Skip to content

Commit 4548249

Browse files
jackctj117bigbrett
jackctj117
and
bigbrett
authored
Add clang-tidy CI action (#167)
* add clang-tidy with fixes to resolve warnings * Change clang-tidy-builder script to ingnore .clang-tidy and CLANG_TIDY_ARGS * Fix to exclude wolfssl files * Fix to only run clang-tidy for src/ and wolfhsm/ * removed supression text and unnecessary return check --------- Co-authored-by: Brett Nicholas <7547222+bigbrett@users.noreply.github.com>
1 parent 21ea606 commit 4548249

10 files changed

Lines changed: 437 additions & 19 deletions

File tree

‎.github/workflows/static-analysis.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,13 @@ jobs:
1414
- name: Checkout code
1515
uses: actions/checkout@v3
1616

17+
- name: Checkout wolfssl
18+
uses: actions/checkout@v3
19+
with:
20+
repository: wolfssl/wolfssl
21+
ref: v5.6.4-stable
22+
path: wolfssl
23+
1724
- name: Install cppcheck
1825
run: |
1926
sudo apt-get update
@@ -55,3 +62,63 @@ jobs:
5562
run: |
5663
echo "❌ Static analysis failed - errors or warnings were found"
5764
exit 1
65+
66+
clang-tidy:
67+
runs-on: ubuntu-latest
68+
69+
steps:
70+
- name: Checkout code
71+
uses: actions/checkout@v3
72+
73+
- name: Checkout wolfssl
74+
uses: actions/checkout@v3
75+
with:
76+
repository: wolfssl/wolfssl
77+
path: wolfssl
78+
79+
- name: Install dependencies
80+
run: |
81+
sudo apt-get update
82+
sudo apt-get install -y clang clang-tidy build-essential
83+
84+
- name: Run clang-tidy
85+
id: clang-tidy
86+
run: |
87+
chmod +x tools/static-analysis/run_clang_tidy_make.sh
88+
chmod +x tools/static-analysis/clang-tidy-builder.sh
89+
tools/static-analysis/run_clang_tidy_make.sh
90+
91+
- name: Display errors and warnings
92+
if: always()
93+
run: |
94+
if [ -f tools/static-analysis/reports/clang_tidy_summary.txt ]; then
95+
# Count issues from clang-tidy output
96+
ERROR_COUNT=$(grep -c "error:" tools/static-analysis/reports/clang_tidy_summary.txt 2>/dev/null) || ERROR_COUNT=0
97+
WARNING_COUNT=$(grep -c "warning:" tools/static-analysis/reports/clang_tidy_summary.txt 2>/dev/null) || WARNING_COUNT=0
98+
99+
echo "## Clang-Tidy Analysis Summary"
100+
echo "- Errors: $ERROR_COUNT"
101+
echo "- Warnings: $WARNING_COUNT"
102+
103+
if [ "$ERROR_COUNT" -gt 0 ] || [ "$WARNING_COUNT" -gt 0 ]; then
104+
echo ""
105+
echo "### Issues found:"
106+
echo ""
107+
# Show first 50 issues to avoid overwhelming output
108+
head -50 tools/static-analysis/reports/clang_tidy_summary.txt
109+
110+
TOTAL_ISSUES=$((ERROR_COUNT + WARNING_COUNT))
111+
if [ "$TOTAL_ISSUES" -gt 50 ]; then
112+
echo ""
113+
echo "... and $((TOTAL_ISSUES - 50)) more issues. See full report for details."
114+
fi
115+
fi
116+
else
117+
echo "⚠️ No clang-tidy summary file found"
118+
fi
119+
120+
- name: Fail if issues found
121+
if: steps.clang-tidy.outcome == 'failure'
122+
run: |
123+
echo "❌ Clang-tidy analysis failed - errors or warnings were found"
124+
exit 1

‎.gitignore‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ tools/testcertgen/ca/
88
tools/testcertgen/*.der
99
*.code-workspace
1010
.vscode
11+
compile_commands.json
1112

12-
# Static analysis reports
13+
# Static analysis
1314
tools/static-analysis/reports/
1415
*.xml
1516
*.html
16-

‎src/wh_crypto.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -211,23 +211,23 @@ int wh_Crypto_EccUpdatePrivateOnlyKeyDer(ecc_key* key, uint16_t pub_size,
211211

212212
/* Store a curve25519_key to a byte sequence in DER format */
213213
int wh_Crypto_Curve25519SerializeKey(curve25519_key* key, uint8_t* buffer,
214-
uint16_t* derSize)
214+
uint16_t* outDerSize)
215215
{
216216
int ret = 0;
217217
/* We must include the algorithm identifier in the DER encoding, or we will
218218
* not be able to deserialize it properly in the public key only case*/
219219
const int WITH_ALG_ENABLE_SUBJECT_PUBLIC_KEY_INFO = 1;
220220

221-
if ((key == NULL) || (buffer == NULL) || (derSize == NULL)) {
221+
if ((key == NULL) || (buffer == NULL) || (outDerSize == NULL)) {
222222
return WH_ERROR_BADARGS;
223223
}
224224

225-
ret = wc_Curve25519KeyToDer(key, buffer, *derSize,
225+
ret = wc_Curve25519KeyToDer(key, buffer, *outDerSize,
226226
WITH_ALG_ENABLE_SUBJECT_PUBLIC_KEY_INFO);
227227

228228
/* ASN.1 functions return the size of the DER encoded key on success */
229229
if (ret > 0) {
230-
*derSize = ret;
230+
*outDerSize = ret;
231231
ret = WH_ERROR_OK;
232232
}
233233
return ret;

‎src/wh_nvm_flash.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -950,7 +950,7 @@ int wh_NvmFlash_Cleanup(void* c)
950950

951951
int wh_NvmFlash_List(void* c,
952952
whNvmAccess access, whNvmFlags flags, whNvmId start_id,
953-
whNvmId *out_count, whNvmId *out_id)
953+
whNvmId *out_avail_objects, whNvmId *out_id)
954954
{
955955
/* TODO: Implement access and flag matching */
956956
(void)access; (void)flags;
@@ -1008,7 +1008,7 @@ int wh_NvmFlash_List(void* c,
10081008
}
10091009
}
10101010
}
1011-
if (out_count != NULL) *out_count = this_count;
1011+
if (out_avail_objects != NULL) *out_avail_objects = this_count;
10121012
if (out_id != NULL) *out_id = this_id;
10131013
return 0;
10141014
}
@@ -1087,7 +1087,7 @@ int wh_NvmFlash_AddObject(void* c, whNvmMetadata *meta,
10871087
}
10881088

10891089
/* Find existing object so we can increment the epoch */
1090-
ret = nfMemDirectory_FindObjectIndexById(d, meta->id, &oldentry);
1090+
(void)nfMemDirectory_FindObjectIndexById(d, meta->id, &oldentry);
10911091
if (oldentry >= 0) {
10921092
epoch = d->objects[oldentry].state.epoch + 1;
10931093
}

‎tools/static-analysis/clang-tidy-builder.sh‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
#!/bin/bash
2+
3+
set -o noclobber -o nounset || exit $?
4+
shopt -s extglob || exit $?
5+
6+
retval=0
7+
8+
if [[ -v CLANG_TIDY ]]; then
9+
10+
while :; do
11+
12+
for arg in "$@"; do
13+
case "$arg" in
14+
*.c) source_file="$arg"
15+
;;
16+
esac
17+
done
18+
unset arg
19+
20+
if [[ ! -v source_file ]]; then
21+
retval=0
22+
break
23+
fi
24+
25+
if [[ ! "$source_file" =~ (^|/)src/[^/]+\.c$ ]] && [[ ! "$source_file" =~ (^|/)wolfhsm/[^/]+\.c$ ]]; then
26+
if [[ -v CLANG_OVERRIDE_CFLAGS ]]; then
27+
read -a CLANG_OVERRIDE_CFLAGS_a < <(echo "${CLANG_OVERRIDE_CFLAGS-}")
28+
else
29+
CLANG_OVERRIDE_CFLAGS_a=()
30+
fi
31+
exec "$CLANG" "$@" "${CLANG_OVERRIDE_CFLAGS_a[@]}"
32+
fi
33+
34+
if [[ -v CLANG_TIDY_ARGS ]]; then
35+
read -r -a clang_tidy_args_array < <(echo "$CLANG_TIDY_ARGS") || exit $?
36+
else
37+
clang_tidy_args_array=()
38+
fi
39+
40+
if [[ -v CLANG_TIDY_PER_FILE_CHECKS ]]; then
41+
per_file_checks=()
42+
read -r -a clang_tidy_per_file_checks < <(echo "$CLANG_TIDY_PER_FILE_CHECKS") || exit $?
43+
for check in "${clang_tidy_per_file_checks[@]}"; do
44+
if [[ "$source_file" =~ ${check%:*} ]]; then
45+
per_file_checks+=("${check#*:}")
46+
fi
47+
done
48+
unset check
49+
fi
50+
51+
if [[ -v per_file_checks ]]; then
52+
declare -i i=0
53+
while [[ $i -lt ${#clang_tidy_args_array[@]} ]]; do
54+
if [[ "${clang_tidy_args_array[i]}" =~ ^-checks ]]; then
55+
SAVE_IFS="$IFS"
56+
IFS=,
57+
clang_tidy_args_array[i]="${clang_tidy_args_array[i]},${per_file_checks[*]}"
58+
IFS="$SAVE_IFS"
59+
added_to_existing_checks=
60+
break
61+
fi
62+
: $((++i))
63+
done
64+
if [[ ! -v added_to_existing_checks ]]; then
65+
SAVE_IFS="$IFS"
66+
IFS=,
67+
clang_tidy_args_array+=("-checks=${per_file_checks[*]}")
68+
IFS="$SAVE_IFS"
69+
fi
70+
fi
71+
72+
if [[ -v CLANG_TIDY_PER_FILE_ARGS ]]; then
73+
read -r -a clang_tidy_per_file_args < <(echo "$CLANG_TIDY_PER_FILE_ARGS") || exit $?
74+
for arg in "${clang_tidy_per_file_args[@]}"; do
75+
if [[ "$source_file" =~ ${arg%:*} ]]; then
76+
clang_tidy_args_array+=("${arg#*:}")
77+
fi
78+
done
79+
unset arg
80+
fi
81+
82+
if [[ -v CLANG_TIDY_CONFIG ]]; then
83+
clang_tidy_args_array+=("-config=${CLANG_TIDY_CONFIG}")
84+
fi
85+
86+
if [[ -v CLANG_TIDY_EXTRA_ARGS ]]; then
87+
read -r -a clang_tidy_extra_args < <(echo "$CLANG_TIDY_EXTRA_ARGS") || exit $?
88+
clang_tidy_args_array+=("${clang_tidy_extra_args[@]}")
89+
fi
90+
91+
for arg in "${clang_tidy_args_array[@]}"; do
92+
case "$arg" in
93+
--use-color) use_color=
94+
;;
95+
esac
96+
done
97+
unset arg
98+
99+
if [[ -v use_color ]]; then
100+
if text_normal_start="$(tput sgr0)"; then
101+
do_style_restore=
102+
fi
103+
fi
104+
105+
while read -r clang_tidy_line; do
106+
case "$clang_tidy_line" in
107+
Use\ -header-filter=.*\ to\ display\ errors\ from\ all\ non-system\ headers.\ Use\ -system-headers\ to\ display\ errors\ from\ system\ headers\ as\ well.)
108+
109+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
110+
;;
111+
112+
+([0-9])\ warning?(s)\ generated.)
113+
114+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
115+
;;
116+
117+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ NOLINT\).)
118+
119+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
120+
if [[ "${clang_tidy_line_a[3]}" == "${clang_tidy_line_a[1]}" ]]; then
121+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
122+
else
123+
echo "$clang_tidy_line" >&2
124+
fi
125+
;;
126+
127+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ in\ non-user\ code,\ +([0-9])\ NOLINT\).)
128+
129+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
130+
if [[ $((clang_tidy_line_a[3] + clang_tidy_line_a[7])) == "${clang_tidy_line_a[1]}" ]]; then
131+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
132+
else
133+
echo "$clang_tidy_line" >&2
134+
fi
135+
;;
136+
137+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ with\ check\ filters\).)
138+
139+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
140+
if [[ "${clang_tidy_line_a[3]}" == "${clang_tidy_line_a[1]}" ]]; then
141+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
142+
else
143+
echo "$clang_tidy_line" >&2
144+
fi
145+
;;
146+
147+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ in\ non-user\ code,\ +([0-9])\ with\ check\ filters\).)
148+
149+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
150+
if [[ $((clang_tidy_line_a[3] + clang_tidy_line_a[7])) == "${clang_tidy_line_a[1]}" ]]; then
151+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
152+
else
153+
echo "$clang_tidy_line" >&2
154+
fi
155+
;;
156+
157+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ in\ non-user\ code,\ +([0-9])\ NOLINT,\ +([0-9])\ with\ check\ filters\).)
158+
159+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
160+
if [[ $((clang_tidy_line_a[3] + clang_tidy_line_a[7] + clang_tidy_line_a[9])) == "${clang_tidy_line_a[1]}" ]]; then
161+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
162+
else
163+
echo "$clang_tidy_line" >&2
164+
fi
165+
;;
166+
167+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ due\ to\ line\ filter\).)
168+
169+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
170+
if [[ "${clang_tidy_line_a[3]}" == "${clang_tidy_line_a[1]}" ]]; then
171+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
172+
else
173+
echo "$clang_tidy_line" >&2
174+
fi
175+
;;
176+
177+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ in\ non-user\ code,\ +([0-9])\ due\ to\ line\ filter\).)
178+
179+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
180+
if [[ $((clang_tidy_line_a[3] + clang_tidy_line_a[7])) == "${clang_tidy_line_a[1]}" ]]; then
181+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
182+
else
183+
echo "$clang_tidy_line" >&2
184+
fi
185+
;;
186+
187+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ due\ to\ line\ filter,\ +([0-9])\ NOLINT\).)
188+
189+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
190+
if [[ $((clang_tidy_line_a[3] + clang_tidy_line_a[7])) == "${clang_tidy_line_a[1]}" ]]; then
191+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
192+
else
193+
echo "$clang_tidy_line" >&2
194+
fi
195+
;;
196+
197+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ in\ non-user\ code,\ +([0-9])\ due\ to\ line\ filter,\ +([0-9])\ NOLINT\).)
198+
199+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
200+
if [[ $((clang_tidy_line_a[3] + clang_tidy_line_a[7] + clang_tidy_line_a[12])) == "${clang_tidy_line_a[1]}" ]]; then
201+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
202+
else
203+
echo "$clang_tidy_line" >&2
204+
fi
205+
;;
206+
207+
Suppressed\ +([0-9])\ warnings\ \(+([0-9])\ in\ non-user\ code\).)
208+
209+
IFS="[( ]" read -r -a clang_tidy_line_a < <(echo "$clang_tidy_line")
210+
if [[ "${clang_tidy_line_a[1]}" == "${clang_tidy_line_a[3]}" ]]; then
211+
[[ -v do_style_restore ]] && echo -n "$text_normal_start" >&2
212+
else
213+
echo "$clang_tidy_line" >&2
214+
fi
215+
;;
216+
217+
*)
218+
219+
echo "$clang_tidy_line" >&2
220+
retval=1
221+
;;
222+
223+
esac
224+
225+
done < <("$CLANG_TIDY" "${clang_tidy_args_array[@]}" "$source_file" -- "$@" 2>&1)
226+
227+
if [[ "$retval" != '0' && -v do_style_restore ]]; then
228+
echo -n "$text_normal_start" >&2
229+
fi
230+
break
231+
done
232+
fi
233+
234+
if [[ "$retval" != '0' ]]; then
235+
if [[ -v CLANG_TIDY_STATUS_FILE ]]; then
236+
# shellcheck disable=SC2320 # noise
237+
echo "${source_file} ${retval}" >> "$CLANG_TIDY_STATUS_FILE" || exit $?
238+
else
239+
exit "$retval"
240+
fi
241+
fi
242+
243+
# shellcheck disable=SC2162 # we want backslashes to be interpreted here.
244+
read -a CLANG_OVERRIDE_CFLAGS_a < <(echo "${CLANG_OVERRIDE_CFLAGS-}")
245+
246+
exec "$CLANG" "$@" "${CLANG_OVERRIDE_CFLAGS_a[@]}"

0 commit comments

Comments
 (0)