.github/workflows: Update analyzer and VM test CI

Enable Cppcheck alongside the other analyzers on master pushes and
manual dispatch, using the existing container and KUnit-enabled runner.
Keep failures for source findings and incomplete analysis, and list the
enabled job in the tooling guide. Use only analyzer names for job titles;
KUnit source coverage remains mandatory.

The Ginkgo VM job reports this runner warning:

  Node.js 20 is deprecated. The following actions target Node.js 20
  but are being forced to run on Node.js 24: actions/checkout@v4,
  actions/upload-artifact@v4.

KUnit uses the same action versions. Update checkout and upload-artifact
to v7 in both VM workflows so they explicitly select Node.js 24, matching
the analyzer workflow. Retain checkout and artifact collection settings.

.github/workflows/analyzers.yml

@@ -44,7 +44,7 @@ jobs:
         run: make scs_lint
 
   native:
-    name: ${{ matrix.analyzer }} (includes KUnit sources)
+    name: ${{ matrix.analyzer }}
     needs: script-tests
     runs-on: ubuntu-24.04
     timeout-minutes: 45
@@ -56,8 +56,7 @@ jobs:
           - smatch
           - checkpatch
           - coccicheck
-          # Supported by the runner; enable after reviewing native coverage.
-          # - cppcheck
+          - cppcheck
     steps:
       - uses: actions/checkout@v7
         with:

.github/workflows/ginkgo.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 220
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           # Compare the whole PR against its merge base, including fork PRs.
@@ -57,7 +57,7 @@ jobs:
             "$RUNNER_TEMP/ginkgo-results" --timeout 10000 --ginkgo-label "$GINKGO_LABEL"
       - name: Save build logs, reports and serial consoles
         if: always() && steps.changes.outputs.run == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ginkgo-results
           retention-days: 7

.github/workflows/kunit.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           # Compare the whole PR against its merge base, including fork PRs.
@@ -59,7 +59,7 @@ jobs:
             "$RUNNER_TEMP/kunit-results" --timeout 1200
       - name: Save build and runtime evidence
         if: always() && steps.changes.outputs.run == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: kunit-results
           retention-days: 7

scripts/README.md

@@ -272,12 +272,10 @@ returns 2 (Make maps both to 2). Empty input is a skip.
 
 The [workflow](../.github/workflows/analyzers.yml) runs on pushes to `master`
 and manual dispatch. Separate jobs run `make sparse`, `make smatch`,
-`make checkpatch` and `make coccicheck`, including KUnit sources.
+`make checkpatch`, `make coccicheck` and `make cppcheck`, including KUnit sources.
 `Analyzer script tests` runs `make lint-test`; it does not execute SCST
 tests. A parallel `SCST code style` job runs `make scs_lint` without a kernel
 build. The container jobs retain reports from `.cache/lint/` for seven days.
-The runner and image also support Cppcheck; its matrix entry remains
-commented out.
 
 CI fails on findings remaining after policy exceptions, just like local Make
 targets. The native-analyzer runner returns 1 for completed analysis with