mirror of
https://github.com/RsyncProject/rsync.git
synced 2026-09-22 10:15:04 -04:00
Andrew Tridgell
5022446815
Now that pull_request triggers fire for any base branch, limit runner minutes by skipping PR jobs unless the PR carries the 'run-ci' label. Applying a label needs triage access, so a fork PR can't enable the matrix by itself. The 'labeled' trigger type is added so applying the label starts a run immediately; skipped jobs cost no runner minutes. Push, schedule and manual dispatch runs are unaffected.
95 lines
4.2 KiB
YAML
95 lines
4.2 KiB
YAML
name: rsync scan-build (clang analyzer)
|
|
|
|
on:
|
|
push:
|
|
branches: [ master ]
|
|
paths-ignore:
|
|
- '.github/workflows/*.yml'
|
|
- '!.github/workflows/scan-build.yml'
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, labeled]
|
|
paths-ignore:
|
|
- '.github/workflows/*.yml'
|
|
- '!.github/workflows/scan-build.yml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
# GATING run: pinned clang-18 on a pinned runner so the checker set -- and
|
|
# thus the expected zero -- is deterministic. The tree is kept clean for
|
|
# clang-18, so --status-bugs (non-zero exit on any report) fails the build
|
|
# when a new finding appears. Pin both the analyzer (clang-18/clang-tools-18)
|
|
# and the runner (ubuntu-24.04, whose apt repos carry those packages).
|
|
gate-clang18:
|
|
# temporary gate: PR CI runs only for PRs labeled 'run-ci', to save CI
|
|
# minutes; labels need triage access, so fork PRs can't self-enable.
|
|
if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'run-ci')
|
|
runs-on: ubuntu-24.04
|
|
name: scan-build gate (clang-18, pinned)
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: prep
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y clang-18 clang-tools-18 acl libacl1-dev attr libattr1-dev liblz4-dev libzstd-dev libxxhash-dev libpopt-dev openssl
|
|
- name: configure (under scan-build)
|
|
# Run configure under scan-build so its analyzer compiler-wrapper is baked
|
|
# into the Makefile's $(CC); --disable-md2man avoids the doc toolchain.
|
|
run: scan-build-18 ./configure --with-rrsync --disable-md2man
|
|
- name: scan-build (gating)
|
|
# --status-bugs makes scan-build exit non-zero if it finds ANY report.
|
|
# pipefail + 'exit $status' propagate that through the tee so the job goes
|
|
# red while still printing the summary; the report uploads for triage.
|
|
run: |
|
|
set -o pipefail
|
|
status=0
|
|
scan-build-18 --status-bugs -o "$PWD/scan-report" make check-progs -j"$(nproc)" 2>&1 | tee scan-build.out || status=$?
|
|
echo '## scan-build gate (clang-18)' >>"$GITHUB_STEP_SUMMARY"
|
|
grep -E 'scan-build: .* bugs? found|scan-build: No bugs found' scan-build.out >>"$GITHUB_STEP_SUMMARY" || true
|
|
exit $status
|
|
- name: upload report
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: scan-build-report-clang18
|
|
path: scan-report
|
|
if-no-files-found: ignore
|
|
|
|
# INFORMATIONAL run: whatever clang ubuntu-latest currently ships. Newer
|
|
# clang releases enable extra, FP-heavy checkers (e.g. unix.Chroot
|
|
# "no chdir after chroot", alpha.unix.Stream) that the gate deliberately
|
|
# avoids, so this is NOT a gate (no --status-bugs). It surfaces what the
|
|
# newest analyzer sees -- useful for spotting genuine new findings before a
|
|
# gate bump -- without blocking merges. continue-on-error keeps a noisy or
|
|
# broken run from affecting the workflow's required status.
|
|
informational-latest:
|
|
# temporary gate: PR CI runs only for PRs labeled 'run-ci', to save CI
|
|
# minutes; labels need triage access, so fork PRs can't self-enable.
|
|
if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'run-ci')
|
|
runs-on: ubuntu-latest
|
|
name: scan-build (latest clang, informational)
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: prep
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y clang clang-tools acl libacl1-dev attr libattr1-dev liblz4-dev libzstd-dev libxxhash-dev libpopt-dev openssl
|
|
- name: configure (under scan-build)
|
|
run: scan-build ./configure --with-rrsync --disable-md2man
|
|
- name: scan-build (informational)
|
|
run: |
|
|
scan-build -o "$PWD/scan-report" make check-progs -j"$(nproc)" 2>&1 | tee scan-build.out
|
|
echo '## scan-build informational (latest clang)' >>"$GITHUB_STEP_SUMMARY"
|
|
grep -E 'scan-build: .* bugs? found|scan-build: No bugs found' scan-build.out >>"$GITHUB_STEP_SUMMARY" || true
|
|
- name: upload report
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: scan-build-report-latest
|
|
path: scan-report
|
|
if-no-files-found: ignore
|