Skip to content
Static Code Analysis

Enable additional RuboCop spacing rules (#3723) #1415

Sign in to view logs

Enable additional RuboCop spacing rules (#3723)

Enable additional RuboCop spacing rules (#3723) #1415

Workflow file for this run

.github/workflows/sca.yml at 94f78a1
name: "Static Code Analysis"
on:
push:
branches: ["master"]
pull_request:
branches: ["*"]
workflow_dispatch:
env:
BUILD_DEPS: automake bison flex git libboost-all-dev libevent-dev libssl-dev libtool make pkg-config
# Disable all languages for which we don't have SCA checks in place
CONFIG_ARGS_FOR_SCA: >
--enable-tutorial=no
--disable-debug
--disable-tests
--disable-dependency-tracking
--without-java
--without-kotlin
--without-netstd
--without-nodejs
--without-nodets
--without-go
--without-dart
--without-erlang
--without-haxe
--without-ruby
--without-rs
--without-lua
--without-perl
--without-d
--without-cl
permissions:
contents: read
jobs:
compiler:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS
- name: Build compiler
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
make -j"$(nproc)" -C compiler/cpp
- name: Run thrift-compiler
run: compiler/cpp/thrift -version
- name: Archive built thrift compiler
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: thrift-compiler
path: compiler/cpp/thrift
retention-days: 3
compiler-cpp:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck
- name: Configure
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
- name: Run cppcheck
run: |
# Compiler cppcheck (All)
cppcheck --force --quiet --inline-suppr --enable=all -j2 compiler/cpp/src
# Silent error checks
# See THRIFT-4371: flex generated scanner code causes false positives in cppcheck.
# suppress *:thrift/thriftl.cc -> flex-generated lexer triggers false null pointer paths.
# suppress syntaxError:thrift/thrifty.cc -> bison-generated parser is not fully parseable.
# suppress normalCheckLevelMaxBranches:compiler/cpp/src/* -> avoid info-only branch limit noise.
# suppress danglingTempReference:.../t_cpp_generator.cc -> ternary between
# derived (ofstream_with_content_based_conditional_update) and base (ostream)
# lvalues is valid, not dangling.
cppcheck --force --quiet --inline-suppr \
--suppress="*:thrift/thriftl.cc" \
--suppress="syntaxError:thrift/thrifty.cc" \
--suppress="normalCheckLevelMaxBranches:compiler/cpp/src/*" \
--suppress="danglingTempReference:compiler/cpp/src/thrift/generate/t_cpp_generator.cc" \
-I compiler/cpp/src \
--error-exitcode=1 -j2 compiler/cpp/src
lib-cpp:
needs: compiler
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck libglib2.0-dev
- name: Configure
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: thrift-compiler
path: compiler/cpp
- name: Run thrift-compiler
run: |
chmod a+x compiler/cpp/thrift
compiler/cpp/thrift -version
- name: Generate C/C++ thrift files
run: |
make -j"$(nproc)" -C lib/cpp
make -j"$(nproc)" -C test/cpp precross
make -j"$(nproc)" -C lib/c_glib
make -j"$(nproc)" -C test/c_glib precross
- name: Run cppcheck
run: |
# C++ cppcheck (All)
cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp
# C Glib cppcheck (All)
cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib
# suppress unknownMacro:lib/cpp/src/thrift/qt/* -> Qt namespace macro needs Qt preprocessing.
# suppress unknownMacro:lib/cpp/test/* -> Boost.Test macros are unresolved in standalone analysis.
# suppress syntaxError:lib/cpp/src/thrift/transport/TSSLSocket.cpp -> OpenSSL macro branches confuse parser.
# suppress normalCheckLevelMaxBranches:* -> avoid info-only branch limit noise.
# exclude lib/cpp/test/gen-cpp and test/cpp/gen-* -> generated fixtures duplicate source/test coverage.
cppcheck --force --quiet --inline-suppr \
--suppress="unknownMacro:lib/cpp/src/thrift/qt/*" \
--suppress="unknownMacro:lib/cpp/test/*" \
--suppress="syntaxError:lib/cpp/src/thrift/transport/TSSLSocket.cpp" \
--suppress="normalCheckLevelMaxBranches:lib/cpp/src/*" \
--suppress="normalCheckLevelMaxBranches:lib/cpp/test/*" \
--suppress="normalCheckLevelMaxBranches:test/cpp/*" \
--suppress="normalCheckLevelMaxBranches:tutorial/cpp/*" \
-i lib/cpp/test/gen-cpp \
-i test/cpp/gen-cpp \
-i test/cpp/gen-cpp-forward \
-i test/cpp/gen-cpp-private \
-i test/cpp/gen-cpp-enumclass \
--error-exitcode=1 -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp
# suppress unknownMacro:lib/c_glib/src/* -> GObject type macros are unresolved in standalone analysis.
# suppress unknownMacro:lib/c_glib/test/* -> test-side GLib macros are unresolved without full preprocess.
# suppress syntaxError:lib/c_glib/test/* -> GLib assert macros parse as syntax errors.
# suppress normalCheckLevelMaxBranches:* -> avoid info-only branch limit noise.
# exclude lib/c_glib/test/gen-c_glib -> generated bindings are covered by generator output checks.
# exclude lib/c_glib/test/gen-cpp -> generated skeleton has placeholder methods without returns.
cppcheck --force --quiet --inline-suppr \
--suppress="unknownMacro:lib/c_glib/src/*" \
--suppress="unknownMacro:lib/c_glib/test/*" \
--suppress="syntaxError:lib/c_glib/test/*" \
--suppress="normalCheckLevelMaxBranches:lib/c_glib/src/*" \
--suppress="normalCheckLevelMaxBranches:lib/c_glib/test/*" \
--suppress="normalCheckLevelMaxBranches:test/c_glib/*" \
--suppress="normalCheckLevelMaxBranches:tutorial/c_glib/*" \
-i lib/c_glib/test/gen-c_glib \
-i lib/c_glib/test/gen-cpp \
--error-exitcode=1 -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib
lib-go:
needs: compiler
runs-on: ubuntu-24.04
strategy:
matrix:
go:
- '1.26'
fail-fast: false
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: ${{ matrix.go }}
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS
- name: Configure
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $(echo $CONFIG_ARGS_FOR_SCA | sed 's/without-go/with-go/')
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: thrift-compiler
path: compiler/cpp
- name: Run gofmt on checked-in Go files
# Args:
# -s: Simplify code
# -l: List files that would change
# -e: Report all errors instead of only the first 10
run: |
git ls-files '*.go' > /tmp/go-files.txt
xargs -r gofmt -s -l -e < /tmp/go-files.txt > /tmp/gofmt-files.txt
cat /tmp/gofmt-files.txt
test ! -s /tmp/gofmt-files.txt
- name: Run gofmt on generated Go files
run: |
chmod a+x compiler/cpp/thrift
thrift_compiler="$PWD/compiler/cpp/thrift"
make -C lib/go/test THRIFT="$thrift_compiler" gopath
make -C test/go THRIFT="$thrift_compiler" gopath
make -C tutorial/go THRIFT="$thrift_compiler" all-local
{
find lib/go/test/gopath/src \
-path lib/go/test/gopath/src/dontexportrwtest -prune -o \
-name '*.go' -type f -print
find test/go/src/gen tutorial/go/gen-go -name '*.go' -type f -print
} > /tmp/generated-go-files.txt
xargs -r gofmt -l -e < /tmp/generated-go-files.txt > /tmp/generated-gofmt-files.txt
cat /tmp/generated-gofmt-files.txt
test ! -s /tmp/generated-gofmt-files.txt
lib-python:
needs: compiler
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.12"
- name: Install Python test dependencies
run: |
python -m pip install --upgrade pip setuptools wheel flake8
- name: Configure
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: thrift-compiler
path: compiler/cpp
- name: Generate Python thrift files
run: |
chmod a+x compiler/cpp/thrift
compiler/cpp/thrift -version
make -j"$(nproc)" -C test/py precross
- name: Run flake8
run: flake8
lib-php:
needs: compiler
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS
- name: Set up PHP
uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
with:
# Lowest supported PHP version
php-version: "8.1"
extensions: xml, curl, pcntl
- name: Configure
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: thrift-compiler
path: compiler/cpp
- name: Generate PHP thrift files
run: |
chmod a+x compiler/cpp/thrift
compiler/cpp/thrift -version
make -j"$(nproc)" -C lib/php/test stubs
make -j"$(nproc)" -C test/php precross
- name: Run phpcs
run: |
composer install --quiet
./vendor/bin/phpcs
- name: Run phpstan
run: |
./vendor/bin/phpstan analyse -c lib/php/phpstan.neon --no-progress --error-format=github
lib-perl:
needs: compiler
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS libperl-critic-perl
- name: Configure
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: thrift-compiler
path: compiler/cpp
- name: Generate Perl thrift files
run: |
chmod a+x compiler/cpp/thrift
compiler/cpp/thrift -version
make -j"$(nproc)" -C lib/perl precross
make -j"$(nproc)" -C test/perl precross
make -j"$(nproc)" -C tutorial/perl
- name: Run perlcritic
run: |
find lib/perl test/perl tutorial/perl test/audit -iname '*.p[lm]' -type f \
! -path 'lib/perl/blib/*' \
! -path 'lib/perl/t/*' \
-print0 | xargs -0 perlcritic
lib-ruby:
needs: compiler
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install dependencies
run: |
sudo apt-get update -yq
# shellcheck disable=SC2086
sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck
- name: Set up Ruby
uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
with:
ruby-version: "2.7"
bundler-cache: true
working-directory: "lib/rb"
- name: Configure
run: |
./bootstrap.sh
# shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: thrift-compiler
path: compiler/cpp
- name: Generate Ruby thrift files
run: |
chmod a+x compiler/cpp/thrift
compiler/cpp/thrift -version
make -j"$(nproc)" -C test/rb precross
make -j"$(nproc)" -C tutorial/rb
- name: Run cppcheck
run: |
# Ruby C extension error checks
# suppress missingIncludeSystem:lib/rb/ext/* -> Ruby and libc headers are not needed for analysis.
# suppress checkersReport -> hide info-only active-checker summary.
# Use -j1 with a build dir: build-dir avoids a large staticFunction false-positive set in serial scans,
# and -j1 avoids the -j2 whole-program path where Init_thrift_native's inline unusedFunction suppression misbinds.
mkdir -p /tmp/cppcheck-rb-ext
cppcheck --force --quiet --inline-suppr --enable=all \
-j1 --cppcheck-build-dir=/tmp/cppcheck-rb-ext \
-I lib/rb/ext \
--library=ruby \
--suppress="missingIncludeSystem:lib/rb/ext/*" \
--suppress="checkersReport" \
--check-level=exhaustive \
--error-exitcode=1 lib/rb/ext
- name: Run rubocop
working-directory: "lib/rb"
run: |
bundle exec rake gen-rb
bundle exec rubocop --config .rubocop.yml --format progress --format github . ../../test/rb ../../tutorial/rb
statistics:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: "1.25"
- name: Install scc
run: |
go install github.com/boyter/scc/v3@v3.6.0
- name: Print statistics
run: |
# TODO etc
echo "FIXMEs: $(grep -r FIXME -- * | wc -l)"
echo "HACKs: $(grep -r HACK -- * | wc -l)"
echo "TODOs: $(grep -r TODO -- * | wc -l)"
# LoC
scc .
# System info
# dpkg -l
uname -a
zizmor:
runs-on: ubuntu-24.04
permissions:
security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
contents: read # Only needed for private repos. Needed to clone the repo.
actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Run zizmor
uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1