Add static analysis CI (cppcheck, Sparse, Smatch) - #371
Conversation
Adds a new GitHub Actions workflow that runs three static analysis tools on kernel/realsense/ code changes: cppcheck for general C bugs, Sparse for kernel type-checking, and Smatch for deeper bug finding (null derefs, use-after-free, buffer overflows). Runs on PRs and pushes to master/dev. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR adds a new GitHub Actions workflow for static analysis of the kernel driver code. The workflow introduces two parallel jobs: a quick cppcheck analysis (~2 min) for general C code issues, and a comprehensive Sparse & Smatch analysis (~40 min) that requires building the kernel to perform kernel-aware checks. The workflow is designed to be non-blocking (won't fail builds) and provides detailed reports through GitHub Step Summary and artifacts.
Changes:
- Added
.github/workflows/static-analysis.ymlwith cppcheck and Sparse/Smatch static analysis jobs - Configured path-based triggers to run only on
kernel/realsense/**changes - Implemented non-blocking error reporting with results uploaded as artifacts
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
The actions/checkout action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository (e.g., build-jp6.2.yml:19) use the pattern actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 #v3 where the commit hash is pinned with a version comment. This prevents supply chain attacks by ensuring the exact code being executed is known.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 |
|
|
||
| - name: Upload results | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
The actions/upload-artifact action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository use pinned commit hashes for GitHub Actions to prevent supply chain attacks.
| uses: actions/upload-artifact@v4 | |
| uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 |
| runs-on: ubuntu-latest | ||
| timeout-minutes: 90 | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
The actions/checkout action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository use pinned commit hashes for GitHub Actions to prevent supply chain attacks.
|
|
||
| - name: Upload results | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
The actions/upload-artifact action should use a pinned commit hash instead of a version tag for security. The existing workflows in this repository use pinned commit hashes for GitHub Actions to prevent supply chain attacks.
| uses: actions/upload-artifact@v4 | |
| uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 |
|
|
||
| - name: Build and install Smatch | ||
| run: | | ||
| git clone --depth=1 https://github.com/error27/smatch.git /tmp/smatch |
There was a problem hiding this comment.
Cloning from the smatch repository using only --depth=1 without pinning a specific commit hash creates a security and reproducibility risk. If the repository is compromised or the HEAD commit changes, the workflow could pull in different code. Consider pinning to a specific commit hash or tag.
| git clone --depth=1 https://github.com/error27/smatch.git /tmp/smatch | |
| git clone --depth=1 --branch v1.72 https://github.com/error27/smatch.git /tmp/smatch |
| - 'kernel/realsense/**' | ||
| push: | ||
| branches: [master, dev] | ||
| paths: | ||
| - 'kernel/realsense/**' |
There was a problem hiding this comment.
The path filter only triggers on kernel/realsense/** changes, but the workflow itself (.github/workflows/static-analysis.yml) is not included. If you modify the workflow file, it won't run to validate the changes. Consider adding .github/workflows/static-analysis.yml to the paths filter so the workflow runs when it's modified, allowing you to test workflow changes in PRs.
| - 'kernel/realsense/**' | |
| push: | |
| branches: [master, dev] | |
| paths: | |
| - 'kernel/realsense/**' | |
| - 'kernel/realsense/**' | |
| - '.github/workflows/static-analysis.yml' | |
| push: | |
| branches: [master, dev] | |
| paths: | |
| - 'kernel/realsense/**' | |
| - '.github/workflows/static-analysis.yml' |
Summary
static-analysis.ymlGitHub Actions workflow with two parallel jobs:kernel/realsense/— catches general bugs, performance issues, and portability problems without needing the full build environment__user/__kernelpointer misuse and type errors, Smatch finds null derefs, use-after-free, and buffer overflowsmaster/devwhenkernel/realsense/**changes, plus manualworkflow_dispatchTest plan
kernel/realsense/d4xx.c🤖 Generated with Claude Code