lightNVR/.github/workflows/static-analysis.yml at main · origin2000/lightNVR · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: Static Analysis

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  clang-tidy:
    name: clang-tidy
    runs-on: ubuntu-latest
    container: debian:sid-slim
    timeout-minutes: 30

    steps:
      - name: Install dependencies
        run: |
          apt-get update
          apt-get install -y \
            git build-essential cmake pkg-config clang-tidy \
            libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
            libsqlite3-dev libuv1-dev libllhttp-dev libcurl4-openssl-dev \
            libcjson-dev libmbedtls-dev libmosquitto-dev

      - name: Checkout
        uses: actions/checkout@v5
        with:
          submodules: false

      - name: Generate compile_commands.json
        run: |
          mkdir -p build && cd build
          cmake .. \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
            -DENABLE_SOD=OFF \
            -DENABLE_GO2RTC=OFF \
            -DBUILD_TESTS=OFF
          # Copy to project root for clang-tidy
          cp compile_commands.json ..

      - name: Run clang-tidy
        run: |
          echo "::group::clang-tidy version"
          clang-tidy --version
          echo "::endgroup::"

          # Find all C source files under src/, excluding third-party code
          find src/ -name '*.c' -not -path '*/sod/*' -not -path '*/ezxml/*' | sort > /tmp/source_files.txt
          echo "Scanning $(wc -l < /tmp/source_files.txt) source files..."

          # Run clang-tidy (non-blocking: always exit 0)
          set +e
          clang-tidy \
            -p compile_commands.json \
            $(cat /tmp/source_files.txt) \
            --quiet \
            2>&1 | tee clang-tidy-report.txt
          set -e

          # Count warnings
          WARNINGS=$(grep -c "warning:" clang-tidy-report.txt || true)
          ERRORS=$(grep -c "error:" clang-tidy-report.txt || true)
          echo "## clang-tidy Results" >> $GITHUB_STEP_SUMMARY
          echo "- **Warnings**: ${WARNINGS}" >> $GITHUB_STEP_SUMMARY
          echo "- **Errors**: ${ERRORS}" >> $GITHUB_STEP_SUMMARY

      - name: Upload clang-tidy report
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: clang-tidy-report
          path: clang-tidy-report.txt
          retention-days: 30

  cppcheck:
    name: cppcheck
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          submodules: false

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y cppcheck

      - name: Run cppcheck
        run: |
          echo "::group::cppcheck version"
          cppcheck --version
          echo "::endgroup::"

          # Run cppcheck with XML output (non-blocking: --error-exitcode=0)
          cppcheck \
            --enable=all \
            --suppress=missingIncludeSystem \
            --suppress=unusedFunction \
            --inline-suppr \
            --error-exitcode=0 \
            --xml \
            --xml-version=2 \
            -I include/ \
            src/ \
            2> cppcheck-report.xml

          # Also generate a human-readable report
          cppcheck \
            --enable=all \
            --suppress=missingIncludeSystem \
            --suppress=unusedFunction \
            --inline-suppr \
            --error-exitcode=0 \
            --template='{file}:{line}: {severity}: {message} [{id}]' \
            -I include/ \
            src/ \
            2> cppcheck-report.txt

          # Summary
          ERRORS=$(grep -c 'severity="error"' cppcheck-report.xml || true)
          WARNINGS=$(grep -c 'severity="warning"' cppcheck-report.xml || true)
          STYLE=$(grep -c 'severity="style"' cppcheck-report.xml || true)
          PERF=$(grep -c 'severity="performance"' cppcheck-report.xml || true)
          echo "## cppcheck Results" >> $GITHUB_STEP_SUMMARY
          echo "- **Errors**: ${ERRORS}" >> $GITHUB_STEP_SUMMARY
          echo "- **Warnings**: ${WARNINGS}" >> $GITHUB_STEP_SUMMARY
          echo "- **Style**: ${STYLE}" >> $GITHUB_STEP_SUMMARY
          echo "- **Performance**: ${PERF}" >> $GITHUB_STEP_SUMMARY

      - name: Upload cppcheck reports
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: cppcheck-reports
          path: |
            cppcheck-report.xml
            cppcheck-report.txt
          retention-days: 30