bash

jobs:
  # Lints scripts/ with shellcheck; tags skip this job but still run the scripts.
  shellcheck:
    name: shellcheck
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Lint the shell scripts
        run: shellcheck scripts/*.sh

  clang-format:
    name: clang-format
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      # Pinned, so a new clang-format release cannot fail an untouched tree.
      - name: Install clang-format
        run: pipx install clang-format==20.1.8

      - name: Check formatting
        run: scripts/format.sh --check

  # The matrix lives in build.yml (shared with release.yml); linux-armv6 is in build-armv6.yml.
  build:
    uses: ./.github/workflows/build.yml