Add static analysis CI (cppcheck, Sparse, Smatch)

[ymodlin]

Summary

• Adds a new static-analysis.yml GitHub Actions workflow with two parallel jobs:
  • cppcheck (~2 min): standalone C static analysis on kernel/realsense/ — catches general bugs, performance issues, and portability problems without needing the full build environment
  • Sparse & Smatch (~40 min): kernel-aware analysis that piggybacks on a JP 6.2 build — Sparse checks __user/__kernel pointer misuse and type errors, Smatch finds null derefs, use-after-free, and buffer overflows
• Triggers on PRs and pushes to master/dev when kernel/realsense/** changes, plus manual workflow_dispatch
• Non-blocking (reports findings without failing the build) — can be tightened later
• Results posted to GitHub Step Summary and uploaded as artifacts

Test plan

• Verify cppcheck job runs and reports findings on a PR touching kernel/realsense/d4xx.c
• Verify Sparse & Smatch job completes the JP 6.2 build and runs both analyzers
• Verify workflow_dispatch manual trigger works
• Verify workflow does NOT trigger on unrelated file changes
• Review findings for false positive rate and adjust suppressions if needed

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds a new GitHub Actions workflow for static analysis of the kernel driver code. The workflow introduces two parallel jobs: a quick cppcheck analysis (~2 min) for general C code issues, and a comprehensive Sparse & Smatch analysis (~40 min) that requires building the kernel to perform kernel-aware checks. The workflow is designed to be non-blocking (won't fail builds) and provides detailed reports through GitHub Step Summary and artifacts.

Changes:

• Added .github/workflows/static-analysis.yml with cppcheck and Sparse/Smatch static analysis jobs
• Configured path-based triggers to run only on kernel/realsense/** changes
• Implemented non-blocking error reporting with results uploaded as artifacts

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The actions/checkout action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository (e.g., build-jp6.2.yml:19) use the pattern actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 #v3 where the commit hash is pinned with a version comment. This prevents supply chain attacks by ensuring the exact code being executed is known.

Suggested change

	- uses: actions/checkout@v4
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

[Copilot]

The actions/upload-artifact action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository use pinned commit hashes for GitHub Actions to prevent supply chain attacks.

Suggested change

	uses: actions/upload-artifact@v4
	uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808

[Copilot]

The actions/checkout action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository use pinned commit hashes for GitHub Actions to prevent supply chain attacks.

[Copilot]

The actions/upload-artifact action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository use pinned commit hashes for GitHub Actions to prevent supply chain attacks.

Suggested change

	uses: actions/upload-artifact@v4
	uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8

[Copilot]

Cloning from the smatch repository using only --depth=1 without pinning a specific commit hash creates a security and reproducibility risk. If the repository is compromised or the HEAD commit changes, the workflow could pull in different code. Consider pinning to a specific commit hash or tag.

Suggested change

	git clone --depth=1 https://github.com/error27/smatch.git /tmp/smatch
	git clone --depth=1 --branch v1.72 https://github.com/error27/smatch.git /tmp/smatch

[Copilot]

The path filter only triggers on kernel/realsense/** changes, but the workflow itself (.github/workflows/static-analysis.yml) is not included. If you modify the workflow file, it won't run to validate the changes. Consider adding .github/workflows/static-analysis.yml to the paths filter so the workflow runs when it's modified, allowing you to test workflow changes in PRs.

Suggested change

	- 'kernel/realsense/**'
	push:
	branches: [master, dev]
	paths:
	- 'kernel/realsense/**'
	- 'kernel/realsense/**'
	- '.github/workflows/static-analysis.yml'
	push:
	branches: [master, dev]
	paths:
	- 'kernel/realsense/**'
	- '.github/workflows/static-analysis.yml'