Run isolated tooling checks and separate Sparse and Smatch Make targets
on pushes to master and manual dispatch. Use the pinned kernel with
KUnit enabled and preserve full logs, policy and tool provenance.
During the source-fix rollout, completed source findings are advisory.
Tool, build, parser and coverage failures remain blocking, including an
empty scan or missing KUnit inputs. Local Make targets stay strict.
Validate the current run's report together with Make's exit status,
since Make maps both findings and incomplete analysis to status 2.
Prepare the runner and container for Coccinelle and Cppcheck as well,
but leave their matrix entries commented out. Cover all four report
formats and GNU Make exit mapping with isolated tooling fixtures.
Build standalone Sparse and Smatch from recorded revisions, applying the
reviewed SCST Smatch frontend correction. Install matching native Smatch
data without replacing standalone Sparse or adding project models.
Reuse the existing checksum-pinned kernel headers. Record source
commits, patch and binary hashes, and installed model contents for CI
evidence. Fail preparation instead of silently falling back to different
tools; no SCST modules are built or loaded while preparing this image.
Gleb Chesnokov