name: Static analyzers

on:
  push:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  script-tests:
    name: Analyzer script tests
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Run analyzer script tests
        run: make lint-test

  scs-lint:
    name: SCST code style
    needs: script-tests
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: "0.13.1"
          python-version: "3.12"
          enable-cache: false
      - name: Test SCST style rules
        run: make scs-lint-test
      - name: Run make scs_lint
        run: make scs_lint

  native:
    name: ${{ matrix.analyzer }}
    needs: script-tests
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        analyzer:
          - sparse
          - smatch
          - checkpatch
          - coccicheck
          - cppcheck
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Build pinned analyzer environment
        run: |
          docker build -f scripts/ci/analyzers.Dockerfile -t scst-analyzers:local . \
            2>&1 | tee "$RUNNER_TEMP/analyzer-image.log"
      - name: Run make ${{ matrix.analyzer }}
        env:
          ANALYZER: ${{ matrix.analyzer }}
        run: |
          source scripts/ci/kernel.env
          docker run --rm --init --network=none --cap-drop=ALL \
            --security-opt=no-new-privileges --user "$(id -u):$(id -g)" \
            --env HOME=/tmp --env GITHUB_STEP_SUMMARY=/scst/.cache/analyzer-summary \
            --env "KDIR=/usr/src/kernels/$KERNEL_BUILD.x86_64" \
            --mount "type=bind,src=$PWD,dst=/scst" scst-analyzers:local \
            python3 -B scripts/ci/run-analyzer.py "$ANALYZER"
      - name: Publish summary
        if: always()
        run: |
          if [[ -f .cache/analyzer-summary ]]; then
            cat .cache/analyzer-summary >> "$GITHUB_STEP_SUMMARY"
          fi
      - name: Save complete analyzer evidence
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.analyzer }}-evidence
          retention-days: 7
          path: |
            ${{ runner.temp }}/analyzer-image.log
            .cache/lint/
            .cache/analyzer-summary