From f55dc51f42576fbbc5912a3fbb77e156158b844b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Thu, 26 Sep 2019 14:47:04 +0200
Subject: [PATCH] Add Cppcheck job to the CI

This MR changes the default Debian sid build to wrap make with bear
that creates compilation database and use the compilation database
to run Cppcheck on the source files systematically.

The job is currently set to be allowed to fail as it will take some
time to fix all the Cppcheck detected issues.
---
 .gitignore     |  3 +++
 .gitlab-ci.yml | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1f4d9e378f..55bc4ffdd4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -56,3 +56,6 @@ kyua.log
 named.memstats
 named.run
 timestamp
+/compile_commands.json
+/cppcheck_html/
+/cppcheck.results
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 041f10cd36..c985152e39 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,6 +15,8 @@ variables:
   BUILD_PARALLEL_JOBS: 6
   TEST_PARALLEL_JOBS: 6
 
+  MAKE: make
+
 stages:
   - precheck
   - build
@@ -22,6 +24,7 @@ stages:
   - system
   - docs
   - push
+  - postcheck
 
 ### Runner Tag Templates
 
@@ -162,7 +165,7 @@ stages:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
   script:
     - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
     - test -z "${RUN_MAKE_INSTALL}" || make install
   dependencies:
     - autoreconf:sid:amd64
@@ -221,6 +224,39 @@ stages:
     expire_in: "1 week"
     when: on_failure
 
+.cppcheck_args: &run_cppcheck |
+  cppcheck --enable=warning,performance,portability,information,missingInclude \
+           --include=config.h \
+           --quiet \
+           --std=c11 \
+           --language=c \
+           --project=compile_commands.json \
+           --error-exitcode=2 \
+           -j ${TEST_PARALLEL_JOBS:-1} \
+           --xml \
+           --output-file=cppcheck.results \
+           --inline-suppr
+
+.cppcheck_report: &cppcheck_report_html |
+  cppcheck-htmlreport --title="BIND 9 ($CI_COMMIT_SHORT_SHA) Cppcheck Report" \
+                      --file=cppcheck.results \
+                      --report-dir=cppcheck_html/
+
+.cppcheck: &cppcheck_job
+  <<: *default_triggering_rules
+  stage: postcheck
+  script:
+    - *run_cppcheck
+  after_script:
+    - *cppcheck_report_html
+  artifacts:
+    paths:
+      - compile_commands.json
+      - cppcheck.results
+      - cppcheck_html/
+    expire_in: "1 week"
+    when: on_failure
+
 ### Job Definitions
 
 # Jobs in the precheck stage
@@ -437,6 +473,7 @@ gcc:sid:amd64:
     CFLAGS: "-Wall -Wextra -O3 -g"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
     RUN_MAKE_INSTALL: 1
+    MAKE: bear make
   <<: *debian_sid_amd64_image
   <<: *build_job
 
@@ -454,6 +491,13 @@ unit:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
+cppcheck:gcc:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *cppcheck_job
+  dependencies:
+    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
+
 # Jobs for regular GCC builds on Debian Sid (i386)
 
 gcc:sid:i386: