static-analysis.yml

name: Static Analysis

on:
  push:
    branches: [ main, phase-* ]
  pull_request:
    branches: [ main ]

jobs:
  clang-tidy:
    name: Clang-Tidy Analysis
    runs-on: ubuntu-24.04

    steps:
    - name: Checkout database_system
      uses: actions/checkout@v6
      with:
        submodules: recursive

    - name: Checkout common_system
      uses: actions/checkout@v6
      with:
        repository: kcenon/common_system
        path: common_system
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Install dependencies
      run: |
        sudo apt-get update
        # Use Clang 18 and clang-tidy-18 for full C++20 std::format support
        sudo apt-get install -y cmake ninja-build clang-18 clang-tidy-18 libgtest-dev libgmock-dev

    - name: Build and install common_system
      run: |
        cd common_system
        cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -DUSE_UNIT_TEST=OFF \
          -DCMAKE_C_COMPILER=clang-18 -DCMAKE_CXX_COMPILER=clang++-18
        cmake --build build --config Release
        sudo cmake --install build --prefix /usr/local

    - name: Configure CMake
      run: |
        cmake -B build -G Ninja \
          -DCMAKE_BUILD_TYPE=Debug \
          -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
          -DCMAKE_CXX_COMPILER=clang++-18 \
          -DCMAKE_C_COMPILER=clang-18 \
          -DUSE_UNIT_TEST=OFF \
          -DBUILD_DATABASE_SAMPLES=OFF \
          -DALLOW_BUILD_WITHOUT_NETWORK_SYSTEM=ON \
          -DUSE_POSTGRESQL=OFF \
          -DUSE_SQLITE=OFF

    - name: Run clang-tidy
      continue-on-error: true  # Phase 0: Allow failures, collect baseline
      run: |
        # Find all C++ source and header files in database directory
        # Use clang-tidy-18 for full C++20 std::format support
        find database -name "*.h" -o -name "*.hpp" | while read file; do
          echo "Analyzing: $file"
          clang-tidy-18 "$file" -p=build -- -std=c++20 || true
        done > clang-tidy-results.txt 2>&1

    - name: Count warnings by category
      if: always()
      run: |
        echo "## Clang-Tidy Warning Summary" > clang-tidy-summary.md
        echo "" >> clang-tidy-summary.md
        echo "Phase 0 Baseline - $(date +%Y-%m-%d)" >> clang-tidy-summary.md
        echo "" >> clang-tidy-summary.md

        if [ -f clang-tidy-results.txt ]; then
          # Count total warnings
          TOTAL=$(grep -c "warning:" clang-tidy-results.txt || echo "0")
          echo "Total warnings: $TOTAL" >> clang-tidy-summary.md
          echo "" >> clang-tidy-summary.md

          # Count by category
          echo "### Warnings by Category" >> clang-tidy-summary.md
          grep "warning:" clang-tidy-results.txt | \
            sed 's/.*\[\(.*\)\]/\1/' | \
            sort | uniq -c | sort -rn >> clang-tidy-summary.md || true
        else
          echo "No warnings file generated" >> clang-tidy-summary.md
        fi

        cat clang-tidy-summary.md

    - name: Upload analysis results
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: clang-tidy-baseline
        path: |
          clang-tidy-results.txt
          clang-tidy-summary.md
        retention-days: 90  # Keep baseline for reference

    - name: Add summary to job
      if: always()
      run: |
        if [ -f clang-tidy-summary.md ]; then
          cat clang-tidy-summary.md >> $GITHUB_STEP_SUMMARY
        fi

  cppcheck:
    name: Cppcheck Analysis
    runs-on: ubuntu-24.04

    steps:
    - name: Checkout code
      uses: actions/checkout@v6
      with:
        submodules: recursive

    - name: Install cppcheck
      run: |
        sudo apt-get update
        sudo apt-get install -y cppcheck

    - name: Run cppcheck
      continue-on-error: true  # Phase 0: Allow failures, collect baseline
      run: |
        cppcheck --enable=all \
          --std=c++20 \
          --suppress=missingIncludeSystem \
          --suppress=unusedFunction \
          --suppress=unmatchedSuppression \
          --inline-suppr \
          --xml \
          --xml-version=2 \
          -I database \
          database 2> cppcheck-results.xml || true

    - name: Generate cppcheck report
      if: always()
      run: |
        echo "## Cppcheck Analysis Summary" > cppcheck-summary.md
        echo "" >> cppcheck-summary.md
        echo "Phase 0 Baseline - $(date +%Y-%m-%d)" >> cppcheck-summary.md
        echo "" >> cppcheck-summary.md

        if [ -f cppcheck-results.xml ]; then
          # Count errors by severity
          echo "### Issues by Severity" >> cppcheck-summary.md
          grep -oP 'severity="\K[^"]+' cppcheck-results.xml | \
            sort | uniq -c | sort -rn >> cppcheck-summary.md || true
        else
          echo "No cppcheck results generated" >> cppcheck-summary.md
        fi

        cat cppcheck-summary.md

    - name: Upload cppcheck results
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: cppcheck-baseline
        path: |
          cppcheck-results.xml
          cppcheck-summary.md
        retention-days: 90

    - name: Add summary to job
      if: always()
      run: |
        if [ -f cppcheck-summary.md ]; then
          cat cppcheck-summary.md >> $GITHUB_STEP_SUMMARY
        fi