Martin Vogel
64bd272cb2
scripts/ci/lint-mem.sh and scripts/ci/msan-lane.sh were committed at mode 100644, so the workflow step that runs them directly died with "Permission denied" (exit 126). scripts/lint-mem-gate.py gets the same treatment: it is invoked through python3 today, but it carries a shebang and should not depend on that. The exec-bit contract already exists to catch precisely this, and it did not, because it derives its candidate set from `git ls-files -s '*.sh'` -- tracked files only. A brand-new script is invisible there until it is committed, so the check passes on the run where the defect is introduced and only starts failing on the run that ships it. The window where the contract is most useful was the one window it could not see. It now also considers not-yet-tracked scripts by their filesystem mode. Verified against the real defect rather than in the abstract: with lint-mem.sh untracked and non-executable the contract reports "_lint.yml:76 executes scripts/ci/lint-mem.sh directly, but its committed mode is 100644", and passes once the bit is set. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
21 lines
762 B
Bash
Executable File
21 lines
762 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# clang-analyzer memory gate — the canonical entry, used by every venue.
|
|
#
|
|
# Path-sensitive analysis for leak paths, null derefs and uninitialized reads.
|
|
# Findings are gated: each one is either fixed, or carries an argued entry in
|
|
# scripts/lint-mem-whitelist.txt that is pinned to the sha256 of the function
|
|
# it argues about, so it expires when that function changes. See
|
|
# scripts/lint-mem-gate.py.
|
|
#
|
|
# Locally: make -f Makefile.cbm lint-mem-ci (or `lint-mem` for the
|
|
# non-gating triage view over the same checks).
|
|
#
|
|
# Usage: scripts/ci/lint-mem.sh [CLANG_TIDY_BINARY]
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/../.."
|
|
|
|
CLANG_TIDY_BIN="${1:-${CLANG_TIDY:-clang-tidy}}"
|
|
|
|
exec make -f Makefile.cbm lint-mem-ci CLANG_TIDY="$CLANG_TIDY_BIN"
|