Commit 4e20cfc3 authored by Ruben ten Hove's avatar Ruben ten Hove
Browse files

Merge branch 'nautajc-static-analysis' into 'master' 

feat: added c pipeline with cppcheck and flawfinder.

See merge request ci/templates!12
parents b2d4132a 57601d99

.gitlab-ci.yml

+13 −0
Original line number Diff line number Diff line
@@ -16,6 +16,9 @@ include: 
  - local: 'python/pylint.yml'

  - local: 'python/safety.yml'



  - local: 'c/cppcheck.yml'

  - local: 'c/flawfinder.yml'



  - local: 'yaml/yamllint.yml'



docker:kaniko:
@@ -38,6 +41,16 @@ python:pytest: 
    # Not happy with this, but we need it so --cov works, without breaking other jobs

    PYTHON_PACKAGE: mypackage



c:cppcheck:

  variables:

    ERROR_EXIT_CODE: 0

    CHECK_PATH: templates_tests/c



c:flawfinder:

  variables:

    ERROR_LEVEL: "6"

    CHECK_PATH: templates_tests/c



workflow:

  rules:

    # Run if we're in a merge request

c/cppcheck.yml

0 → 100644
+17 −0
Original line number Diff line number Diff line 
c:cppcheck:

  stage: test

  image: registry.gitlab.com/notno/test/c:latest

  variables:

    CHECK_PATH: "."  # Can be a file

    DEFAULT_ARGS: "--report-progress --verbose"

    EXTRA_ARGS: ""

    ENABLE: "all"

    ERROR_EXIT_CODE: 1  # Which exit code on failure

  script:

    - cppcheck --xml-version=2 ${DEFAULT_ARGS} ${EXTRA_ARGS} --enable=${ENABLE} --error-exitcode=0 ${CHECK_PATH} 2> cppcheck-result.xml

    - cppcheck_junit cppcheck-result.xml cppcheck-junit.xml

    - cppcheck ${EXTRA_ARGS} --enable=${ENABLE} --error-exitcode=${ERROR_EXIT_CODE} ${CHECK_PATH}

  needs: []

  artifacts:

    reports:

      junit: cppcheck-junit.xml

c/flawfinder.yml

0 → 100644
+12 −0
Original line number Diff line number Diff line 
c:flawfinder:

  stage: test

  image: registry.gitlab.com/notno/test/c:latest

  variables:

    ERROR_LEVEL: "3"

    MIN_LEVEL: "1"

    DEFAULT_ARGS: "--falsepositive --immediate --context"

    EXTRA_ARGS: ""

    CHECK_PATH: "."  # Can be a file

  script:

    - flawfinder ${DEFAULT_ARGS} ${EXTRA_ARGS} --minlevel ${MIN_LEVEL} --error-level=${ERROR_LEVEL} ${CHECK_PATH}

  needs: []

pipelines/c-basic.yml

0 → 100644
+6 −0
Original line number Diff line number Diff line 
variables:

  FLAWFINDER_ERROR_LEVEL: "3"

  DIRECTORIES: "."

include:

  - local: 'C/flawfinder.yml'

  - local: 'C/cppcheck.yml'

templates_tests/c/broken/example.c

0 → 100644
+14 −0
Original line number Diff line number Diff line 
#include "stdio.h"



void foo(int x)

{

    int buf[10];

    buf[x] = 0; // <- ERROR

    if (x == 1000) {}

}



int main() {

  int num;

  scanf("%d", &num);

  foo(num);

}