corestate/.github/workflows/module-build.yml

name: Module Build CI

on:
  push:
    branches: [ main, develop ]
    paths:
      - 'module/**'
  pull_request:
    branches: [ main ]
    paths:
      - 'module/**'

jobs:
  build-native-module:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [x86_64, aarch64]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential \
            cmake \
            linux-headers-generic \
            gcc-aarch64-linux-gnu \
            g++-aarch64-linux-gnu
            
      - name: Cache CMake build
        uses: actions/cache@v4
        with:
          path: |
            module/native/build
          key: ${{ runner.os }}-cmake-${{ matrix.arch }}-${{ hashFiles('module/native/CMakeLists.txt') }}
          restore-keys: |
            ${{ runner.os }}-cmake-${{ matrix.arch }}-
            
      - name: Configure CMake build
        run: |
          cd module/native
          mkdir -p build
          cd build
          if [ "${{ matrix.arch }}" = "aarch64" ]; then
            cmake .. -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc -DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++
          else
            cmake ..
          fi
          
      - name: Build native components
        run: |
          cd module/native/build
          make -j$(nproc)
          
      - name: Run component tests
        if: matrix.arch == 'x86_64'
        run: |
          cd module/native/build
          # Run tests if available
          if [ -f "test_runner" ]; then
            ./test_runner
          else
            echo "No test runner found, skipping tests"
          fi
          
      - name: Package build artifacts
        run: |
          cd module/native/build
          tar -czf ../../../module-${{ matrix.arch }}.tar.gz .
          
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: module-${{ matrix.arch }}
          path: module-${{ matrix.arch }}.tar.gz
          
  validate-module-properties:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name: Validate module.prop
        run: |
          if [ -f "module/module.prop" ]; then
            echo "Validating module.prop..."
            # Check required fields
            grep -q "^id=" module/module.prop || (echo "Missing id field" && exit 1)
            grep -q "^name=" module/module.prop || (echo "Missing name field" && exit 1)
            grep -q "^version=" module/module.prop || (echo "Missing version field" && exit 1)
            grep -q "^versionCode=" module/module.prop || (echo "Missing versionCode field" && exit 1)
            grep -q "^author=" module/module.prop || (echo "Missing author field" && exit 1)
            grep -q "^description=" module/module.prop || (echo "Missing description field" && exit 1)
            echo "module.prop validation passed"
          else
            echo "module.prop not found"
            exit 1
          fi
          
  check-kernel-compatibility:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        kernel_version: ['5.15', '6.1', '6.6']
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name: Install kernel headers for ${{ matrix.kernel_version }}
        run: |
          sudo apt-get update
          # This is a simulation - in real scenarios you'd need actual kernel headers
          echo "Checking compatibility with kernel ${{ matrix.kernel_version }}"
          
      - name: Check source compatibility
        run: |
          echo "Checking C++ source compatibility with kernel ${{ matrix.kernel_version }}"
          # Check for deprecated kernel APIs
          if grep -r "deprecated_function" module/native/ 2>/dev/null; then
            echo "Warning: Found deprecated kernel functions"
          fi
          
          # Check for kernel version-specific code
          if grep -r "LINUX_VERSION_CODE" module/native/ 2>/dev/null; then
            echo "Found kernel version checks in code"
          fi
          
          echo "Compatibility check completed for kernel ${{ matrix.kernel_version }}"
          
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name: Run Semgrep security scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >
            p/security-audit
            p/cpp
          scanDirPath: module/
        continue-on-error: true
        
      - name: Check for hardcoded secrets
        run: |
          echo "Scanning for hardcoded secrets in module..."
          # Check for common secret patterns
          if grep -r -i "password\|secret\|key\|token" module/ --include="*.cpp" --include="*.h" --include="*.c"; then
            echo "Warning: Found potential hardcoded secrets"
          else
            echo "No hardcoded secrets detected"
          fi