Skip to content

Commit d93a22e

Browse files
aidangarskeaidangarske
committed
Add initial support
1 parent 5140cc3 commit d93a22e

File tree

1 file changed

+237
-0
lines changed

1 file changed

+237
-0
lines changed

‎.github/workflows/static-analysis.yml‎

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
name: Static Analysis
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ '*' ]
7+
pull_request:
8+
branches: [ '*' ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
# END OF COMMON SECTION
14+
15+
jobs:
16+
cppcheck:
17+
name: cppcheck Static Analysis
18+
runs-on: ubuntu-22.04
19+
timeout-minutes: 30
20+
steps:
21+
- name: Checkout wolfProvider
22+
uses: actions/checkout@v4
23+
with:
24+
fetch-depth: 1
25+
26+
- name: Install dependencies
27+
run: |
28+
sudo apt-get update
29+
sudo apt-get install -y cppcheck
30+
31+
- name: Build dependencies (OpenSSL and wolfSSL)
32+
run: |
33+
OPENSSL_TAG=openssl-3.5.4 WOLFSSL_TAG=master ./scripts/build-wolfprovider.sh 2>&1 | tail -100 || true
34+
# We only need the build to succeed enough to have headers available
35+
36+
- name: Run cppcheck
37+
run: |
38+
# Configure include paths for cppcheck
39+
OPENSSL_INC="$PWD/openssl-install/include"
40+
WOLFSSL_INC="$PWD/wolfssl-install/include"
41+
WOLFPROV_INC="$PWD/include"
42+
43+
# Run cppcheck on source files
44+
cppcheck \
45+
--enable=all \
46+
--suppress=missingIncludeSystem \
47+
--suppress=unusedFunction \
48+
--suppress=unmatchedSuppression \
49+
--inline-suppr \
50+
--force \
51+
--error-exitcode=1 \
52+
-I "$OPENSSL_INC" \
53+
-I "$WOLFSSL_INC" \
54+
-I "$WOLFPROV_INC" \
55+
--platform=unix64 \
56+
src/ test/ 2>&1 | tee cppcheck-output.txt || true
57+
58+
# Display output
59+
cat cppcheck-output.txt
60+
61+
# Fail if critical errors found (warnings won't fail the build)
62+
if grep -q "error:" cppcheck-output.txt; then
63+
echo "cppcheck found errors"
64+
exit 1
65+
fi
66+
67+
- name: Upload cppcheck results
68+
if: always()
69+
uses: actions/upload-artifact@v4
70+
with:
71+
name: cppcheck-results
72+
path: cppcheck-output.txt
73+
retention-days: 7
74+
75+
scan-build:
76+
name: clang Static Analyzer (scan-build)
77+
runs-on: ubuntu-22.04
78+
timeout-minutes: 45
79+
steps:
80+
- name: Checkout wolfProvider
81+
uses: actions/checkout@v4
82+
with:
83+
fetch-depth: 1
84+
85+
- name: Install dependencies
86+
run: |
87+
sudo apt-get update
88+
sudo apt-get install -y clang clang-tools build-essential autoconf automake libtool pkg-config
89+
90+
- name: Build dependencies (OpenSSL and wolfSSL)
91+
run: |
92+
OPENSSL_TAG=openssl-3.5.4 WOLFSSL_TAG=master ./scripts/build-wolfprovider.sh 2>&1 | tail -100 || true
93+
94+
- name: Generate configure script
95+
run: |
96+
./autogen.sh
97+
98+
- name: Configure with scan-build
99+
run: |
100+
OPENSSL_INSTALL_DIR="$PWD/openssl-install"
101+
WOLFSSL_INSTALL_DIR="$PWD/wolfssl-install"
102+
103+
scan-build -o scan-build-output \
104+
./configure \
105+
--with-openssl="$OPENSSL_INSTALL_DIR" \
106+
--with-wolfssl="$WOLFSSL_INSTALL_DIR" \
107+
--prefix="$PWD/wolfprov-install" \
108+
CC=clang
109+
110+
- name: Build with scan-build
111+
run: |
112+
scan-build -o scan-build-output \
113+
make -j$(nproc) 2>&1 | tee scan-build-log.txt || true
114+
115+
- name: Check scan-build results
116+
run: |
117+
# Find the latest scan-build report directory
118+
REPORT_DIR=$(find scan-build-output -maxdepth 1 -type d -name "scan-build-*" | sort -r | head -1)
119+
120+
if [ -z "$REPORT_DIR" ] || [ ! -d "$REPORT_DIR" ]; then
121+
echo "No scan-build report directory found"
122+
exit 0
123+
fi
124+
125+
# Count bugs found
126+
BUG_COUNT=$(find "$REPORT_DIR" -name "*.html" | wc -l)
127+
echo "scan-build found $BUG_COUNT potential issues"
128+
129+
# Display summary
130+
if [ -f "$REPORT_DIR/index.html" ]; then
131+
echo "View detailed report in scan-build-output/index.html"
132+
# Extract text summary if possible
133+
grep -o '<title>.*</title>' "$REPORT_DIR/index.html" || true
134+
fi
135+
136+
# Fail if critical bugs found (adjust threshold as needed)
137+
if [ "$BUG_COUNT" -gt 50 ]; then
138+
echo "Too many issues found by scan-build"
139+
exit 1
140+
fi
141+
142+
- name: Upload scan-build results
143+
if: always()
144+
uses: actions/upload-artifact@v4
145+
with:
146+
name: scan-build-results
147+
path: scan-build-output/
148+
retention-days: 7
149+
150+
infer:
151+
name: Facebook Infer Static Analysis
152+
runs-on: ubuntu-22.04
153+
timeout-minutes: 60
154+
steps:
155+
- name: Checkout wolfProvider
156+
uses: actions/checkout@v4
157+
with:
158+
fetch-depth: 1
159+
160+
- name: Install dependencies
161+
run: |
162+
sudo apt-get update
163+
sudo apt-get install -y build-essential autoconf automake libtool pkg-config python3 opam
164+
165+
# Install Infer
166+
VERSION=1.1.0
167+
cd /tmp
168+
wget https://github.com/facebook/infer/releases/download/v${VERSION}/infer-linux64-v${VERSION}.tar.xz
169+
tar xf infer-linux64-v${VERSION}.tar.xz
170+
sudo mv infer-linux64-v${VERSION} /opt/infer
171+
sudo ln -sf /opt/infer/bin/infer /usr/local/bin/infer
172+
173+
- name: Build dependencies (OpenSSL and wolfSSL)
174+
run: |
175+
OPENSSL_TAG=openssl-3.5.4 WOLFSSL_TAG=master ./scripts/build-wolfprovider.sh 2>&1 | tail -100 || true
176+
177+
- name: Generate configure script
178+
run: |
179+
./autogen.sh
180+
181+
- name: Configure project
182+
run: |
183+
OPENSSL_INSTALL_DIR="$PWD/openssl-install"
184+
WOLFSSL_INSTALL_DIR="$PWD/wolfssl-install"
185+
186+
./configure \
187+
--with-openssl="$OPENSSL_INSTALL_DIR" \
188+
--with-wolfssl="$WOLFSSL_INSTALL_DIR" \
189+
--prefix="$PWD/wolfprov-install" \
190+
CC=clang
191+
192+
- name: Clean build for Infer
193+
run: |
194+
make clean || true
195+
rm -rf infer-out
196+
197+
- name: Run Infer analysis
198+
run: |
199+
# Run infer on the build (it wraps the compilation)
200+
infer run -- make -j$(nproc) 2>&1 | tee infer-log.txt || true
201+
202+
# Generate text report
203+
if [ -d infer-out ]; then
204+
infer report --issues-csv infer-report.csv 2>&1 || true
205+
infer report --issues-txt infer-report.txt 2>&1 || true
206+
207+
# Display summary
208+
if [ -f infer-report.txt ]; then
209+
echo "=== Infer Analysis Summary ==="
210+
cat infer-report.txt
211+
212+
# Count issues
213+
ISSUE_COUNT=$(grep -c "Found.*issue" infer-report.txt || echo "0")
214+
echo "Infer found issues (check infer-report.txt for details)"
215+
216+
# Fail if too many critical issues (adjust threshold as needed)
217+
if [ "$ISSUE_COUNT" -gt 100 ]; then
218+
echo "Too many issues found by Infer"
219+
exit 1
220+
fi
221+
fi
222+
else
223+
echo "Infer did not produce output directory"
224+
fi
225+
226+
- name: Upload Infer results
227+
if: always()
228+
uses: actions/upload-artifact@v4
229+
with:
230+
name: infer-results
231+
path: |
232+
infer-out/
233+
infer-report.txt
234+
infer-report.csv
235+
infer-log.txt
236+
retention-days: 7
237+
if-no-files-found: ignore

0 commit comments

Comments
 (0)