Adds .editorconfig pinning UTF-8, LF line endings, final newlines, and
trailing-whitespace stripping repo-wide. YAML gets 2-space indent;
shell scripts get space-only (size left unenforced for existing 3-space
files). Vendored / machine-generated trees are exempt:
src/m68000 (UAE 68K core), src/bios/jag*.c (bin2c hex tables), and
libretro-common (vendored).

Wires editorconfig-checker v3.0.3 into c-cpp.yml as a new job so
deviations show up at PR time. .ecrc carries the binary-file glob
exclusions (ROMs, baselines, build artifacts, vendored sources) since
.editorconfig itself can't skip files entirely.

Drive-by cleanups to satisfy the new check:
- Strip trailing whitespace from CODEOWNERS, Makefile, src/cd/cdrom.c,
  src/jerry/jerry.h, src/tom/{blitter,gpu,op,tom}.c.
- Convert .gitlab-ci.yml from CRLF to LF.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Resolves the "Node.js 20 actions are deprecated" warnings emitted on
every workflow run (June 2 2026 deadline).

  actions/checkout         v4 -> v5  (Node 24)
  actions/upload-artifact  v4 -> v5
  actions/download-artifact v4 -> v5
  actions/cache            v4 -> v5
  actions/github-script    v7 -> v8
  mymindstorm/setup-emsdk  v14 -> v16

Conservative N+1 major bumps where possible. Latest tags are further
ahead (checkout v6, upload-artifact v7, etc.) but introduce additional
behavioral changes; v5 is the stable Node-24 transition release.

msys2/setup-msys2@v2, nttld/setup-ndk@v1, and ilammy/msvc-dev-cmd@v1
are already at their current major versions.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Replaces the split GIT_VERSION/CORE_VERSION wiring (Makefile -DGIT_VERSION
+ libretro.c hardcoded "v2.2.0") with a generated src/core/version.h that
both sites read.

  CORE_BASE_VERSION (Makefile)            single source of truth
        v
  scripts/gen-version-h.sh                portable composer
        v
  src/core/version.h (gitignored)         #define CORE_VERSION ...
        v
  libretro.c                              #include "version.h"

Generation is content-aware (cmp + mv), so unchanged content leaves
mtime untouched and incremental builds stay incremental. Only changing
the version (or the git short rev) invalidates libretro.o.

CI: msvc-check compiles libretro.c directly without going through make,
so it runs scripts/gen-version-h.sh as a pre-step.

Also fixes version-bump.yml which was greping `library_version = "v..."`
in libretro.c -- a literal that no longer exists since the assignment
became `= CORE_VERSION`. The workflow now reads/writes the Makefile's
CORE_BASE_VERSION line.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Mach-O ld64 ignores --version-script (so link.T did nothing on Apple
platforms) but it does honour -exported_symbols_list. Adds:

  exports.list       production retro_* only (mirrors link.T)
  exports-test.list  wide symbol set for white-box test harnesses
                     (mirrors link-test.T)

Threaded into the osx, ios, and tvos-arm64 platform stanzas via a new
$(MACHO_EXPORTS_FLAGS) variable that toggles between the two lists
based on TEST_EXPORTS=1, mirroring the existing GNU-ld choice.

Effect on macOS arm64 production .dylib:
  before: every internal DSP/GPU/blitter/68K symbol exported (~hundreds)
  after:  46 retro_* entry points, zero leaks

CI: c-cpp.yml gets a "Verify Mach-O symbol gating" step that runs
nm -gU on the production .dylib and fails if anything outside retro_*
is exported. Runs before the test step (which would relink with the
wide list).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Adds a cppcheck CI job that scans src/ + libretro.c for warning,
performance, and portability issues.  Excludes vendored / generated
trees (src/m68000, src/bios/jag*.c, libretro-common) at scan time.

Known pre-existing findings are pinned in cppcheck-suppressions.txt
with one-line rationales (false positives where cppcheck doesn't
model GET16/GET32, plus a handful of upstream signed-shift idioms
flagged for follow-up).  --error-exitcode=1 means new findings
outside the suppression set fail CI -- keeps the baseline from
silently growing.

Local baseline (with the suppressions) is 0 findings.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

The macos-13 (Intel) runner pool is increasingly scarce -- v2.2.0's
release job was queued for over an hour on this single row before we
cancelled it and shipped manually.

Switch the macos-x86_64 builds (in both release.yml and c-cpp.yml) to
run on macos-latest (arm64) and cross-compile via `clang -arch x86_64`.
BLITTER_SIMD=sse2 is required because Makefile.common's auto-detect
keys on host arch (uname -m), not target.

Threaded through a new optional matrix field `make_extra` so the Build
step can append per-row flags without bloating the per-row matrix
entries.

Tested locally on Apple Silicon: the cross-compiled .dylib loads
cleanly and passes file/lipo identification as Mach-O x86_64.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Three build/CI bugs surfaced by PR #121 first run:

1. Makefile -- the new `$(CORE_DIR)/libretro.o: $(VERSION_H)` rule sat
   above `all:`, so Make 3.81 (the stock /usr/bin/make on macOS, also
   the GitHub Actions macos-latest runner) latched onto libretro.o as
   the default goal and the build silently stopped after one .o.
   Moved the dependency hook below `all:`, and switched version.h
   regeneration from a `: FORCE` rule to a parse-time
   `_VERSION_GEN := $(shell ...)` (avoids a separate parallelism quirk
   in old Make).  Verified: make -j4 now produces the dylib with 46
   retro_* exports as expected.

2. cppcheck-suppressions.txt -- cppcheck 2.13 (Ubuntu 24.04 apt)
   rejects comment lines in suppressions files with "Failed to add
   suppression. No id."  Newer cppcheck (2.20) accepts them.  The
   workflow now strips comments + blank lines before passing the file
   to cppcheck, keeping the source-of-truth file with rationale intact.

3. c89-lint.sh -- since libretro.c now `#include "version.h"`, the
   `-fsyntax-only` lint failed on a fresh checkout where `make` hadn't
   run yet.  c89-lint.sh now self-bootstraps version.h via
   `scripts/gen-version-h.sh` so it works standalone.

Also addresses Copilot review comments on the CLAUDE.md edit:

- C89 exempt list now matches the actual scripts/c89-lint.sh::skip_file
  patterns (cpu*.c / read*.c / jag*bios*.c / SIMD / test tools), not
  the over-broad `src/m68000/*`.
- Memory map reference points at src/core/vjag_memory.c (where the
  address-range comment lives) instead of vjag_memory.h.
- Removed dangling references to non-existent test/headless.py and
  libretro.py; the actual harness is test/regression_test.sh +
  miniretro.
- Removed the `make screenshots-preflight` reference (no such target).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

ndk-build uses jni/Android.mk, not the project Makefile, so the
parse-time `_VERSION_GEN := $(shell ...)` doesn't run and libretro.c
fails with "version.h: file not found".  Same shape as the msvc-check
fix: explicitly call scripts/gen-version-h.sh before invoking
ndk-build, in both c-cpp.yml and release.yml.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Establishes the GitFlow branching model (develop / release/* /
hotfix/*) and wires the CI to support it.  master remains the default
GitHub branch (so clones / "View raw" / etc. still resolve).

Workflow trigger updates:
- c-cpp.yml, regression-test.yml: push fires on [master, develop],
  pull_request on [develop, master].  Means CI runs on PRs to either
  branch and on every push that lands.
- pull-request.yml: auto-PR for feature/* branches now targets
  develop, not master.

New workflow:
- warn-pr-base.yml: comments on PRs that target master, asking the
  contributor to retarget to develop.  Skipped when the source branch
  is release/* or hotfix/* (the legitimate master-bound exits).
  Uses pull_request_target so it has write perms on fork PRs; only
  reads PR metadata so this is safe.  Idempotent via a marker comment.

New docs:
- .github/PULL_REQUEST_TEMPLATE.md: prompts contributors to verify
  base is develop, with an explicit hotfix/release escape hatch.
- docs/release-process.md: documents the full flow including
  back-merge after tagging and a hotfix recipe.
- CLAUDE.md: short branching paragraph so future Claude sessions
  default to branching off develop.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

CONTRIBUTING.md is the human-facing complement to CLAUDE.md.  Covers
GitFlow branching, build / test / lint commands, pre-commit setup,
commit-message style, and the C89 reminder.

scripts/install-hooks.sh now also runs check-info-version.sh in the
pre-commit pipeline whenever dist/info/.info or Makefile is staged --
catches a stale display_version bump before it reaches CI.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

New \"sanitizers\" job in c-cpp.yml builds with
-fsanitize=address,undefined -O1 -g and runs the full make test
suite with ASAN_OPTIONS / UBSAN_OPTIONS set strict.

Initially marked continue-on-error: true so the first run is
advisory -- the cppcheck job already flagged a couple of signed-shift
UB sites in src/tom/{gpu,op}.c that UBSAN will hit immediately, and
ASAN may surface other latent issues.  Triage them, fix or suppress,
then flip to gating.

Local sanity: clang -fsanitize=address,undefined builds the dylib
cleanly on darwin-arm64 (Mach-O x86_64 dlsym path is exercised in CI).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

.clang-format: tolerant config for the existing mixed-indent codebase.
UseTab: ForIndentation accepts both tab and 4-space indent without
rewriting one to the other.  ColumnLimit: 0 keeps line-length advisory
(no auto-rewrap).  Enforces brace placement, spacing, and pointer
alignment that ARE consistent across the tree.

clang-format.yml workflow runs clang-format-diff -p1 against the PR
diff hunks ONLY (-U0), so existing files are invisible to it -- only
new/changed lines are checked against the config.  Vendored / generated
trees excluded via git pathspec.

continue-on-error: true so it surfaces as advisory, not a merge gate,
while contributors get used to the convention.  Job summary emits the
suggested diff for easy copy-paste.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

.clang-tidy: curated check list (bugprone-* + clang-analyzer-* + a few
readability checks) with disables for the noise that always misfires
on emulator C (narrowing-conversions on register byte ops,
macro-parentheses on GET16/SET32 byte-swap macros, reserved-identifier
on UAE 68K __regs idioms, etc.).

clang-tidy job runs only on pull_request events.  Generates
compile_commands.json via bear, then runs clang-tidy on the
PR-changed .c/.h files only (filtered to in-tree code; excludes
libretro-common, src/m68000, src/bios/jag*.c, generated version.h).

continue-on-error: true so the first run surfaces the baseline
without blocking PRs.  Plan: triage findings on the first 1-2 PRs,
suppress / fix as appropriate, then flip to gating.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Adds:
- Makefile: COVERAGE=1 toggle injects --coverage -O0 -g into FLAGS +
  LDFLAGS.  New \`make coverage\` target does clean + COVERAGE=1
  TEST_EXPORTS=1 build + make test + gcovr report.
- gcovr.cfg: filters to src/, excludes libretro-common, src/m68000,
  src/bios/jag*.c, test/.  Cobertura XML output.
- codecov.yml: per-PR patch threshold 0%, project threshold 1% (noise
  absorption), same ignore globs.
- c-cpp.yml: new \"coverage\" job runs make coverage and uploads via
  codecov-action@v5.  Token optional (public repo); set
  CODECOV_TOKEN secret to skip the anonymous-upload rate limit.
  continue-on-error: true so coverage runs are advisory.

Codecov requires the GitHub App to be installed on the libretro org
to post the per-PR comment + status -- one-time admin step.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Three GitHub issue forms (yml schema) under .github/ISSUE_TEMPLATE/:

- bug_report.yml -- functional bugs.  Pre-fills the questions we
  always end up asking: which game, which BIOS mode, which blitter
  mode, which core version + frontend, log output.
- performance_issue.yml -- separate template for slowdown / stutter
  reports, with a prompt for `make benchmark` numbers and the
  blitter-mode A/B (most perf reports are blitter-specific).
- feature_request.yml -- libretro-surface feature asks; redirects
  hardware-emulation feature requests to upstream Virtual Jaguar.

config.yml disables blank issues and adds two contact links: the
libretro Discord (for general questions that aren't core bugs) and
the upstream repo (for issues reproducible in standalone Virtual
Jaguar).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Adds .github/labeler.yml + .github/workflows/labeler.yml using
actions/labeler@v5.  Any PR that touches a subsystem gets the
matching label so triage queries work:

  is:pr label:dsp
  is:pr label:blitter label:performance
  is:pr label:tests author:JoeMatt

Subsystem mappings:
  dsp        src/jerry/dsp*, test/test_dsp_*, test/test_audio_*
  gpu        src/tom/gpu*, test/test_gpu_*
  blitter    src/tom/blitter*, test/test_blitter_*
  op         src/tom/op*, test/test_op_*
  m68k       src/m68000/**, test/test_m68k_*
  cd         src/cd/**, test/test_cd_*
  bios       src/bios/**, test/test_hle_bios.c
  core       src/core/**, test/test_subsystem_*, test/test_event_*, ...

Area mappings reuse existing labels where possible
(`ci/cd 🤖`, `📖 documentation`, `performance`) and add
`libretro-glue`, `tests`, `build`.

sync-labels: true means labels auto-removed if a follow-up commit
reverts the relevant files.

11 new labels created on the repo (subsystem + area).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Three real bugs flagged in Copilot's second review pass:

1. cppcheck workflow used `grep -E '^\s*(#|$)'` to strip suppressions
   file comments.  `\s` is a GNU grep extension, not POSIX ERE.
   Switched to `[[:space:]]` for portability.

2. Makefile invoked `_VERSION_GEN := $(shell bash gen-version-h.sh)`
   on every parse, including read-only goals like `make clean`,
   `make print-FOO`, `make lint`.  Now gated via MAKECMDGOALS filter:
   read-only / metadata goals skip the bash invocation.  Real builds
   (default goal, all, etc.) still run it.  Verified locally: make
   clean / print-* / lint don't spawn the script; make / make all
   regenerate version.h as expected.

3. clang-format workflow captured the entire PR diff into a shell
   variable.  Switched to mktemp + stream pipe -- handles large diffs
   without shell variable bloat.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

The previous "always exit 0" intent was foiled by GitHub Actions'
default `bash -e {0}` shell: both git diff and clang-format-diff
return 1 when their output is non-empty (diff present / suggestions
made), which `set -e` treats as a fatal error and kills the script
before our trailing `exit 0` runs.

Switch to `shell: bash {0}` (no -e), keep `set -u`, and add `|| true`
on the clang-format-diff invocation belt-and-suspenders.  Also handle
"clang-format-diff not found" as a warning rather than hard error
(this is an advisory check; missing tooling shouldn't fail it).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

The compile step had `-fsanitize=address,undefined` but the link
step uses \$(LD) (defaults to cc), so the asan/ubsan runtime libs
(__asan_memcpy, __ubsan_handle_*) weren't pulled in -- linker
errors before the test step could run.

Setting LD=\"clang -fsanitize=...\" alongside CC/CXX makes the link
step instrument-aware.  The job will now actually run the test
suite under sanitizers and surface real findings (or pass clean).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

The first sanitizer run (now correctly linking with -shared-libasan)
caught real UB in src/m68000/readcpu.c:1004 -- "shift exponent -1 is
negative".  The UAE 68K core (machine-generated, ~1.8 MB cpuemu.c)
uses negative shifts intentionally; fixing requires patching the
generator upstream and is out of scope.  We treat src/m68000/ as
opaque per CLAUDE.md.

Add .ubsan-ignorelist with src:src/m68000/* and pass it via
-fsanitize-ignorelist so the sanitizer job isolates new bugs in OUR
code without burying the signal under upstream noise.

Also fix docs/profiling.md: SIMD is currently wired into the
ACCURATE blitter's pixel kernel (BlitterMidsummer2's DATA() macro),
not the fast blitter as the doc claimed.  Caught by the blitter
spike research agent.  Cross-references issue #124 for the SIMD
widening plan.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Five real findings:

1. scripts/gen-version-h.sh: shebang said #!/usr/bin/env bash but the
   script is pure POSIX sh.  Switched to /usr/bin/env sh so it runs
   in environments without bash.  Updated the header comment to
   describe the actual call sites (Makefile parse-time $(shell),
   Android.mk, c89-lint, install-hooks pre-commit, msvc-check).
2. scripts/c89-lint.sh: now invokes the generator via \`sh\`, not
   \`bash\` -- so the C89 lint hook works on POSIX-only environments.
3. jni/Android.mk: ndk-build doesn't go through the project Makefile,
   so the parse-time version.h gen there didn't fire for local
   Android builds (only c-cpp.yml's CI step had it).  Added the
   \`$(shell sh ... gen-version-h.sh ...)\` invocation to Android.mk.
   Also dropped the now-redundant -DGIT_VERSION wiring (handled by
   the generated header).
4. scripts/install-hooks.sh header comment: corrected dist/info/.info
   path reference to "anything under dist/info/ or Makefile".
5. Makefile \`make benchmark\` target: -ldl is Linux-specific and was
   hard-coded.  macOS clang accepts it as a no-op but other linkers
   may not.  Now conditional via \`$(if $(filter Linux,$(uname)),-ldl)\`.

Local sanity: sh scripts/gen-version-h.sh runs clean, c89-lint passes,
make benchmark on Apple Silicon produces expected ~240 FPS without
spurious -ldl warnings.

Co-Authored-By: Claude Opus 4.7 <[email protected]>