Enable additional RuboCop spacing rules #1413

Workflow file for this run

	name: "Static Code Analysis"

	on:
	push:
	branches: ["master"]
	pull_request:
	branches: ["*"]
	workflow_dispatch:

	env:
	BUILD_DEPS: automake bison flex git libboost-all-dev libevent-dev libssl-dev libtool make pkg-config
	# Disable all languages for which we don't have SCA checks in place
	CONFIG_ARGS_FOR_SCA: >
	--enable-tutorial=no
	--disable-debug
	--disable-tests
	--disable-dependency-tracking
	--without-java
	--without-kotlin
	--without-netstd
	--without-nodejs
	--without-nodets
	--without-go
	--without-dart
	--without-erlang
	--without-haxe
	--without-ruby
	--without-rs
	--without-lua
	--without-perl
	--without-d
	--without-cl

	permissions:
	contents: read

	jobs:
	compiler:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS

	- name: Build compiler
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $CONFIG_ARGS_FOR_SCA
	make -j"$(nproc)" -C compiler/cpp

	- name: Run thrift-compiler
	run: compiler/cpp/thrift -version

	- name: Archive built thrift compiler
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: thrift-compiler
	path: compiler/cpp/thrift
	retention-days: 3

	compiler-cpp:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck

	- name: Configure
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $CONFIG_ARGS_FOR_SCA

	- name: Run cppcheck
	run: \|
	# Compiler cppcheck (All)
	cppcheck --force --quiet --inline-suppr --enable=all -j2 compiler/cpp/src

	# Silent error checks
	# See THRIFT-4371: flex generated scanner code causes false positives in cppcheck.
	# suppress *:thrift/thriftl.cc -> flex-generated lexer triggers false null pointer paths.
	# suppress syntaxError:thrift/thrifty.cc -> bison-generated parser is not fully parseable.
	# suppress normalCheckLevelMaxBranches:compiler/cpp/src/* -> avoid info-only branch limit noise.
	# suppress danglingTempReference:.../t_cpp_generator.cc -> ternary between
	# derived (ofstream_with_content_based_conditional_update) and base (ostream)
	# lvalues is valid, not dangling.
	cppcheck --force --quiet --inline-suppr \
	--suppress="*:thrift/thriftl.cc" \
	--suppress="syntaxError:thrift/thrifty.cc" \
	--suppress="normalCheckLevelMaxBranches:compiler/cpp/src/*" \
	--suppress="danglingTempReference:compiler/cpp/src/thrift/generate/t_cpp_generator.cc" \
	-I compiler/cpp/src \
	--error-exitcode=1 -j2 compiler/cpp/src

	lib-cpp:
	needs: compiler
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck libglib2.0-dev

	- name: Configure
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $CONFIG_ARGS_FOR_SCA

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: thrift-compiler
	path: compiler/cpp

	- name: Run thrift-compiler
	run: \|
	chmod a+x compiler/cpp/thrift
	compiler/cpp/thrift -version

	- name: Generate C/C++ thrift files
	run: \|
	make -j"$(nproc)" -C lib/cpp
	make -j"$(nproc)" -C test/cpp precross

	make -j"$(nproc)" -C lib/c_glib
	make -j"$(nproc)" -C test/c_glib precross

	- name: Run cppcheck
	run: \|
	# C++ cppcheck (All)
	cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp

	# C Glib cppcheck (All)
	cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib

	# suppress unknownMacro:lib/cpp/src/thrift/qt/* -> Qt namespace macro needs Qt preprocessing.
	# suppress unknownMacro:lib/cpp/test/* -> Boost.Test macros are unresolved in standalone analysis.
	# suppress syntaxError:lib/cpp/src/thrift/transport/TSSLSocket.cpp -> OpenSSL macro branches confuse parser.
	# suppress normalCheckLevelMaxBranches:* -> avoid info-only branch limit noise.
	# exclude lib/cpp/test/gen-cpp and test/cpp/gen-* -> generated fixtures duplicate source/test coverage.
	cppcheck --force --quiet --inline-suppr \
	--suppress="unknownMacro:lib/cpp/src/thrift/qt/*" \
	--suppress="unknownMacro:lib/cpp/test/*" \
	--suppress="syntaxError:lib/cpp/src/thrift/transport/TSSLSocket.cpp" \
	--suppress="normalCheckLevelMaxBranches:lib/cpp/src/*" \
	--suppress="normalCheckLevelMaxBranches:lib/cpp/test/*" \
	--suppress="normalCheckLevelMaxBranches:test/cpp/*" \
	--suppress="normalCheckLevelMaxBranches:tutorial/cpp/*" \
	-i lib/cpp/test/gen-cpp \
	-i test/cpp/gen-cpp \
	-i test/cpp/gen-cpp-forward \
	-i test/cpp/gen-cpp-private \
	-i test/cpp/gen-cpp-enumclass \
	--error-exitcode=1 -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp

	# suppress unknownMacro:lib/c_glib/src/* -> GObject type macros are unresolved in standalone analysis.
	# suppress unknownMacro:lib/c_glib/test/* -> test-side GLib macros are unresolved without full preprocess.
	# suppress syntaxError:lib/c_glib/test/* -> GLib assert macros parse as syntax errors.
	# suppress normalCheckLevelMaxBranches:* -> avoid info-only branch limit noise.
	# exclude lib/c_glib/test/gen-c_glib -> generated bindings are covered by generator output checks.
	# exclude lib/c_glib/test/gen-cpp -> generated skeleton has placeholder methods without returns.
	cppcheck --force --quiet --inline-suppr \
	--suppress="unknownMacro:lib/c_glib/src/*" \
	--suppress="unknownMacro:lib/c_glib/test/*" \
	--suppress="syntaxError:lib/c_glib/test/*" \
	--suppress="normalCheckLevelMaxBranches:lib/c_glib/src/*" \
	--suppress="normalCheckLevelMaxBranches:lib/c_glib/test/*" \
	--suppress="normalCheckLevelMaxBranches:test/c_glib/*" \
	--suppress="normalCheckLevelMaxBranches:tutorial/c_glib/*" \
	-i lib/c_glib/test/gen-c_glib \
	-i lib/c_glib/test/gen-cpp \
	--error-exitcode=1 -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib

	lib-go:
	needs: compiler
	runs-on: ubuntu-24.04
	strategy:
	matrix:
	go:
	- '1.26'
	fail-fast: false
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
	with:
	go-version: ${{ matrix.go }}

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS

	- name: Configure
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $(echo $CONFIG_ARGS_FOR_SCA \| sed 's/without-go/with-go/')

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: thrift-compiler
	path: compiler/cpp

	- name: Run gofmt on checked-in Go files
	# Args:
	# -s: Simplify code
	# -l: List files that would change
	# -e: Report all errors instead of only the first 10
	run: \|
	git ls-files '*.go' > /tmp/go-files.txt
	xargs -r gofmt -s -l -e < /tmp/go-files.txt > /tmp/gofmt-files.txt
	cat /tmp/gofmt-files.txt
	test ! -s /tmp/gofmt-files.txt

	- name: Run gofmt on generated Go files
	run: \|
	chmod a+x compiler/cpp/thrift
	thrift_compiler="$PWD/compiler/cpp/thrift"

	make -C lib/go/test THRIFT="$thrift_compiler" gopath
	make -C test/go THRIFT="$thrift_compiler" gopath
	make -C tutorial/go THRIFT="$thrift_compiler" all-local

	{
	find lib/go/test/gopath/src \
	-path lib/go/test/gopath/src/dontexportrwtest -prune -o \
	-name '*.go' -type f -print
	find test/go/src/gen tutorial/go/gen-go -name '*.go' -type f -print
	} > /tmp/generated-go-files.txt

	xargs -r gofmt -l -e < /tmp/generated-go-files.txt > /tmp/generated-gofmt-files.txt
	cat /tmp/generated-gofmt-files.txt
	test ! -s /tmp/generated-gofmt-files.txt

	lib-python:
	needs: compiler
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS

	- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: "3.12"

	- name: Install Python test dependencies
	run: \|
	python -m pip install --upgrade pip setuptools wheel flake8

	- name: Configure
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $CONFIG_ARGS_FOR_SCA

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: thrift-compiler
	path: compiler/cpp

	- name: Generate Python thrift files
	run: \|
	chmod a+x compiler/cpp/thrift
	compiler/cpp/thrift -version
	make -j"$(nproc)" -C test/py precross

	- name: Run flake8
	run: flake8

	lib-php:
	needs: compiler
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS

	- name: Set up PHP
	uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
	with:
	# Lowest supported PHP version
	php-version: "8.1"
	extensions: xml, curl, pcntl

	- name: Configure
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $CONFIG_ARGS_FOR_SCA

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: thrift-compiler
	path: compiler/cpp

	- name: Generate PHP thrift files
	run: \|
	chmod a+x compiler/cpp/thrift
	compiler/cpp/thrift -version
	make -j"$(nproc)" -C lib/php/test stubs
	make -j"$(nproc)" -C test/php precross

	- name: Run phpcs
	run: \|
	composer install --quiet
	./vendor/bin/phpcs

	- name: Run phpstan
	run: \|
	./vendor/bin/phpstan analyse -c lib/php/phpstan.neon --no-progress --error-format=github

	lib-perl:
	needs: compiler
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS libperl-critic-perl

	- name: Configure
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $CONFIG_ARGS_FOR_SCA

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: thrift-compiler
	path: compiler/cpp

	- name: Generate Perl thrift files
	run: \|
	chmod a+x compiler/cpp/thrift
	compiler/cpp/thrift -version
	make -j"$(nproc)" -C lib/perl precross
	make -j"$(nproc)" -C test/perl precross
	make -j"$(nproc)" -C tutorial/perl

	- name: Run perlcritic
	run: \|
	find lib/perl test/perl tutorial/perl test/audit -iname '*.p[lm]' -type f \
	! -path 'lib/perl/blib/*' \
	! -path 'lib/perl/t/*' \
	-print0 \| xargs -0 perlcritic

	lib-ruby:
	needs: compiler
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install dependencies
	run: \|
	sudo apt-get update -yq
	# shellcheck disable=SC2086
	sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck

	- name: Set up Ruby
	uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
	with:
	ruby-version: "2.7"
	bundler-cache: true
	working-directory: "lib/rb"

	- name: Configure
	run: \|
	./bootstrap.sh
	# shellcheck disable=SC2086
	./configure $CONFIG_ARGS_FOR_SCA

	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: thrift-compiler
	path: compiler/cpp

	- name: Generate Ruby thrift files
	run: \|
	chmod a+x compiler/cpp/thrift
	compiler/cpp/thrift -version
	make -j"$(nproc)" -C test/rb precross
	make -j"$(nproc)" -C tutorial/rb

	- name: Run cppcheck
	run: \|
	# Ruby C extension error checks
	# suppress missingIncludeSystem:lib/rb/ext/* -> Ruby and libc headers are not needed for analysis.
	# suppress checkersReport -> hide info-only active-checker summary.
	# Use -j1 with a build dir: build-dir avoids a large staticFunction false-positive set in serial scans,
	# and -j1 avoids the -j2 whole-program path where Init_thrift_native's inline unusedFunction suppression misbinds.
	mkdir -p /tmp/cppcheck-rb-ext
	cppcheck --force --quiet --inline-suppr --enable=all \
	-j1 --cppcheck-build-dir=/tmp/cppcheck-rb-ext \
	-I lib/rb/ext \
	--library=ruby \
	--suppress="missingIncludeSystem:lib/rb/ext/*" \
	--suppress="checkersReport" \
	--check-level=exhaustive \
	--error-exitcode=1 lib/rb/ext

	- name: Run rubocop
	working-directory: "lib/rb"
	run: \|
	bundle exec rake gen-rb
	bundle exec rubocop --config .rubocop.yml --format progress --format github . ../../test/rb ../../tutorial/rb

	statistics:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
	with:
	go-version: "1.25"

	- name: Install scc
	run: \|
	go install github.com/boyter/scc/v3@v3.6.0

	- name: Print statistics
	run: \|
	# TODO etc
	echo "FIXMEs: $(grep -r FIXME -- * \| wc -l)"
	echo "HACKs: $(grep -r HACK -- * \| wc -l)"
	echo "TODOs: $(grep -r TODO -- * \| wc -l)"

	# LoC
	scc .

	# System info
	# dpkg -l
	uname -a

	zizmor:
	runs-on: ubuntu-24.04
	permissions:
	security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
	contents: read # Only needed for private repos. Needed to clone the repo.
	actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
	steps:
	- name: Checkout repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Run zizmor
	uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1

Navigation Menu

Uh oh!

Enable additional RuboCop spacing rules #1413

Workflow file

Enable additional RuboCop spacing rules #1413

Uh oh!

Workflow file for this run