mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-30 07:23:47 +08:00
Martin Vogel
5afdfcaac9
CodeQL ran on every pull_request push, and PR CI's security / codeql-gate job polled up to 150 min for that run before ci-ok could pass. With ~30 PRs pushed at once, the gate jobs held runners while the CodeQL runs they waited for queued behind them, and PR CI starved for hours. - codeql.yml: triggers are push to main, a weekly schedule, workflow_call and workflow_dispatch; pull_request is gone. The open-alert check moves here, unchanged and still fail-closed, as the `alerts` job (needs analyze), so every main push and every weekly run fails while any code-scanning alert is open. Push runs keep cancel-in-progress; called and scheduled runs get a group of their own. The analysis key is pinned to the push configuration so dry-run/release uploads do not open configurations of their own on main. - _security.yml: codeql-gate removed; callers grant contents: read only. - dry-run.yml, release.yml: a `codeql` job calls codeql.yml on the dispatched commit; release verify needs it and requires success. - select-lanes.sh, require-all-green.sh: the codeql-gate lane is gone from the selector universe and from ci-ok's job map; no other lane changes. - tests: the fail-closed contract follows the check to codeql.yml and now also pins the triggers, the derived callers' grants and release verify; lane fixtures drop codeql-gate. - SECURITY.md, MAINTAINERS.md: say where CodeQL runs now. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
95 lines
4.2 KiB
YAML
95 lines
4.2 KiB
YAML
# Reusable: lint only (cppcheck + clang-format).
|
|
# Security-static is separate — see _security.yml; CodeQL — see codeql.yml.
|
|
name: Lint & Security
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
lanes:
|
|
description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
|
|
type: string
|
|
default: all
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint') }}
|
|
# Pinned, not ubuntu-latest: the LLVM install below adds an
|
|
# apt.llvm.org llvm-toolchain-NOBLE repo, which is 24.04 by name. When
|
|
# GitHub moves ubuntu-latest to the next LTS this job breaks on a day
|
|
# nobody chose. Pin the runner to the release the repo line already names.
|
|
runs-on: ubuntu-24.04
|
|
# 15 min proved too tight on a slow runner day and a timed-out lint reads
|
|
# as "cancelled", which the release graph must treat as a hard stop; keep
|
|
# a bound, but one only a genuine hang can hit. 30 min stopped being that
|
|
# in 2026-10: single-process cppcheck over a src tree that grew ~60 % in
|
|
# files took the lint step from ~8 to 22-29 min, and three runs on
|
|
# 2026-10-13 were cancelled at 30 min with cppcheck still alive.
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
# Tests must pass or fail — no SKIPs except genuinely platform-specific
|
|
# ones (SKIP_PLATFORM / #ifdef). Fails the lint phase on any plain SKIP().
|
|
- name: No-skips policy (tests pass or fail)
|
|
run: bash scripts/check-no-test-skips.sh
|
|
|
|
- name: Install build deps
|
|
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev cmake
|
|
|
|
- name: Install LLVM 20
|
|
run: |
|
|
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
|
|
echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" | sudo tee /etc/apt/sources.list.d/llvm-20.list
|
|
sudo apt-get update
|
|
sudo apt-get install -y clang-format-20
|
|
|
|
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
id: cppcheck-cache
|
|
with:
|
|
path: /opt/cppcheck
|
|
key: cppcheck-2.20.0-ubuntu-amd64
|
|
|
|
- name: Build cppcheck 2.20.0
|
|
if: steps.cppcheck-cache.outputs.cache-hit != 'true'
|
|
run: |
|
|
git clone --depth 1 --branch 2.20.0 https://github.com/danmar/cppcheck.git /tmp/cppcheck
|
|
cmake -S /tmp/cppcheck -B /tmp/cppcheck/build -DCMAKE_BUILD_TYPE=Release -DHAVE_RULES=OFF -DCMAKE_INSTALL_PREFIX=/opt/cppcheck
|
|
cmake --build /tmp/cppcheck/build -j$(nproc)
|
|
cmake --install /tmp/cppcheck/build
|
|
|
|
- name: Add cppcheck to PATH
|
|
run: echo "/opt/cppcheck/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Lint (cppcheck + clang-format, no clang-tidy — enforced locally)
|
|
run: scripts/lint.sh --ci CLANG_FORMAT=clang-format-20
|
|
|
|
# Memory-analyzer gate (user decision 2026-08-03: runner cost accepted).
|
|
# Path-sensitive clang-analyzer over the memory checks only: leak paths,
|
|
# null derefs, uninitialized reads. Its first run produced 9 real fixes;
|
|
# the gate is green because every false positive was RESTRUCTURED for
|
|
# provability (never suppressed — the NOLINT ban applies here too).
|
|
# Vendored-tree diagnostics are path-filtered, mirroring .cppcheck.
|
|
lint-mem:
|
|
if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint-mem') }}
|
|
# Pinned for the same reason as `lint`: llvm-toolchain-noble-21 below.
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install build deps
|
|
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
|
|
|
|
- name: Install LLVM 21 (pinned analyzer toolchain)
|
|
run: |
|
|
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
|
|
echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" | sudo tee /etc/apt/sources.list.d/llvm-21.list
|
|
sudo apt-get update
|
|
sudo apt-get install -y clang-tidy-21
|
|
|
|
- name: Memory-analyzer gate
|
|
run: scripts/ci/lint-mem.sh clang-tidy-21
|