Problem
We have basic GitHub Actions CI but no static analysis. For a C codebase handling network protocols, static analysis catches buffer overflows, null pointer dereferences, and memory leaks that testing alone may miss.
Prior Art
- mtg: CodeQL + govulncheck in GitHub Actions
- Industry standard for C projects: clang-tidy, cppcheck, Coverity
Proposed Tools
clang-tidy (recommended)
- Best integration with Clang/LLVM toolchain
- Checks:
bugprone-*, security-*, cert-*, clang-analyzer-*
- Can fix some issues automatically
cppcheck
- Standalone, no build system integration needed
- Good at finding buffer overflows and undefined behavior
- Low false positive rate
CodeQL (GitHub-native)
- Free for open-source repos
- Runs as GitHub Action
- Catches security-relevant patterns (CWEs)
Proposed CI Addition
- name: Static Analysis
run: |
apt-get install -y cppcheck
cppcheck --enable=warning,security --error-exitcode=1 \
--suppress=missingInclude \
net/ mtproto/ common/ crypto/ engine/Priority
Low-effort addition to existing CI. Can start with cppcheck (zero config) and add clang-tidy later.
Problem
We have basic GitHub Actions CI but no static analysis. For a C codebase handling network protocols, static analysis catches buffer overflows, null pointer dereferences, and memory leaks that testing alone may miss.
Prior Art
Proposed Tools
clang-tidy (recommended)
bugprone-*,security-*,cert-*,clang-analyzer-*cppcheck
CodeQL (GitHub-native)
Proposed CI Addition
Priority
Low-effort addition to existing CI. Can start with
cppcheck(zero config) and addclang-tidylater.