7b097fbdd1
Some checks failed
C++ Tests / test-fast (pull_request) Successful in 2m2s
API Docs / doc-build (pull_request) Successful in 46s
Markdown link check / check (pull_request) Successful in 47s
C++ Tests / test-cgal (pull_request) Failing after 10m51s
C++ Tests / quality-gates (pull_request) Successful in 2m21s
Two reviewer-facing additions:
1. New `quality-gates` job in .gitea/workflows/cpp-tests.yml
──────────────────────────────────────────────────────────
Runs in parallel with test-cgal after test-fast. Installs
`codespell` + `shellcheck` (apt) into the existing ci-cpp container,
then executes four scripts strictly (exit 1 on any finding):
* license-headers.sh — 66/66 files carry SPDX MIT
* cgal-conventions.py — 0 violations across 6 CGAL public headers
* codespell.sh — 0 typos across docs + source + scripts
* shellcheck.sh — 0 findings across 16 shell scripts
Each ran at 0 findings locally for weeks before promotion. The
gates are now contractual: a regression fails the PR. Total
wall-time on the eulernest runner: ~30 s.
2. New code/deps/THIRD-PARTY-LICENSES.md
──────────────────────────────────────
Enumerates every vendored dependency under code/deps/, plus the
auto-fetched GoogleTest, plus the system-required Boost, with:
* upstream project + version + SPDX identifier
* compatibility note for MIT distribution
* a downstream-packager license matrix (header-only consumer
vs CLI binary) clarifying the LGPL §3 vs §4 distinction
relevant to CGAL's header-only consumption
Required for any future Linux-distribution packaging and for the
CGAL submission's compliance check. Cross-referenced from
doc/architecture/dependencies.md.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
98 lines
3.0 KiB
Bash
Executable File
98 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# scripts/quality/cppcheck.sh
|
|
#
|
|
# Run cppcheck over the public headers. Complementary to clang-tidy:
|
|
# cppcheck has different heuristics, fewer false-positives on heavy
|
|
# template code (CGAL/Eigen), and catches some bugs (unused includes,
|
|
# memory leaks in detail/) that clang-tidy is bad at.
|
|
#
|
|
# Local-only. Promotion to CI when the existing tree is finding-free
|
|
# at the chosen severity level.
|
|
#
|
|
# Usage:
|
|
# bash scripts/quality/cppcheck.sh # error+warning only
|
|
# bash scripts/quality/cppcheck.sh --strict # +style, exit 1 on any
|
|
# bash scripts/quality/cppcheck.sh --all # absolute everything,
|
|
# useful for diffs only
|
|
#
|
|
# Exit codes:
|
|
# 0 no findings at the chosen severity, or findings but not --strict
|
|
# 1 findings + --strict
|
|
# 2 prerequisite missing
|
|
|
|
set -uo pipefail
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd "$ROOT" || exit 2
|
|
|
|
command -v cppcheck >/dev/null 2>&1 || {
|
|
echo "FAIL: cppcheck not in PATH." >&2
|
|
echo " macOS: brew install cppcheck" >&2
|
|
echo " Linux: sudo apt install cppcheck" >&2
|
|
exit 2
|
|
}
|
|
|
|
STRICT=0
|
|
ALL=0
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--strict) STRICT=1 ;;
|
|
--all) ALL=1 ;;
|
|
*) echo "Unknown arg: $arg" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
ENABLE="warning"
|
|
if [ "$STRICT" -eq 1 ]; then ENABLE="warning,style"; fi
|
|
if [ "$ALL" -eq 1 ]; then ENABLE="all"; fi
|
|
|
|
BUILD_DIR="build-cppcheck"
|
|
LOG="$BUILD_DIR/cppcheck.log"
|
|
mkdir -p "$BUILD_DIR"
|
|
|
|
echo "cppcheck ($(cppcheck --version 2>&1 | head -1))"
|
|
echo " enable: $ENABLE"
|
|
echo " log: $LOG"
|
|
echo
|
|
|
|
# Suppress noise classes that are not actionable in our project:
|
|
# missingIncludeSystem — CGAL/Eigen/Boost headers are intentionally
|
|
# included implicitly; cppcheck cannot resolve.
|
|
# unmatchedSuppression — cosmetic.
|
|
# unusedFunction — header-only; many `inline` helpers ARE used,
|
|
# cppcheck can't see across TUs.
|
|
# normalCheckLevelMaxBranches — informational, not a finding.
|
|
#
|
|
# We point cppcheck at code/include/ only. The deps tree is third-party
|
|
# code and out of scope.
|
|
|
|
cppcheck \
|
|
--enable="$ENABLE" \
|
|
--std=c++17 \
|
|
--quiet \
|
|
--error-exitcode=2 \
|
|
--inline-suppr \
|
|
--suppress=missingIncludeSystem \
|
|
--suppress=unmatchedSuppression \
|
|
--suppress=unusedFunction \
|
|
--suppress=normalCheckLevelMaxBranches \
|
|
-I code/include \
|
|
code/include 2>&1 | tee "$LOG"
|
|
rc=$?
|
|
|
|
echo
|
|
echo "── Summary ──"
|
|
n=$(grep -cE "\[(error|warning|style|performance|portability)\]" "$LOG" || true)
|
|
echo " total findings: $n"
|
|
echo " full log: $LOG"
|
|
|
|
if [ "$STRICT" -eq 1 ] && [ "$n" -gt 0 ]; then
|
|
exit 1
|
|
fi
|
|
if [ "$rc" -eq 2 ] && [ "$STRICT" -ne 1 ]; then
|
|
# cppcheck signalled "error" severity but caller didn't ask --strict.
|
|
echo
|
|
echo "NOTE: cppcheck reported an `error`-severity finding. Even"
|
|
echo " without --strict, please review the log."
|
|
fi
|
|
exit 0
|