From 7bf4e75dea6d72969ae6e3708ec0312be3fc604d Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Sun, 5 Jul 2026 14:25:47 +0200
Subject: [PATCH] Add 'make format-check' and similar clang format check to CI.

---
 .github/workflows/linux-ci.yml | 32 ++++++++++++++++++++++++++++++++
 Makefile.in                    |  6 ++++++
 2 files changed, 38 insertions(+)

diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml
index 6724d46c0..5664b2ec4 100644
--- a/.github/workflows/linux-ci.yml
+++ b/.github/workflows/linux-ci.yml
@@ -57,3 +57,35 @@ jobs:
 
       - name: Run tests
         run: extras/build-tests/nix/run-tests
+
+  format-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        #uses: actions/checkout@v4
+        #no, pin to v4.2.2 for security reasons:
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        #and we don't need the credentials later..
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      # We pin clang-format to major version 21 because different versions
+      # format slightly differently (which would cause false failures).
+      # This must match the version developers use, see also the comment
+      # at the top of the .clang-format file.
+      - name: Install clang-format 21
+        run: |
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt-llvm-org.asc >/dev/null
+          echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" | sudo tee /etc/apt/sources.list.d/llvm21.list
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends clang-format-21
+
+      # Same check as 'make format-check' in Makefile.in (we cannot use
+      # that directly here because 'make' requires ./configure to have run).
+      - name: Check code formatting
+        run: |
+          clang-format-21 --version
+          clang-format-21 --dry-run --Werror `git ls-files src include | grep -E '\.(c|h)$' | grep -vE 'crypt_blowfish|openssl_hostname_validation'`
diff --git a/Makefile.in b/Makefile.in
index a63393925..626b0a374 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -174,6 +174,12 @@ depend:
 format:
 	clang-format -i `git ls-files src include | grep -E '\.(c|h)$$' | grep -vE 'crypt_blowfish|openssl_hostname_validation'`
 
+# Like 'make format' but only CHECK if everything is formatted properly,
+# without modifying any file. Fails if 'make format' would change something.
+# The CI runs this too (see .github/workflows/linux-ci.yml).
+format-check:
+	clang-format --dry-run --Werror `git ls-files src include | grep -E '\.(c|h)$$' | grep -vE 'crypt_blowfish|openssl_hostname_validation'`
+
 install: all
 	$(INSTALL) -m 0700 -d $(DESTDIR)@BINDIR@
 	$(INSTALL) -m 0700 src/ircd $(DESTDIR)@BINDIR@/unrealircd