CI: Add Baremetal CI

- Adds CI to exercise the MPS3 AN547 (Cortex-M55) baremetal builds.
- It includes functional tests, KAT tests, and ACVP tests.

Signed-off-by: willieyz <[email protected]>

Author: willieyz

.github/workflows/all.yml

@@ -87,3 +87,11 @@ jobs:
     needs: [ base, nix ]
     uses: ./.github/workflows/slothy.yml
     secrets: inherit
+  baremetal:
+    name: Baremetal
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    needs: [ base ]
+    uses: ./.github/workflows/baremetal.yml
+    secrets: inherit

.github/workflows/baremetal.yml

@@ -0,0 +1,38 @@
+# Copyright (c) The mldsa-native project authors
+# Copyright (c) The mlkem-native project authors
+# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+
+name: Baremetal
+permissions:
+  contents: read
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  baremetal_tests:
+    name: Baremetal tests (${{ matrix.target.name }})
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+         - runner: ubuntu-latest
+           name: 'M55-AN547'
+           makefile: test/baremetal/platform/m55-an547/platform.mk
+           nix-shell: arm-embedded
+    runs-on: ${{ matrix.target.runner }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: baremetal build + test
+        uses: ./.github/actions/functest
+        env:
+          EXTRA_MAKEFILE: ${{ matrix.target.makefile }}
+        with:
+          nix-shell: ${{ matrix.target.nix-shell }}
+          gh_token: ${{ secrets.GITHUB_TOKEN }}
+          opt: no_opt
+          func: true
+          kat: true
+          acvp: true
+          examples: false
+          stack: false

test/mk/config.mk

@@ -76,7 +76,14 @@ endif
 # Include retained variables #
 ##############################
 
+
+# Force AUTO=0 when cross-compiling to avoid host architecture detection
+ifneq ($(CROSS_PREFIX),)
+override AUTO:=0
+else
 AUTO ?= 1
+endif
+
 CYCLES ?=
 OPT ?= 1
 RETAINED_VARS := CROSS_PREFIX CYCLES OPT AUTO