CI: add static analysis (clang-tidy, cppcheck)

[dvershinin]

Problem

We have basic GitHub Actions CI but no static analysis. For a C codebase handling network protocols, static analysis catches buffer overflows, null pointer dereferences, and memory leaks that testing alone may miss.

Prior Art

• mtg: CodeQL + govulncheck in GitHub Actions
• Industry standard for C projects: clang-tidy, cppcheck, Coverity

Proposed Tools

clang-tidy (recommended)

• Best integration with Clang/LLVM toolchain
• Checks: bugprone-*, security-*, cert-*, clang-analyzer-*
• Can fix some issues automatically

cppcheck

• Standalone, no build system integration needed
• Good at finding buffer overflows and undefined behavior
• Low false positive rate

CodeQL (GitHub-native)

• Free for open-source repos
• Runs as GitHub Action
• Catches security-relevant patterns (CWEs)

Proposed CI Addition

- name: Static Analysis
  run: |
    apt-get install -y cppcheck
    cppcheck --enable=warning,security --error-exitcode=1 \
      --suppress=missingInclude \
      net/ mtproto/ common/ crypto/ engine/

Priority

Low-effort addition to existing CI. Can start with cppcheck (zero config) and add clang-tidy later.

[github-actions]

Thank you for opening this issue.

This project is maintained by a single developer in their free time.
Upstream TelegramMessenger/MTProxy is abandoned. This fork is the only actively maintained version.

Continued development depends on community support:

• GitHub Sponsors — sponsors' issues are prioritized
• TON: UQBOGq_b3eL63Qfkj6ykoBibK3zGJDQzLK91v2q-UCY7BPeb (send via @wallet in Telegram)
• USDT (TRC-20): TNVSj1QjZ5jqdaeshe7VCpXWo2S1n936Hj
• BTC: bc1qvxxldmanwggula7992uun5a2qxm65ej9h0unj7
• GetPageSpeed RPM packages — production-ready install with support

Issues without community interest may be closed after 60 days of inactivity.

[dvershinin]

Implemented in 0040d1e. All three CI workflows green:

• Static Analysis: cppcheck (42 files clean) + CodeQL
• CI: all E2E tests pass
• Docker Build: image builds and pushes

Changes: fixed 10 instances of undefined behavior (signed left-shifts), 1 realloc memory leak, 3 potential null-pointer memcpy calls. Added make lint for local use.