name: Setup Baseband Guard (BBG)
description: Download and configure Baseband Guard security module

runs:
  using: composite
  steps:
    - name: Install Baseband Guard
      uses: ./.github/actions/retry
      with:
        command: |
          set -o pipefail
          curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors --connect-timeout 30 https://raw.githubusercontent.com/vc-teahouse/Baseband-guard/main/setup.sh | bash
        attempts: 5
        delay: 5
        workdir: ${{ github.workspace }}/kernel
    
    - name: Configure Baseband Guard
      shell: bash
      working-directory: ${{ github.workspace }}/kernel
      run: |
        # Modify security Kconfig to include baseband_guard in LSM
        sed -i '/^config LSM$/,/^help$/{ /^[[:space:]]*default/ { /baseband_guard/! s/selinux/selinux,baseband_guard/ } }' common/security/Kconfig
    
    - name: Verify BBG Installation
      shell: bash
      working-directory: ${{ github.workspace }}/kernel
      run: |
        if grep -q "baseband_guard" common/security/Kconfig; then
          echo "[+] SUCCESS: baseband_guard found in common/security/Kconfig"
          grep -n "baseband_guard" common/security/Kconfig || true
        else
          echo "[-] FAILED: baseband_guard not found in common/security/Kconfig"
          exit 1
        fi
    
    - name: Extract BBG Version
      shell: bash
      working-directory: ${{ github.workspace }}/kernel/Baseband-guard
      run: |
        # Extract and export BBG version info
        BBG_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
        echo "BBG_COMMIT=$BBG_COMMIT" >> $GITHUB_ENV

    - name: Enable Kernel Configs
      uses: ./.github/actions/set-kernel-config
      with:
        config_list: |
          CONFIG_BBG=y