RTOS/.gitea/workflows/static-analysis.yml

/**
 * @file static-analysis.yml
 * @brief Gitea workflow for static analysis
 */

name: Static Analysis

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:
  schedule:
    - cron: '0 2 * * 1'  # Weekly on Monday at 2 AM

env:
  PROJECT_NAME: automotive-rtos
  BUILD_DIR: build/analysis

jobs:
  # Cppcheck analysis
  cppcheck:
    name: Cppcheck Analysis
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/automotive-rtos/build-env:latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Run cppcheck
        run: |
          mkdir -p ${{ env.BUILD_DIR }}/cppcheck

          cppcheck \
            --enable=all \
            --inconclusive \
            --std=c11 \
            --platform=arm32 \
            --force \
            --inline-suppr \
            -Ikernel/include \
            -Idrivers/include \
            -Imiddleware \
            -Iconfig \
            --suppress=missingInclude \
            --suppress=missingIncludeSystem \
            --suppress=unusedFunction \
            --xml \
            --xml-version=2 \
            kernel drivers middleware applications \
            2> ${{ env.BUILD_DIR }}/cppcheck/cppcheck.xml

          # Convert to HTML
          cppcheck-htmlreport \
            --file=${{ env.BUILD_DIR }}/cppcheck/cppcheck.xml \
            --report-dir=${{ env.BUILD_DIR }}/cppcheck/html \
            --source-dir=.

      - name: Upload cppcheck report
        uses: actions/upload-artifact@v3
        with:
          name: cppcheck-report
          path: ${{ env.BUILD_DIR }}/cppcheck/

      - name: Check for critical issues
        run: |
          critical_count=$(grep -c 'severity="error"' ${{ env.BUILD_DIR }}/cppcheck/cppcheck.xml || true)
          echo "Critical issues: $critical_count"

          if [ "$critical_count" -gt 0 ]; then
            echo "❌ Critical issues found"
            exit 1
          fi

  # MISRA C compliance
  misra-compliance:
    name: MISRA C:2012 Compliance
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/automotive-rtos/build-env:latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Run MISRA check
        run: |
          mkdir -p ${{ env.BUILD_DIR }}/misra

          # Check if MISRA addon is available
          if [ -f "/usr/share/cppcheck/addons/misra.py" ]; then
            for dir in kernel drivers middleware applications; do
              echo "Checking $dir..."
              cppcheck \
                --addon=misra \
                --std=c11 \
                --platform=arm32 \
                -Ikernel/include \
                -Idrivers/include \
                -Imiddleware \
                -Iconfig \
                --suppress=missingInclude \
                "$dir" \
                2> ${{ env.BUILD_DIR }}/misra/${dir}_misra.log || true
            done

            # Count violations
            total_violations=0
            for log in ${{ env.BUILD_DIR }}/misra/*_misra.log; do
              violations=$(grep -c "misra" "$log" || true)
              total_violations=$((total_violations + violations))
              echo "$(basename $log): $violations violations"
            done

            echo "Total MISRA violations: $total_violations"

            # Check against threshold
            if [ "$total_violations" -gt 100 ]; then
              echo "❌ Too many MISRA violations"
              exit 1
            fi
          else
            echo "⚠ MISRA addon not available"
          fi

      - name: Upload MISRA report
        uses: actions/upload-artifact@v3
        with:
          name: misra-report
          path: ${{ env.BUILD_DIR }}/misra/

  # Compiler warnings
  compiler-warnings:
    name: Compiler Warnings Check
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/automotive-rtos/build-env:latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Check compiler warnings
        run: |
          mkdir -p ${{ env.BUILD_DIR }}/compiler

          # Compile with strict warnings
          find kernel drivers middleware applications -name "*.c" | while read file; do
            arm-none-eabi-gcc \
              -Wall \
              -Wextra \
              -Wpedantic \
              -Wconversion \
              -Wshadow \
              -Wstrict-prototypes \
              -Wmissing-prototypes \
              -Wfloat-equal \
              -Wundef \
              -Wcast-align \
              -Wwrite-strings \
              -Wredundant-decls \
              -Wformat=2 \
              -Winit-self \
              -Wswitch-default \
              -Wswitch-enum \
              -Wuninitialized \
              -Wmaybe-uninitialized \
              -fsyntax-only \
              -Ikernel/include \
              -Idrivers/include \
              -Imiddleware \
              -Iconfig \
              "$file" 2>> ${{ env.BUILD_DIR }}/compiler/warnings.log
          done

          warning_count=$(grep -c "warning" ${{ env.BUILD_DIR }}/compiler/warnings.log || true)
          echo "Total warnings: $warning_count"

          if [ "$warning_count" -gt 50 ]; then
            echo "❌ Too many compiler warnings"
            exit 1
          fi

      - name: Upload warnings report
        uses: actions/upload-artifact@v3
        with:
          name: compiler-warnings
          path: ${{ env.BUILD_DIR }}/compiler/

  # Code complexity analysis
  complexity:
    name: Code Complexity Analysis
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/automotive-rtos/build-env:latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Install lizard
        run: |
          pip3 install lizard

      - name: Run complexity analysis
        run: |
          mkdir -p ${{ env.BUILD_DIR }}/complexity

          lizard \
            --CCN 10 \
            --length 100 \
            --arguments 6 \
            --html \
            kernel drivers middleware applications \
            > ${{ env.BUILD_DIR }}/complexity/complexity.html

          # Check for high complexity functions
          high_complexity=$(lizard --CCN 20 kernel drivers middleware applications | grep -c "warning" || true)
          echo "High complexity functions: $high_complexity"

          if [ "$high_complexity" -gt 10 ]; then
            echo "⚠ High code complexity detected"
          fi

      - name: Upload complexity report
        uses: actions/upload-artifact@v3
        with:
          name: complexity-report
          path: ${{ env.BUILD_DIR }}/complexity/

  # Generate analysis summary
  analysis-summary:
    name: Generate Analysis Summary
    needs: [cppcheck, misra-compliance, compiler-warnings, complexity]
    if: always()
    runs-on: ubuntu-latest

    steps:
      - name: Download reports
        uses: actions/download-artifact@v3
        with:
          path: analysis-results

      - name: Generate summary
        run: |
          echo "# Static Analysis Summary" > analysis-summary.md
          echo "" >> analysis-summary.md
          echo "Date: $(date)" >> analysis-summary.md
          echo "" >> analysis-summary.md

          echo "## Results" >> analysis-summary.md
          echo "" >> analysis-summary.md

          for report_dir in analysis-results/*/; do
            if [ -d "$report_dir" ]; then
              echo "### $(basename $report_dir)" >> analysis-summary.md
              echo "" >> analysis-summary.md

              # List files
              find "$report_dir" -type f | while read file; do
                echo "- $(basename $file)" >> analysis-summary.md
              done

              echo "" >> analysis-summary.md
            fi
          done

      - name: Upload summary
        uses: actions/upload-artifact@v3
        with:
          name: analysis-summary
          path: analysis-summary.md

  # Notify on failure
  notify:
    name: Notify on Failure
    needs: [cppcheck, misra-compliance, compiler-warnings, complexity]
    if: failure()
    runs-on: ubuntu-latest

    steps:
      - name: Send notification
        run: |
          echo "Static analysis failed!"
          echo "Branch: ${{ github.ref }}"
          echo "Commit: ${{ github.sha }}"

          # Send webhook notification
          if [ -n "${{ secrets.WEBHOOK_URL }}" ]; then
            curl -X POST \
              -H "Content-Type: application/json" \
              -d '{
                "text": "Static analysis failed for commit '"${{ github.sha }}"'",
                "branch": "'"${{ github.ref }}"'"
              }' \
              "${{ secrets.WEBHOOK_URL }}"
          fi