ci: add Baseband-guard setup to build workflow

Add BBG setup script and configuration to the kernel build process to enhance security by including baseband_guard in the LSM configuration.

.github/workflows/build.yml

@@ -234,6 +234,14 @@ jobs:
           cp ../../kernel_patches/wild/hooks/scope_min_manual_hooks_v1.4.patch ./
           patch -p1 --forward -F 3 < scope_min_manual_hooks_v1.4.patch
 
+      - name: Add BBG
+        run: |
+          cd "$CONFIG/kernel_platform"
+          echo "Adding BBG..."
+          wget -O- https://github.com/vc-teahouse/Baseband-guard/raw/main/setup.sh | bash
+          echo "CONFIG_BBG=y" >> common/arch/arm64/configs/gki_defconfig
+          sed -i '/^config LSM$/,/^help$/{ /^[[:space:]]*default/ { /baseband_guard/! s/landlock/landlock,baseband_guard/ } }' common/security/Kconfig
+
       - name: Apply Module Symbol Version Fix Patch
         if: ${{ matrix.apply_symbol_fix }}
         run: |

.github/workflows/main.yml

@@ -132,7 +132,6 @@ jobs:
 
           NEW:
           -> **Symbol Fix Variant**: Normal build with additional symbol fixes for compatibility, if you encounter any issues with the normal build try this!
-
       
           Features:
           -> Wild KSU