72 lines
2.3 KiB
YAML
72 lines
2.3 KiB
YAML
name: Clang Static Analyzer
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [ master, "release/**" ]
|
|
pull_request:
|
|
branches: [ master ]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
Analyze:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
# Needed to upload the results to code-scanning dashboard.
|
|
security-events: write
|
|
contents: read
|
|
|
|
env:
|
|
# The @microsoft/sarif-multitool tool actually uses DotnetCore, which in
|
|
# turn aborts when it finds that GitHub's CI machine doesn't have ICU.
|
|
# Just turn off localisation. A future version of the ubuntu-24.04 or
|
|
# ubuntu-latest runners might not need this workaround.
|
|
DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
|
|
|
|
steps:
|
|
- name: Setup
|
|
run: |
|
|
sudo apt-get -qq update
|
|
sudo apt-get -qq install ninja-build clang-tools
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Configure
|
|
run: |
|
|
mkdir build
|
|
cd build
|
|
scan-build cmake -G Ninja -DPCRE2_SUPPORT_JIT=ON -DCMAKE_BUILD_TYPE=Debug ..
|
|
|
|
- name: Build
|
|
run: |
|
|
# Inefficiently run clang scan twice; once to generate HTML, and secondly
|
|
# to generate SARIF files. Ideally we would have some way to scan once and
|
|
# generate one of those outputs from the other, but I don't know a good way
|
|
# to do that.
|
|
cd build
|
|
scan-build -o clang-report/ ninja
|
|
|
|
ninja clean
|
|
scan-build -o clang-sarif -sarif ninja
|
|
# Work around issue in GitHub's SARIF ingestion - merge all SARIF files into one
|
|
npx -y @microsoft/sarif-multitool merge clang-sarif/*/*.sarif --output-file=clang.sarif
|
|
|
|
# Upload the browsable HTML report as an artifact.
|
|
- name: Upload report
|
|
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
|
|
with:
|
|
name: "Clang Static Analyzer report"
|
|
path: './build/clang-report'
|
|
|
|
# Upload the results to GitHub's code scanning dashboard.
|
|
- name: "Upload to code-scanning"
|
|
uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
|
|
with:
|
|
sarif_file: build/clang.sarif
|
|
category: clang-analyzer
|