From 9230565f3c705928088bf2ea01cf6c84cdda2425 Mon Sep 17 00:00:00 2001
From: Dany Petit <danypetit.be@gmail.com>
Date: Sat, 29 Aug 2026 22:30:38 +0200
Subject: [PATCH] ci: add self-contained Linux job on distro packages, guard
 sonarcloud for forks

- New build-linux-native workflow builds the game and runs the test suite
  against distro SDL2/libnoise/OpenAL packages (apt), with no Conan and no
  third-party server dependencies. Mirrors a verified local build.
- sonarcloud job now only runs on the upstream repository: forks lack
  SONAR_TOKEN and the scan step fetches a runner script from an external CDN.
---
 .github/workflows/build-linux-native.yml | 50 ++++++++++++++++++++++++
 .github/workflows/sonarcloud.yml         |  3 ++
 2 files changed, 53 insertions(+)
 create mode 100644 .github/workflows/build-linux-native.yml

diff --git a/.github/workflows/build-linux-native.yml b/.github/workflows/build-linux-native.yml
new file mode 100644
index 0000000000..d3e8cc84ee
--- /dev/null
+++ b/.github/workflows/build-linux-native.yml
@@ -0,0 +1,50 @@
+name: Build Linux (distro packages)
+
+# Self-contained CI job: builds against the SDL2/OpenAL/libnoise packages
+# shipped by the distro instead of Conan profiles. It needs no external
+# services, so it keeps working even if third-party infrastructure
+# (personal git servers, CDN downloads) goes away.
+
+on: [push, pull_request]
+
+jobs:
+  linux-gcc:
+    name: Linux (GCC, distro packages)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          echo -e 'pcm.!default {\n type plug\n slave.pcm "null"\n}' > ~/.asoundrc
+          sudo apt-get update
+          sudo apt-get -y install \
+            ninja-build \
+            libsdl2-dev \
+            libsdl2-image-dev \
+            libsdl2-ttf-dev \
+            libnoise-dev \
+            libpng-dev \
+            zlib1g-dev \
+            libopenal-dev \
+            libvorbis-dev
+
+      - name: Configure
+        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TEST=ON -G Ninja
+
+      - name: Build
+        run: cmake --build build -j"$(nproc)"
+
+      - name: Test
+        env:
+          SDL_VIDEODRIVER: dummy
+          SDL_AUDIODRIVER: dummy
+        run: ctest --test-dir build --output-on-failure -j2
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: Cytopia-linux-${{ github.sha }}
+          path: |
+            build/bin/Cytopia
+            data/resources
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index f6ab473c4f..c98ef49853 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -9,6 +9,9 @@ on:
 jobs:
   build:
     name: sonarcloud scan
+    # Only run on the upstream repo: forks lack the SONAR_TOKEN secret and the
+    # scan step downloads a runner script from an external CDN.
+    if: github.repository == 'CytopiaTeam/Cytopia'
     runs-on: ubuntu-latest
     env:
       CONAN_SYSREQUIRES_MODE: "enabled"