[bazel][ci-minor-increase] Make new CI workflow: faster and aligned with Bazel ideas

.aspect/cli/config.yml

@@ -0,0 +1,4 @@
+lint:
+  aspects:
+    - //tools/bazel:lint.bzl%ruff
+    - //tools/bazel:lint.bzl%clang_tidy

.bazeliskrc

@@ -0,0 +1,2 @@
+BAZELISK_BASE_URL=https://static.aspect.build/aspect
+USE_BAZEL_VERSION=aspect/2025.06.52

.clang-tidy

@@ -1,33 +1,53 @@
-Checks:          'clang-diagnostic-*,clang-analyzer-*,cppcoreguidelines-*,modernize-*,-modernize-use-trailing-return-type'
+# .clang-tidy
+
+# Enable broad sets, disable one modernize check explicitly.
+Checks: >
+  clang-diagnostic-*,
+  clang-analyzer-*,
+  cppcoreguidelines-*,
+  modernize-*,
+  -modernize-use-trailing-return-type
+
+# Lint everything. Set a regex (e.g. ^src/|^include/) to scope.
 HeaderFilterRegex: ''
-AnalyzeTemporaryDtors: false
-FormatStyle:     google
+
+# Use clang-format's "google" style when auto-fixing.
+FormatStyle: google
+
+# Per-check options, grouped for readability.
 CheckOptions:
-  - key:             cert-dcl16-c.NewSuffixes
-    value:           'L;LL;LU;LLU'
-  - key:             cert-oop54-cpp.WarnOnlyIfThisHasSuspiciousField
-    value:           '0'
-  - key:             cppcoreguidelines-explicit-virtual-functions.IgnoreDestructors
-    value:           '1'
-  - key:             cppcoreguidelines-non-private-member-variables-in-classes.IgnoreClassesWithAllMemberVariablesBeingPublic
-    value:           '1'
-  - key:             google-readability-braces-around-statements.ShortStatementLines
-    value:           '1'
-  - key:             google-readability-function-size.StatementThreshold
-    value:           '800'
-  - key:             google-readability-namespace-comments.ShortNamespaceLines
-    value:           '10'
-  - key:             google-readability-namespace-comments.SpacesBeforeComments
-    value:           '2'
-  - key:             modernize-loop-convert.MaxCopySize
-    value:           '16'
-  - key:             modernize-loop-convert.MinConfidence
-    value:           reasonable
-  - key:             modernize-loop-convert.NamingStyle
-    value:           CamelCase
-  - key:             modernize-pass-by-value.IncludeStyle
-    value:           llvm
-  - key:             modernize-replace-auto-ptr.IncludeStyle
-    value:           llvm
-  - key:             modernize-use-nullptr.NullMacros
-    value:           'NULL'
+  # --- CERT ---
+  - key: cert-dcl16-c.NewSuffixes
+    value: 'L;LL;LU;LLU'
+  - key: cert-oop54-cpp.WarnOnlyIfThisHasSuspiciousField
+    value: '0'
+
+  # --- CppCoreGuidelines ---
+  - key: cppcoreguidelines-explicit-virtual-functions.IgnoreDestructors
+    value: '1'
+  - key: cppcoreguidelines-non-private-member-variables-in-classes.IgnoreClassesWithAllMemberVariablesBeingPublic
+    value: '1'
+
+  # --- Google Readability ---
+  - key: google-readability-braces-around-statements.ShortStatementLines
+    value: '1'
+  - key: google-readability-function-size.StatementThreshold
+    value: '800'
+  - key: google-readability-namespace-comments.ShortNamespaceLines
+    value: '10'
+  - key: google-readability-namespace-comments.SpacesBeforeComments
+    value: '2'
+
+  # --- Modernize ---
+  - key: modernize-loop-convert.MaxCopySize
+    value: '16'
+  - key: modernize-loop-convert.MinConfidence
+    value: 'reasonable'
+  - key: modernize-loop-convert.NamingStyle
+    value: 'CamelCase'
+  - key: modernize-pass-by-value.IncludeStyle
+    value: 'llvm'
+  - key: modernize-replace-auto-ptr.IncludeStyle
+    value: 'llvm'
+  - key: modernize-use-nullptr.NullMacros
+    value: 'NULL'

.github/Dockerfile

@@ -0,0 +1,21 @@
+FROM debian:latest
+
+ARG USER=ci
+ARG BAZELISK_TAG=v1.19.0
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates curl git      \
+    build-essential gcc g++         \
+    clang lld ninja-build sudo      \
+    python3                         \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSL -o /usr/local/bin/bazelisk \
+      "https://github.com/bazelbuild/bazelisk/releases/download/${BAZELISK_TAG}/bazelisk-linux-amd64" \
+    && chmod 0755 /usr/local/bin/bazelisk \
+    && ln -s /usr/local/bin/bazelisk /usr/local/bin/bazel
+
+RUN useradd -m ${USER} \
+    && echo "${USER} ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+WORKDIR /home/${USER}/workspace

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/mainline-compile.yml

@@ -0,0 +1,52 @@
+name: HyperCPU CI/CD Pipeline (compile project)
+
+on:
+  workflow_call:
+
+jobs:
+  testing:
+    name: Compile (${{ matrix.compiler }})
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/hypercpu-project/hypercpu-builder:latest
+      options: --init
+    permissions:
+      contents: read
+      packages: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        compiler: [gcc, clang]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+          fetch-depth: 0
+
+      - name: Cache Bazel
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/bazel
+          key: bazel-${{ runner.os }}-${{ matrix.compiler }}-${{ hashFiles('**/*.bazel', '**/*.bzl') }}
+          restore-keys: |
+            bazel-${{ runner.os }}-${{ matrix.compiler }}-
+            bazel-${{ runner.os }}-
+
+      - name: Fix permissions
+        run: chown -R ci:ci "$GITHUB_WORKSPACE"
+
+      - name: Bazel build (linux-opt mode, with ${{ matrix.compiler }} compiler)
+        run: sudo -u ci bazelisk build //... --config=linux-opt --compiler=${{ matrix.compiler }}
+
+      - name: Upload package tarball
+        uses: actions/upload-artifact@v4
+        with:
+          name: hcpu-tarballs-${{ matrix.compiler }}
+          path: |
+            bazel-bin/tools/packaging/*.tar.gz
+            !bazel-bin/tools/packaging/hcpu.tar.gz
+          if-no-files-found: error

.github/workflows/mainline-format.yml

@@ -0,0 +1,27 @@
+name: HyperCPU CI/CD Pipeline (format)
+
+on:
+  workflow_call:
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/hypercpu-project/hypercpu-builder:latest
+      options: --init
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Fix permissions
+        run: chown -R ci:ci "$GITHUB_WORKSPACE"
+
+      - name: Run formatters
+        run: sudo -u ci bazelisk run :format
+
+      - name: Check diff
+        run: sudo -u ci git diff --quiet