Fix production build errors, add build step to Docker test infra

- Fix GCC -O2 warnings: calloc for cf (maybe-uninitialized),
  suppress stringop-truncation/alloc-size-larger-than (false positives),
  guard louvain against negative node_count
- Default compiler: cc on macOS, gcc on Linux/Windows (fixes gcc-14
  not found on MSYS2)
- Docker test infra now runs BOTH test (ASan) and build (-O2 -Werror)

Author: DeusData

Makefile.cbm

@@ -41,7 +41,8 @@ endif
 IS_GCC := $(shell echo | $(CC) -dM -E - 2>/dev/null | grep -q '__GNUC__' && ! echo | $(CC) -dM -E - 2>/dev/null | grep -q '__clang__' && echo yes || echo no)
 GCC_ONLY_FLAGS :=
 ifeq ($(IS_GCC),yes)
-GCC_ONLY_FLAGS := -Wno-format-truncation -Wno-unused-result
+GCC_ONLY_FLAGS := -Wno-format-truncation -Wno-unused-result \
+                  -Wno-stringop-truncation -Wno-alloc-size-larger-than
 endif
 
 CFLAGS_COMMON = -std=c11 -D_DEFAULT_SOURCE -Wall -Wextra -Werror \

scripts/build.sh

@@ -82,7 +82,7 @@ print_env "build.sh"
 echo "  ui=$WITH_UI version=${VERSION:-dev}"
 
 # Verify compiler supports target arch
-verify_compiler "${CC:-gcc-14}"
+verify_compiler "$CC"
 
 # Step 1: Clean C build artifacts only (not node_modules — npm ci handles that)
 rm -rf "$ROOT/build/c"

scripts/env.sh

@@ -74,6 +74,17 @@ verify_compiler() {
     fi
 }
 
+# ── Default compiler selection ─────────────────────────────────
+# macOS: cc (Apple Clang). Linux/Windows: gcc (system default).
+# CI overrides via CC=gcc CXX=g++ args. Local macOS overrides via CC=cc.
+if [[ -z "${CC:-}" ]]; then
+    if [[ "$OS" == "darwin" ]]; then
+        export CC=cc CXX=c++
+    else
+        export CC=gcc CXX=g++
+    fi
+fi
+
 # ── Print environment summary ──────────────────────────────────
 print_env() {
     local context="$1"

scripts/test.sh

@@ -50,7 +50,7 @@ done
 print_env "test.sh"
 
 # Verify compiler supports target arch
-verify_compiler "${CC:-gcc-14}"
+verify_compiler "$CC"
 
 # Step 1: Clean
 scripts/clean.sh

src/pipeline/pass_githistory.c

@@ -430,7 +430,14 @@ int cbm_pipeline_githistory_compute(const char *repo_path, cbm_githistory_result
     result->commit_count = commit_count;
 
     /* Convert to testable format */
-    cbm_commit_files_t *cf = malloc((size_t)commit_count * sizeof(cbm_commit_files_t));
+    cbm_commit_files_t *cf = calloc((size_t)commit_count, sizeof(cbm_commit_files_t));
+    if (!cf) {
+        for (int c = 0; c < commit_count; c++) {
+            commit_free(&commits[c]);
+        }
+        free(commits);
+        return 0;
+    }
     for (int c = 0; c < commit_count; c++) {
         cf[c].files = commits[c].files;
         cf[c].count = commits[c].count;

src/store/store.c

@@ -3431,7 +3431,7 @@ static int arch_file_tree(cbm_store_t *s, const char *project, cbm_architecture_
 
 int cbm_louvain(const int64_t *nodes, int node_count, const cbm_louvain_edge_t *edges,
                 int edge_count, cbm_louvain_result_t **out, int *out_count) {
-    if (node_count == 0) {
+    if (node_count <= 0) {
         *out = NULL;
         *out_count = 0;
         return CBM_STORE_OK;

test-infrastructure/docker-compose.yml

@@ -6,13 +6,10 @@
 #   macOS:        not possible in Docker — test natively: scripts/test.sh CC=cc
 #   Windows:      not possible in Docker on Mac — CI only
 #
-# Usage:
-#   ./test-infrastructure/run.sh              # test arm64 (native, fast)
-#   ./test-infrastructure/run.sh all          # test arm64 + amd64 in parallel
-#   ./test-infrastructure/run.sh amd64        # test amd64 only (QEMU, slower)
-#   ./test-infrastructure/run.sh lint         # lint only
+# Each platform runs BOTH test (ASan/LeakSan) AND production build (-O2 -Werror).
 
 services:
+  # ── Test builds (ASan + UBSan + LeakSanitizer) ──────────────
   test:
     build:
       context: ..
@@ -31,6 +28,28 @@ services:
       - ..:/src
     command: ["CC=gcc", "CXX=g++"]
 
+  # ── Production builds (-O2 -Werror, catches stricter GCC warnings) ──
+  build:
+    build:
+      context: ..
+      dockerfile: test-infrastructure/Dockerfile
+    platform: linux/arm64
+    volumes:
+      - ..:/src
+    entrypoint: ["scripts/build.sh"]
+    command: ["CC=gcc", "CXX=g++"]
+
+  build-amd64:
+    build:
+      context: ..
+      dockerfile: test-infrastructure/Dockerfile
+    platform: linux/amd64
+    volumes:
+      - ..:/src
+    entrypoint: ["scripts/build.sh"]
+    command: ["CC=gcc", "CXX=g++"]
+
+  # ── Lint ────────────────────────────────────────────────────
   lint:
     build:
       context: ..

test-infrastructure/run.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Local CI testing — GCC + ASan + LeakSanitizer in Docker.
+# Local CI testing — mirrors GitHub Actions for all Docker-capable platforms.
 #
 # Coverage:
 #   arm64:   Native on Apple Silicon (fast, ~3 min)
@@ -8,34 +8,48 @@
 #   Windows: CI only (no Docker support on Mac)
 #
 # Usage:
-#   ./test-infrastructure/run.sh              # arm64 test (default, fast)
-#   ./test-infrastructure/run.sh all          # arm64 + amd64 in parallel
-#   ./test-infrastructure/run.sh amd64        # amd64 only
+#   ./test-infrastructure/run.sh              # test + build arm64 (default)
+#   ./test-infrastructure/run.sh all          # test + build, arm64 + amd64
+#   ./test-infrastructure/run.sh test         # test only (ASan + LeakSan)
+#   ./test-infrastructure/run.sh build        # production build only (-O2 -Werror)
+#   ./test-infrastructure/run.sh amd64        # test + build amd64 only
 #   ./test-infrastructure/run.sh lint         # clang-format + cppcheck
 #   ./test-infrastructure/run.sh shell        # debug shell (arm64)
-#   ./test-infrastructure/run.sh shell-amd64  # debug shell (amd64)
 
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 COMPOSE="docker compose -f $ROOT/test-infrastructure/docker-compose.yml"
 
-case "${1:-test}" in
-    test|arm64)
-        echo "=== Linux arm64 (GCC + ASan + LeakSanitizer) ==="
+case "${1:-full}" in
+    full)
+        echo "=== Linux arm64: test (ASan+LeakSan) + production build (-O2) ==="
         $COMPOSE run --rm test
+        $COMPOSE run --rm build
+        ;;
+    test)
+        echo "=== Linux arm64: test (ASan + LeakSanitizer) ==="
+        $COMPOSE run --rm test
+        ;;
+    build)
+        echo "=== Linux arm64: production build (-O2 -Werror) ==="
+        $COMPOSE run --rm build
         ;;
     amd64)
-        echo "=== Linux amd64 via QEMU (GCC + ASan + LeakSanitizer) ==="
+        echo "=== Linux amd64 via QEMU: test + build ==="
         $COMPOSE run --rm test-amd64
+        $COMPOSE run --rm build-amd64
         ;;
     all)
-        echo "=== Testing arm64 + amd64 in parallel ==="
-        $COMPOSE run --rm -d test
+        echo "=== All platforms: test + build ==="
+        echo "--- arm64 test ---"
+        $COMPOSE run --rm test
+        echo "--- arm64 build ---"
+        $COMPOSE run --rm build
+        echo "--- amd64 test ---"
         $COMPOSE run --rm test-amd64
-        echo "=== Waiting for arm64... ==="
-        # docker compose run -d returns immediately; wait for the container
-        $COMPOSE wait test 2>/dev/null || true
+        echo "--- amd64 build ---"
+        $COMPOSE run --rm build-amd64
         echo "=== All platforms passed ==="
         ;;
     lint)
@@ -46,12 +60,8 @@ case "${1:-test}" in
         echo "=== Debug shell (Linux arm64) ==="
         $COMPOSE run --rm --entrypoint bash test
         ;;
-    shell-amd64)
-        echo "=== Debug shell (Linux amd64 via QEMU) ==="
-        $COMPOSE run --rm --entrypoint bash test-amd64
-        ;;
     *)
-        echo "Usage: $0 {test|arm64|amd64|all|lint|shell|shell-amd64}"
+        echo "Usage: $0 {full|test|build|amd64|all|lint|shell}"
         exit 1
         ;;
 esac