ci fixes

Author: vanhauser-thc

.github/workflows/tests.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        llvm: ["21"]
+        llvm: ["21", "22", "23"]
     env:
       LLVM_MAJOR: ${{ matrix.llvm }}
     steps:
@@ -32,7 +32,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: stable
+          go-version: "1.22.2"
 
       - name: Install LLVM ${{ matrix.llvm }}
         run: |
@@ -42,7 +42,7 @@ jobs:
           sudo apt-get install -y "llvm-$LLVM_MAJOR-dev" "clang-$LLVM_MAJOR"
 
       - name: Install gllvm
-        run: go install github.com/SRI-CSL/gllvm/cmd/...@latest
+        run: go install github.com/SRI-CSL/gllvm/cmd/...@v1.3.1
 
       - name: Install Rust nightly + rust-src
         run: |
@@ -59,3 +59,21 @@ jobs:
 
       - name: Build analyzer and run tests
         run: make test LLVM_MAJOR="$LLVM_MAJOR"
+
+      - name: Run detected LLVM matrix
+        run: make matrix LLVM_MAJOR="$LLVM_MAJOR"
+
+      - name: Run full C and Rust CLI paths
+        if: matrix.llvm == '23'
+        run: |
+          REACHABILITY_ANALYZER="$PWD/analyzer/build/reachability-analyzer" \
+            .venv/bin/python -m pytest \
+            driver/tests/test_cli.py::test_run_c_direct \
+            driver/tests/test_cli.py::test_run_rust_end_to_end \
+            driver/tests/test_cli.py::test_run_mixed_end_to_end -q
+
+      - name: Run reproducible static checks
+        if: matrix.llvm == '23'
+        run: |
+          sudo apt-get install -y cppcheck clang-tools-23
+          make compdb static-analysis LLVM_MAJOR="$LLVM_MAJOR"

.gitignore

@@ -1,5 +1,7 @@
 # build artifacts
 analyzer/build/
+analyzer/compile_commands.json
+.reachability-cache/
 **/*.bc
 **/*.o
 **/target/

Changelog.md

@@ -1,4 +1,57 @@
 ### v1.1-dev
+- Analyzer soundness: callback value-flow now follows every indexed store into
+  globals, aggregates, stack objects, loads, and heap-returned objects; alias and
+  pointer-cast chains use one cycle-safe callable resolver; callback-like operand
+  bundles and defined personality functions contribute call-graph edges.
+- Indirect resolution keeps exact function types as its precise path but unions
+  address-flow-proven type-punned targets and conservatively widens unresolved
+  cast provenance. Address-taken declarations use the same policy and appear as
+  reached opaque leaves in `external_declarations` without changing defined-body
+  metrics.
+- New default-off `--include-process-lifecycle-roots` option adds constructors,
+  destructors, ifunc resolvers, and a defined `LLVMFuzzerInitialize` as roots.
+  Selected roots appear in `entries`; malformed records and unresolved explicit
+  entries are always visible as warnings.
+- Confidence evidence is now entry-relative. Unreachable code can no longer
+  raise an indirectly reached decoy from `low` to `medium` confidence.
+- Analyzer robustness: invalid-UTF-8 symbols are replaced safely in JSON/DOT,
+  the LLVM debug-info option lookup is type-checked, and deterministic DOT output
+  contains the same reachable defined-function subgraph as JSON edges.
+- Output destinations are file-only, collision-checked through symlinks, and
+  validated before cleanup. JSON, lists, and optional DOT are staged beside
+  their destinations and published transactionally; failed or concurrent runs
+  cannot expose mixed output sets or share extraction/link intermediates.
+- `--clean` no longer recursively deletes project-wide `*.o`, `*.bc`, or
+  manifests. It removes selected output files and C/C++ artifacts recorded in
+  `.reachability-cache/owned-c-artifacts.json`, while retaining unrelated files.
+- An explicit `--artifact` is now a strict contract: missing, unsupported, or
+  unextractable paths fail rather than triggering discovery. Automatic discovery
+  has no first-eight limit and rejects equally plausible candidates with a
+  ranked list.
+- Static archive expansion fails closed if any requested archive cannot be
+  listed or fully extracted. Successful expansion work is retained for
+  diagnostics, member names containing spaces are parsed correctly, and no
+  complete-looking partial report is published.
+- gllvm builds and every `get-bc` invocation now use per-run stable symlinks to
+  the exact checked `clang`, `clang++`, and `llvm-link`; `check-toolchain` reports
+  those effective tools.
+- Rust acquisition uses Cargo metadata for workspace-root profile semantics,
+  hierarchically merges Cargo configuration, honors `CARGO_TARGET_DIR`, filters
+  host-only artifacts consistently, and restricts fallback collection to the
+  current invocation. Multiple live versions and every codegen unit of the same
+  crate are preserved instead of collapsing by crate name.
+- Expected subprocess, decoding, JSON, and I/O failures now become concise
+  stage-specific CLI errors without tracebacks. Analyzer warnings are forwarded
+  on every run, while clean runs stay quiet.
+- Large bitcode sets are linked in bounded batches, Cargo artifact output and
+  non-verbose C/C++ build logs are spooled, and the analyzer writes staged JSON
+  directly to its final parser input rather than round-tripping a second copy.
+- Hosted CI covers LLVM 21, 22, and 23 plus full C/Rust CLI paths and reproducible
+  cppcheck/Clang Static Analyzer gates. Matrix discovery follows `PATH` and fails
+  without a supported LLVM unless an explicit local skip is requested.
+- Development setup pins gllvm 1.3.1, pytest 9.1.1, and setuptools 80.9.0;
+  `make compdb` generates a clangd compilation database and
+  `make static-analysis` reproduces the analyzer checks.
 - New `--mangling {auto,legacy,v0}` flag (default `auto`) on `reachability run`,
   for every Rust `--lang` value: forces the analysis build's rustc
   `-Csymbol-mangling-version` so its Rust symbols match whatever build you join
@@ -73,9 +126,6 @@
 - The toolchain check no longer requires `opt` on `PATH`: it was only
   version-probed as a redundant proxy, so `clang`/`clang++`/`llvm-link` (the
   actual bitcode producer/merger) now define coherence.
-- Rust acquisition warns when `deps/` holds bitcode from more than one build of a
-  crate (the newest is chosen by mtime, which can be stale if that crate was
-  cached); re-run with `--clean` for a fresh build.
 - C/C++ artifact detection now recognizes fat/universal Mach-O binaries.
 
 ### v1.0

Makefile

@@ -16,10 +16,14 @@ GOBIN       := $(shell go env GOPATH 2>/dev/null)/bin
 PY          := $(CURDIR)/.venv/bin/python
 ANALYZER     := $(CURDIR)/analyzer/build/reachability-analyzer
 
-.PHONY: help venv build test matrix ci clean
+.PHONY: help venv build test matrix ci compdb cppcheck scan-build static-analysis clean
 
 help:
 	@grep -E '^[a-z-]+:.*##' $(MAKEFILE_LIST) | sed 's/:.*##/\t/'
+	@printf 'compdb\tgenerate analyzer/compile_commands.json for clangd\n'
+	@printf 'cppcheck\trun cppcheck on the analyzer\n'
+	@printf 'scan-build\trun Clang Static Analyzer on the analyzer\n'
+	@printf 'static-analysis\trun all analyzer static checks\n'
 
 venv: ## create the Python venv (.venv) with the driver + test deps
 	bash scripts/setup_venv.sh
@@ -36,12 +40,22 @@ test: build | $(PY) ## run the full test suite
 	  REACHABILITY_ANALYZER="$(ANALYZER)" \
 	  "$(PY)" -m pytest tests/ -q
 
-matrix: ## build + test against every installed llvm-config-NN (NN >= 21)
+matrix: | $(PY) ## build + test against every installed llvm-config-NN (NN >= 21)
 	bash scripts/test_matrix.sh
 
 ci: ## run this repo's suite + cov-analysis's suite (cross-repo key contract)
 	bash scripts/ci_cross_repo.sh
 
+compdb:
+	$(MAKE) -C analyzer LLVM_CONFIG=$(LLVM_CONFIG) compdb
+
+cppcheck:
+	$(MAKE) -C analyzer LLVM_CONFIG=$(LLVM_CONFIG) cppcheck
+
+scan-build:
+	$(MAKE) -C analyzer LLVM_CONFIG=$(LLVM_CONFIG) scan-build
+
+static-analysis: cppcheck scan-build
+
 clean: ## remove analyzer build outputs
 	$(MAKE) -C analyzer clean BUILD=build
-	rm -rf analyzer/build/2[0-9]