diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml
index 0d5399ea945..5c04b80f8c4 100644
--- a/.github/workflows/sca.yml
+++ b/.github/workflows/sca.yml
@@ -9,7 +9,6 @@ on:
env:
BUILD_DEPS: automake bison flex git libboost-all-dev libevent-dev libssl-dev libtool make pkg-config
- SCA_DEPS: cppcheck python3-flake8 sloccount libglib2.0-dev
# Disable all languages for which we don't have SCA checks in place
CONFIG_ARGS_FOR_SCA: >
--enable-tutorial=no
@@ -37,7 +36,7 @@ permissions:
contents: read
jobs:
- sca:
+ compiler:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -47,58 +46,50 @@ jobs:
- name: Install dependencies
run: |
sudo apt-get update -yq
- sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS $SCA_DEPS
+ # shellcheck disable=SC2086
+ sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS
- - name: Set up PHP
- uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # master
+ - name: Build compiler
+ run: |
+ ./bootstrap.sh
+ # shellcheck disable=SC2086
+ ./configure $CONFIG_ARGS_FOR_SCA
+ make -j"$(nproc)" -C compiler/cpp
+
+ - name: Run thrift-compiler
+ run: compiler/cpp/thrift -version
+
+ - name: Archive built thrift compiler
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
- # Lowest supported PHP version
- php-version: "8.1"
- extensions: mbstring, xml, curl, pcntl
+ name: thrift-compiler
+ path: compiler/cpp/thrift
+ retention-days: 3
- - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+ compiler-cpp:
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
- python-version: "3.12"
+ persist-credentials: false
- - name: Install Python test dependencies
+ - name: Install dependencies
run: |
- python -m pip install --upgrade pip setuptools wheel flake8
-
- - name: Set up Ruby
- uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
- with:
- ruby-version: "2.7"
- bundler-cache: true
- working-directory: "lib/rb"
+ sudo apt-get update -yq
+ # shellcheck disable=SC2086
+ sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck
- # Generate thrift files so the static code analysis includes an analysis
- # of the files the thrift compiler spits out.
- - name: Build compiler
- id: compile
+ - name: Configure
run: |
./bootstrap.sh
+ # shellcheck disable=SC2086
./configure $CONFIG_ARGS_FOR_SCA
- make -j$(nproc) -C compiler/cpp
- name: Run cppcheck
- id: cppcheck
- continue-on-error: true
run: |
- make -j$(nproc) -C lib/cpp
- make -j$(nproc) -C test/cpp precross
-
- make -j$(nproc) -C lib/c_glib
- make -j$(nproc) -C test/c_glib precross
-
# Compiler cppcheck (All)
cppcheck --force --quiet --inline-suppr --enable=all -j2 compiler/cpp/src
- # C++ cppcheck (All)
- cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp
-
- # C Glib cppcheck (All)
- cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib
-
# Silent error checks
# See THRIFT-4371: flex generated scanner code causes false positives in cppcheck.
# suppress *:thrift/thriftl.cc -> flex-generated lexer triggers false null pointer paths.
@@ -110,6 +101,52 @@ jobs:
--suppress="normalCheckLevelMaxBranches:compiler/cpp/src/*" \
--error-exitcode=1 -j2 compiler/cpp/src
+ lib-cpp:
+ needs: compiler
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+
+ - name: Install dependencies
+ run: |
+ sudo apt-get update -yq
+ # shellcheck disable=SC2086
+ sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck libglib2.0-dev
+
+ - name: Configure
+ run: |
+ ./bootstrap.sh
+ # shellcheck disable=SC2086
+ ./configure $CONFIG_ARGS_FOR_SCA
+
+ - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: thrift-compiler
+ path: compiler/cpp
+
+ - name: Run thrift-compiler
+ run: |
+ chmod a+x compiler/cpp/thrift
+ compiler/cpp/thrift -version
+
+ - name: Generate C/C++ thrift files
+ run: |
+ make -j"$(nproc)" -C lib/cpp
+ make -j"$(nproc)" -C test/cpp precross
+
+ make -j"$(nproc)" -C lib/c_glib
+ make -j"$(nproc)" -C test/c_glib precross
+
+ - name: Run cppcheck
+ run: |
+ # C++ cppcheck (All)
+ cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp
+
+ # C Glib cppcheck (All)
+ cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib
+
# suppress unknownMacro:lib/cpp/src/thrift/qt/* -> Qt namespace macro needs Qt preprocessing.
# suppress unknownMacro:lib/cpp/test/* -> Boost.Test macros are unresolved in standalone analysis.
# suppress syntaxError:lib/cpp/src/thrift/transport/TSSLSocket.cpp -> OpenSSL macro branches confuse parser.
@@ -148,6 +185,137 @@ jobs:
-i lib/c_glib/test/gen-cpp \
--error-exitcode=1 -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib
+ lib-python:
+ needs: compiler
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+
+ - name: Install dependencies
+ run: |
+ sudo apt-get update -yq
+ # shellcheck disable=SC2086
+ sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS
+
+ - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+ with:
+ python-version: "3.12"
+
+ - name: Install Python test dependencies
+ run: |
+ python -m pip install --upgrade pip setuptools wheel flake8
+
+ - name: Configure
+ run: |
+ ./bootstrap.sh
+ # shellcheck disable=SC2086
+ ./configure $CONFIG_ARGS_FOR_SCA
+
+ - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: thrift-compiler
+ path: compiler/cpp
+
+ - name: Generate Python thrift files
+ run: |
+ chmod a+x compiler/cpp/thrift
+ compiler/cpp/thrift -version
+ make -j"$(nproc)" -C test/py precross
+
+ - name: Run flake8
+ run: flake8
+
+ lib-php:
+ needs: compiler
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+
+ - name: Install dependencies
+ run: |
+ sudo apt-get update -yq
+ # shellcheck disable=SC2086
+ sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS
+
+ - name: Set up PHP
+ uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # master
+ with:
+ # Lowest supported PHP version
+ php-version: "8.1"
+ extensions: mbstring, xml, curl, pcntl
+
+ - name: Configure
+ run: |
+ ./bootstrap.sh
+ # shellcheck disable=SC2086
+ ./configure $CONFIG_ARGS_FOR_SCA
+
+ - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: thrift-compiler
+ path: compiler/cpp
+
+ - name: Generate PHP thrift files
+ run: |
+ chmod a+x compiler/cpp/thrift
+ compiler/cpp/thrift -version
+ make -j"$(nproc)" -C lib/php/test stubs
+ make -j"$(nproc)" -C test/php precross
+
+ - name: Run phpcs
+ run: |
+ composer install --quiet
+ ./vendor/bin/phpcs
+
+ - name: Run phpstan
+ run: |
+ ./vendor/bin/phpstan analyse -c lib/php/phpstan.neon --no-progress --error-format=github
+
+ lib-ruby:
+ needs: compiler
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+
+ - name: Install dependencies
+ run: |
+ sudo apt-get update -yq
+ # shellcheck disable=SC2086
+ sudo apt-get install -y --no-install-recommends g++ $BUILD_DEPS cppcheck
+
+ - name: Set up Ruby
+ uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+ with:
+ ruby-version: "2.7"
+ bundler-cache: true
+ working-directory: "lib/rb"
+
+ - name: Configure
+ run: |
+ ./bootstrap.sh
+ # shellcheck disable=SC2086
+ ./configure $CONFIG_ARGS_FOR_SCA
+
+ - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: thrift-compiler
+ path: compiler/cpp
+
+ - name: Generate Ruby thrift files
+ run: |
+ chmod a+x compiler/cpp/thrift
+ compiler/cpp/thrift -version
+ make -j"$(nproc)" -C test/rb precross
+ make -j"$(nproc)" -C tutorial/rb
+
+ - name: Run cppcheck
+ run: |
# Ruby C extension error checks
# suppress missingIncludeSystem:lib/rb/ext/* -> Ruby and libc headers are not needed for analysis.
# suppress checkersReport -> hide info-only active-checker summary.
@@ -163,91 +331,42 @@ jobs:
--check-level=exhaustive \
--error-exitcode=1 lib/rb/ext
- - name: Run flake8
- id: flake8
- continue-on-error: true
- run: |
- make -j$(nproc) -C test/py precross
-
- flake8
-
- - name: Run phpcs
- id: phpcs
- continue-on-error: true
- run: |
- # PHP code style
- composer install --quiet
- ./vendor/bin/phpcs
-
- - name: Run phpstan
- id: phpstan
- continue-on-error: true
- run: |
- # PHP static analysis
- ./vendor/bin/phpstan analyse -c lib/php/phpstan.neon --no-progress --error-format=github
-
- name: Run rubocop
- id: rubocop
- continue-on-error: true
working-directory: "lib/rb"
run: |
- # The SCA configure args disable Ruby, so top-level precross skips Ruby targets.
- make -j$(nproc) -C ../../test/rb precross
- make -j$(nproc) -C ../../tutorial/rb
bundle exec rake gen-rb
bundle exec rubocop --config .rubocop.yml --format progress --format github . ../../test/rb ../../tutorial/rb
+ statistics:
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+
+ - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+ with:
+ go-version: "1.25"
+
+ - name: Install scc
+ run: |
+ go install github.com/boyter/scc/v3@v3.6.0
+
- name: Print statistics
- if: ${{ always() }}
run: |
# TODO etc
- echo "FIXMEs: $(grep -r FIXME * | wc -l)"
- echo "HACKs: $(grep -r HACK * | wc -l)"
- echo "TODOs: $(grep -r TODO * | wc -l)"
+ echo "FIXMEs: $(grep -r FIXME -- * | wc -l)"
+ echo "HACKs: $(grep -r HACK -- * | wc -l)"
+ echo "TODOs: $(grep -r TODO -- * | wc -l)"
# LoC
- sloccount .
+ scc .
# System info
# dpkg -l
uname -a
- - name: Fail if any SCA check failed
- if: ${{ always() && steps.compile.outcome == 'success' }}
- env:
- CPPCHECK_OUTCOME: ${{ steps.cppcheck.outcome }}
- FLAKE8_OUTCOME: ${{ steps.flake8.outcome }}
- PHPCS_OUTCOME: ${{ steps.phpcs.outcome }}
- PHPSTAN_OUTCOME: ${{ steps.phpstan.outcome }}
- RUBOCOP_OUTCOME: ${{ steps.rubocop.outcome }}
- run: |
- failed=0
-
- if [ "$CPPCHECK_OUTCOME" != "success" ]; then
- echo "::error::Step 'cppcheck' failed (outcome: $CPPCHECK_OUTCOME)"
- failed=1
- fi
- if [ "$FLAKE8_OUTCOME" != "success" ]; then
- echo "::error::Step 'flake8' failed (outcome: $FLAKE8_OUTCOME)"
- failed=1
- fi
- if [ "$PHPCS_OUTCOME" != "success" ]; then
- echo "::error::Step 'phpcs' failed (outcome: $PHPCS_OUTCOME)"
- failed=1
- fi
- if [ "$PHPSTAN_OUTCOME" != "success" ]; then
- echo "::error::Step 'phpstan' failed (outcome: $PHPSTAN_OUTCOME)"
- failed=1
- fi
- if [ "$RUBOCOP_OUTCOME" != "success" ]; then
- echo "::error::Step 'rubocop' failed (outcome: $RUBOCOP_OUTCOME)"
- failed=1
- fi
-
- exit $failed
-
zizmor:
- name: Run zizmor
runs-on: ubuntu-24.04
permissions:
security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
diff --git a/phpcs.xml.dist b/phpcs.xml.dist
index 180388aea98..23c6c9276f0 100644
--- a/phpcs.xml.dist
+++ b/phpcs.xml.dist
@@ -4,7 +4,7 @@
lib/php/lib
lib/php/test
- lib/php/test/packages/*
+ lib/php/test/Resources/packages/*