GCC Static Analyzer #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright The Zephyr Project Contributors | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # GCC static analyzer (-fanalyzer) scan, reported to the Security dashboard. | |
| # | |
| name: GCC Static Analyzer | |
| on: | |
| schedule: | |
| # Run at 04:00 UTC on every day. | |
| - cron: '0 4 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.profile }}) | |
| if: github.repository_owner == 'zephyrproject-rtos' | |
| runs-on: | |
| group: zephyr-runner-v2-linux-x64-4xlarge | |
| container: | |
| image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.29.3.20260727 | |
| options: '--entrypoint /bin/bash' | |
| timeout-minutes: 720 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - profile: kernel | |
| twister-args: >- | |
| -p qemu_x86 -p qemu_cortex_m3 | |
| -T tests/kernel -T tests/lib -T tests/arch | |
| - profile: connectivity | |
| twister-args: >- | |
| -p qemu_x86 | |
| -T tests/net -T tests/bluetooth | |
| - profile: subsys | |
| twister-args: >- | |
| -p qemu_x86 | |
| -T tests/subsys -T tests/drivers | |
| env: | |
| ZEPHYR_TOOLCHAIN_VARIANT: zephyr | |
| USE_CCACHE: "0" | |
| steps: | |
| - name: Apply container owner mismatch workaround | |
| run: | | |
| # FIXME: The owner UID of the GITHUB_WORKSPACE directory may not | |
| # match the container user UID because of the way GitHub | |
| # Actions runner is implemented. Remove this workaround when | |
| # GitHub comes up with a fundamental fix for this problem. | |
| git config --global --add safe.directory ${GITHUB_WORKSPACE} | |
| - name: Clone cached Zephyr repository | |
| continue-on-error: true | |
| run: | | |
| git clone --shared /repo-cache/zephyrproject/zephyr . | |
| git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY} | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Zephyr environment | |
| uses: ./.github/actions/zephyr-ci-env | |
| with: | |
| group-filter: '+ci,+optional,+testing' | |
| run-checks: 'true' | |
| - name: Install Python packages | |
| run: | | |
| pip install -r scripts/requirements-actions.txt --require-hashes | |
| - name: Build with the GCC analyzer | |
| run: | | |
| export ZEPHYR_BASE=${PWD} | |
| # As with the CodeQL scan, a partially built tree is still worth | |
| # reporting on: a board that fails to configure must not cost us the | |
| # findings from everything that did compile. | |
| set +e | |
| ./scripts/twister \ | |
| --build-only \ | |
| --inline-logs --force-color -v \ | |
| --outdir twister-out-gcc-sca \ | |
| -j 16 \ | |
| -xZEPHYR_SCA_VARIANT=gcc \ | |
| -xUSE_CCACHE=0 \ | |
| "-xGCC_SCA_OPTS=-fdiagnostics-format=sarif-file;-Wno-error;-Wno-analyzer-too-complex" \ | |
| ${{ matrix.twister-args }} | |
| status=$? | |
| set -e | |
| if [ ${status} -ne 0 ]; then | |
| echo "::warning title=Incomplete analyzer build::twister exited ${status} for" \ | |
| "profile '${{ matrix.profile }}'; reporting on the translation units that" \ | |
| "did compile. Coverage for this profile is incomplete." | |
| fi | |
| - name: Merge analyzer output | |
| run: | | |
| # GCC leaves one SARIF file per translation unit in each build | |
| # directory, so this collapses thousands of files -- most of them | |
| # empty -- into one report with repository-relative paths. | |
| python3 scripts/ci/gcc_sca_sarif.py twister-out-gcc-sca \ | |
| --source-root "${PWD}" \ | |
| -o results-${{ matrix.profile }}.sarif | |
| - name: Upload profile SARIF | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: gcc-sca-sarif-${{ matrix.profile }} | |
| if-no-files-found: error | |
| retention-days: 7 | |
| path: results-${{ matrix.profile }}.sarif | |
| upload: | |
| name: Upload to code scanning | |
| needs: analyze | |
| # Report whatever finished. One profile timing out should not cost the | |
| # findings from the others. | |
| if: always() && github.repository_owner == 'zephyrproject-rtos' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download profile SARIF | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: gcc-sca-sarif-* | |
| merge-multiple: true | |
| path: sarif-in | |
| - name: Merge profiles into one report | |
| id: merge | |
| run: | | |
| set -eu | |
| if ! ls sarif-in/*.sarif >/dev/null 2>&1; then | |
| echo "::warning title=No analyzer results::every profile failed before" \ | |
| "producing a report; nothing to upload" | |
| echo "found=false" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| # The merge is idempotent, so the same script folds the per-profile | |
| # reports together and drops findings duplicated across profiles -- | |
| # shared code is recompiled by each one. | |
| python3 scripts/ci/gcc_sca_sarif.py sarif-in \ | |
| --source-root "${PWD}" \ | |
| -o results.sarif | |
| echo "found=true" >> $GITHUB_OUTPUT | |
| - name: Write job summary | |
| if: steps.merge.outputs.found == 'true' | |
| run: python3 scripts/ci/sarif_summary.py results.sarif | |
| - name: Upload SARIF to code scanning | |
| if: steps.merge.outputs.found == 'true' | |
| uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 | |
| with: | |
| sarif_file: results.sarif | |
| # Keeps these alerts in their own lane in the dashboard, so they | |
| # neither collide with nor get closed by the CodeQL and Eclair runs. | |
| category: gcc-static-analyzer | |
| - name: Upload SARIF as artifact | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: gcc-sca-sarif | |
| if-no-files-found: ignore | |
| retention-days: 30 | |
| path: results.sarif |