Skip to content

Commit a381d4a

Browse files
ymodlinclaude
ymodlin
and
claude
committed
Add static analysis CI workflow (cppcheck, Sparse, Smatch)
Adds a new GitHub Actions workflow that runs three static analysis tools on kernel/realsense/ code changes: cppcheck for general C bugs, Sparse for kernel type-checking, and Smatch for deeper bug finding (null derefs, use-after-free, buffer overflows). Runs on PRs and pushes to master/dev. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 6b0383c commit a381d4a

1 file changed

Lines changed: 172 additions & 0 deletions

File tree

‎.github/workflows/static-analysis.yml‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
name: Static Analysis
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'kernel/realsense/**'
7+
push:
8+
branches: [master, dev]
9+
paths:
10+
- 'kernel/realsense/**'
11+
workflow_dispatch:
12+
13+
permissions: read-all
14+
15+
jobs:
16+
cppcheck:
17+
name: cppcheck
18+
runs-on: ubuntu-latest
19+
timeout-minutes: 10
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Install cppcheck
24+
run: sudo apt-get update && sudo apt-get install -y cppcheck
25+
26+
- name: Run cppcheck
27+
run: |
28+
cppcheck \
29+
--enable=warning,performance,portability \
30+
--suppress=missingIncludeSystem \
31+
--suppress=missingInclude \
32+
--force \
33+
--inline-suppr \
34+
--template='[{severity}] {file}:{line}: {message} [{id}]' \
35+
kernel/realsense/ 2>&1 | tee cppcheck_output.txt
36+
37+
# Generate summary
38+
TOTAL=$(grep -cE '^\[(error|warning|performance|portability)\]' cppcheck_output.txt || true)
39+
echo "## cppcheck Results" >> $GITHUB_STEP_SUMMARY
40+
echo "" >> $GITHUB_STEP_SUMMARY
41+
echo "Found **${TOTAL}** finding(s) in \`kernel/realsense/\`." >> $GITHUB_STEP_SUMMARY
42+
echo "" >> $GITHUB_STEP_SUMMARY
43+
if [ "$TOTAL" -gt 0 ]; then
44+
echo '```' >> $GITHUB_STEP_SUMMARY
45+
cat cppcheck_output.txt >> $GITHUB_STEP_SUMMARY
46+
echo '```' >> $GITHUB_STEP_SUMMARY
47+
fi
48+
49+
- name: Upload results
50+
if: always()
51+
uses: actions/upload-artifact@v4
52+
with:
53+
name: cppcheck-results
54+
path: cppcheck_output.txt
55+
56+
sparse-smatch:
57+
name: Sparse & Smatch
58+
runs-on: ubuntu-latest
59+
timeout-minutes: 90
60+
steps:
61+
- uses: actions/checkout@v4
62+
63+
- name: Install build dependencies and Sparse
64+
run: |
65+
sudo apt-get update
66+
sudo apt-get install -y \
67+
build-essential bc wget flex bison curl libssl-dev xxd \
68+
sparse \
69+
libsqlite3-dev libxml2-dev llvm pkg-config
70+
71+
- name: Build and install Smatch
72+
run: |
73+
git clone --depth=1 https://github.com/error27/smatch.git /tmp/smatch
74+
cd /tmp/smatch
75+
make -j$(nproc)
76+
sudo make PREFIX=/usr install
77+
smatch --version
78+
79+
- name: Setup workspace
80+
run: yes | ./setup_workspace.sh 6.2
81+
82+
- name: Apply patches
83+
run: |
84+
git config --global user.email "builder@example.com"
85+
git config --global user.name "builder"
86+
./apply_patches.sh 6.2
87+
88+
- name: Build kernel and modules
89+
run: ./build_all.sh 6.2
90+
91+
- name: Run Sparse on d4xx
92+
run: |
93+
DEVDIR=${{ github.workspace }}
94+
SRCS=$DEVDIR/sources_6.2
95+
export CROSS_COMPILE=$DEVDIR/l4t-gcc/6.x/bin/aarch64-buildroot-linux-gnu-
96+
KERNEL_HEADERS=$SRCS/kernel/kernel-jammy-src
97+
98+
# Delete d4xx.o to force recompilation — Sparse (C=1) only checks recompiled files
99+
rm -f $SRCS/nvidia-oot/drivers/media/i2c/d4xx.o
100+
101+
make -j$(nproc) ARCH=arm64 C=1 \
102+
-C $KERNEL_HEADERS \
103+
M=$SRCS/nvidia-oot \
104+
CONFIG_TEGRA_OOT_MODULE=m \
105+
srctree.nvidia-oot=$SRCS/nvidia-oot \
106+
srctree.hwpm=$SRCS/hwpm \
107+
srctree.nvconftest=$SRCS/out/nvidia-conftest \
108+
KBUILD_EXTRA_SYMBOLS=$SRCS/hwpm/drivers/tegra/hwpm/Module.symvers \
109+
modules 2>&1 | tee $DEVDIR/sparse_raw.txt || true
110+
111+
grep -i "d4xx" $DEVDIR/sparse_raw.txt > $DEVDIR/sparse_output.txt || true
112+
113+
- name: Run Smatch on d4xx
114+
run: |
115+
DEVDIR=${{ github.workspace }}
116+
SRCS=$DEVDIR/sources_6.2
117+
export CROSS_COMPILE=$DEVDIR/l4t-gcc/6.x/bin/aarch64-buildroot-linux-gnu-
118+
KERNEL_HEADERS=$SRCS/kernel/kernel-jammy-src
119+
120+
rm -f $SRCS/nvidia-oot/drivers/media/i2c/d4xx.o
121+
122+
make -j$(nproc) ARCH=arm64 C=1 CHECK="smatch -p=kernel" \
123+
-C $KERNEL_HEADERS \
124+
M=$SRCS/nvidia-oot \
125+
CONFIG_TEGRA_OOT_MODULE=m \
126+
srctree.nvidia-oot=$SRCS/nvidia-oot \
127+
srctree.hwpm=$SRCS/hwpm \
128+
srctree.nvconftest=$SRCS/out/nvidia-conftest \
129+
KBUILD_EXTRA_SYMBOLS=$SRCS/hwpm/drivers/tegra/hwpm/Module.symvers \
130+
modules 2>&1 | tee $DEVDIR/smatch_raw.txt || true
131+
132+
grep -i "d4xx" $DEVDIR/smatch_raw.txt > $DEVDIR/smatch_output.txt || true
133+
134+
- name: Generate summary
135+
if: always()
136+
run: |
137+
echo "## Sparse & Smatch Results" >> $GITHUB_STEP_SUMMARY
138+
echo "" >> $GITHUB_STEP_SUMMARY
139+
140+
SPARSE_COUNT=0
141+
SMATCH_COUNT=0
142+
[ -s sparse_output.txt ] && SPARSE_COUNT=$(wc -l < sparse_output.txt)
143+
[ -s smatch_output.txt ] && SMATCH_COUNT=$(wc -l < smatch_output.txt)
144+
145+
echo "| Tool | Findings |" >> $GITHUB_STEP_SUMMARY
146+
echo "|------|----------|" >> $GITHUB_STEP_SUMMARY
147+
echo "| Sparse | ${SPARSE_COUNT} |" >> $GITHUB_STEP_SUMMARY
148+
echo "| Smatch | ${SMATCH_COUNT} |" >> $GITHUB_STEP_SUMMARY
149+
echo "" >> $GITHUB_STEP_SUMMARY
150+
151+
for TOOL in sparse smatch; do
152+
FILE="${TOOL}_output.txt"
153+
if [ -s "$FILE" ]; then
154+
LABEL=$(echo "$TOOL" | sed 's/./\U&/')
155+
echo "### $LABEL Findings" >> $GITHUB_STEP_SUMMARY
156+
echo '```' >> $GITHUB_STEP_SUMMARY
157+
head -100 "$FILE" >> $GITHUB_STEP_SUMMARY
158+
echo '```' >> $GITHUB_STEP_SUMMARY
159+
echo "" >> $GITHUB_STEP_SUMMARY
160+
fi
161+
done
162+
163+
- name: Upload results
164+
if: always()
165+
uses: actions/upload-artifact@v4
166+
with:
167+
name: sparse-smatch-results
168+
path: |
169+
sparse_output.txt
170+
smatch_output.txt
171+
sparse_raw.txt
172+
smatch_raw.txt

0 commit comments

Comments
 (0)