options: accept --max-alloc=0 again, resolved to the parser's own cei… #343
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: rsync scan-build (clang analyzer) | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| on: | |
| push: | |
| branches: [ master ] | |
| paths-ignore: | |
| - '.github/workflows/*.yml' | |
| - '!.github/workflows/scan-build.yml' | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| paths-ignore: | |
| - '.github/workflows/*.yml' | |
| - '!.github/workflows/scan-build.yml' | |
| workflow_dispatch: | |
| jobs: | |
| # GATING run: pinned clang-18 on a pinned runner so the checker set -- and | |
| # thus the expected zero -- is deterministic. The tree is kept clean for | |
| # clang-18, so --status-bugs (non-zero exit on any report) fails the build | |
| # when a new finding appears. Pin both the analyzer (clang-18/clang-tools-18) | |
| # and the runner (ubuntu-24.04, whose apt repos carry those packages). | |
| gate-clang18: | |
| runs-on: ubuntu-24.04 | |
| name: scan-build gate (clang-18, pinned) | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: prep | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y clang-18 clang-tools-18 acl libacl1-dev attr libattr1-dev liblz4-dev libzstd-dev libxxhash-dev libidn2-dev libpopt-dev openssl | |
| - name: configure (under scan-build) | |
| # Run configure under scan-build so its analyzer compiler-wrapper is baked | |
| # into the Makefile's $(CC); --disable-md2man avoids the doc toolchain. | |
| run: scan-build-18 ./configure --with-rrsync --disable-md2man | |
| - name: scan-build (gating) | |
| # --status-bugs makes scan-build exit non-zero if it finds ANY report. | |
| # pipefail + 'exit $status' propagate that through the tee so the job goes | |
| # red while still printing the summary; the report uploads for triage. | |
| run: | | |
| set -o pipefail | |
| status=0 | |
| scan-build-18 --status-bugs -o "$PWD/scan-report" make check-progs -j"$(nproc)" 2>&1 | tee scan-build.out || status=$? | |
| echo '## scan-build gate (clang-18)' >>"$GITHUB_STEP_SUMMARY" | |
| grep -E 'scan-build: .* bugs? found|scan-build: No bugs found' scan-build.out >>"$GITHUB_STEP_SUMMARY" || true | |
| exit $status | |
| - name: upload report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: scan-build-report-clang18 | |
| path: scan-report | |
| if-no-files-found: ignore | |
| # INFORMATIONAL run: whatever clang ubuntu-latest currently ships. Newer | |
| # clang releases enable extra, FP-heavy checkers (e.g. unix.Chroot | |
| # "no chdir after chroot", alpha.unix.Stream) that the gate deliberately | |
| # avoids, so this is NOT a gate (no --status-bugs). It surfaces what the | |
| # newest analyzer sees -- useful for spotting genuine new findings before a | |
| # gate bump -- without blocking merges. continue-on-error keeps a noisy or | |
| # broken run from affecting the workflow's required status. | |
| informational-latest: | |
| runs-on: ubuntu-latest | |
| name: scan-build (latest clang, informational) | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: prep | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y clang clang-tools acl libacl1-dev attr libattr1-dev liblz4-dev libidn2-dev libzstd-dev libxxhash-dev libpopt-dev openssl | |
| - name: configure (under scan-build) | |
| run: scan-build ./configure --with-rrsync --disable-md2man | |
| - name: scan-build (informational) | |
| run: | | |
| scan-build -o "$PWD/scan-report" make check-progs -j"$(nproc)" 2>&1 | tee scan-build.out | |
| echo '## scan-build informational (latest clang)' >>"$GITHUB_STEP_SUMMARY" | |
| grep -E 'scan-build: .* bugs? found|scan-build: No bugs found' scan-build.out >>"$GITHUB_STEP_SUMMARY" || true | |
| - name: upload report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: scan-build-report-latest | |
| path: scan-report | |
| if-no-files-found: ignore |