mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-08 08:53:43 +08:00
Martin VogelandRares Popa
a45a99c9c7
Distilled from #2109 by Rares Popa. Two slices only; the rest of that PR is either frontend work the UI rebuild makes redundant, or a gating change that needs re-siting first. 1. Three jobs move from ubuntu-latest to ubuntu-24.04 _lint.yml `lint` and `lint-mem`, and _test.yml `test-diag`, each install a toolchain from an apt.llvm.org repo whose name contains the release: deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main noble IS 24.04. So these jobs already depend on a specific release while asking for whatever ubuntu-latest happens to mean that morning. The day GitHub advances ubuntu-latest, all three break at once, on a schedule nobody here chose, and the failure surfaces as an apt error far from its cause. Pinning the runner to the release the repo line already names costs nothing and removes the trapdoor. 2. actions/attest-sbom -> actions/attest attest-sbom is deprecated. Its remaining behaviour is to print "::warning::actions/attest-sbom has been deprecated" and forward to actions/attest with NODE_OPTIONS set, passing sbom-path through unchanged. Calling attest directly yields the same attestation minus the wrapper. Verified rather than assumed, because this sits on the release path: 59d89421af93a897026c735860bf21b6eb4f7b26 is exactly tag v4.1.0 of actions/attest, and sbom-path is a real input on that action at that SHA. The step keeps no continue-on-error, so a failed SBOM attestation still fails the release. That is the intended behaviour and the comment now says so: an unattested SBOM is worse than an absent one, because the artifact ships looking complete. Deliberately NOT taken from #2109, each for its own reason: - the actionlint job, as sited. _lint.yml is consumed by pr.yml, dry-run.yml and release.yml, pr.yml gates its whole test stage on `if lint succeeded`, and release.yml gates build on needs.lint.result == 'success'. A job there is merge-blocking and release-blocking with no branch-protection edit to make it visible, and this one curls a tarball from github.com releases with no cache and no fallback. actionlint is worth having; not on that path, and not before it has been run against current main. - the test-package-wrappers node matrix. It reruns the Go and PyPI suites a second time per OS to vary a Node version only the npm leg reads. - everything frontend: the test-frontend job, .node-version, and the dependabot graph-ui block. The UI is being rebuilt from the ground up, so gating on the current one buys coverage of a surface that is going away. Co-authored-by: Rares Popa <2606875+rarepops@users.noreply.github.com> Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
85 lines
3.7 KiB
YAML
85 lines
3.7 KiB
YAML
# Reusable: lint only (cppcheck + clang-format).
|
|
# Security-static and CodeQL gate are separate — see _security.yml.
|
|
name: Lint & Security
|
|
|
|
on:
|
|
workflow_call: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
# Pinned, not ubuntu-latest: the LLVM install below adds an
|
|
# apt.llvm.org llvm-toolchain-NOBLE repo, which is 24.04 by name. When
|
|
# GitHub moves ubuntu-latest to the next LTS this job breaks on a day
|
|
# nobody chose. Pin the runner to the release the repo line already names.
|
|
runs-on: ubuntu-24.04
|
|
# 15 min proved too tight on a slow runner day and a timed-out lint reads
|
|
# as "cancelled", which the release graph must treat as a hard stop; keep
|
|
# a bound, but one only a genuine hang can hit (normal runtime ~5 min).
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
# Tests must pass or fail — no SKIPs except genuinely platform-specific
|
|
# ones (SKIP_PLATFORM / #ifdef). Fails the lint phase on any plain SKIP().
|
|
- name: No-skips policy (tests pass or fail)
|
|
run: bash scripts/check-no-test-skips.sh
|
|
|
|
- name: Install build deps
|
|
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev cmake
|
|
|
|
- name: Install LLVM 20
|
|
run: |
|
|
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
|
|
echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" | sudo tee /etc/apt/sources.list.d/llvm-20.list
|
|
sudo apt-get update
|
|
sudo apt-get install -y clang-format-20
|
|
|
|
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
id: cppcheck-cache
|
|
with:
|
|
path: /opt/cppcheck
|
|
key: cppcheck-2.20.0-ubuntu-amd64
|
|
|
|
- name: Build cppcheck 2.20.0
|
|
if: steps.cppcheck-cache.outputs.cache-hit != 'true'
|
|
run: |
|
|
git clone --depth 1 --branch 2.20.0 https://github.com/danmar/cppcheck.git /tmp/cppcheck
|
|
cmake -S /tmp/cppcheck -B /tmp/cppcheck/build -DCMAKE_BUILD_TYPE=Release -DHAVE_RULES=OFF -DCMAKE_INSTALL_PREFIX=/opt/cppcheck
|
|
cmake --build /tmp/cppcheck/build -j$(nproc)
|
|
cmake --install /tmp/cppcheck/build
|
|
|
|
- name: Add cppcheck to PATH
|
|
run: echo "/opt/cppcheck/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Lint (cppcheck + clang-format, no clang-tidy — enforced locally)
|
|
run: scripts/lint.sh --ci CLANG_FORMAT=clang-format-20
|
|
|
|
# Memory-analyzer gate (user decision 2026-08-03: runner cost accepted).
|
|
# Path-sensitive clang-analyzer over the memory checks only: leak paths,
|
|
# null derefs, uninitialized reads. Its first run produced 9 real fixes;
|
|
# the gate is green because every false positive was RESTRUCTURED for
|
|
# provability (never suppressed — the NOLINT ban applies here too).
|
|
# Vendored-tree diagnostics are path-filtered, mirroring .cppcheck.
|
|
lint-mem:
|
|
# Pinned for the same reason as `lint`: llvm-toolchain-noble-21 below.
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install build deps
|
|
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
|
|
|
|
- name: Install LLVM 21 (pinned analyzer toolchain)
|
|
run: |
|
|
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
|
|
echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" | sudo tee /etc/apt/sources.list.d/llvm-21.list
|
|
sudo apt-get update
|
|
sudo apt-get install -y clang-tidy-21
|
|
|
|
- name: Memory-analyzer gate
|
|
run: scripts/ci/lint-mem.sh clang-tidy-21
|