OpENer/.github/workflows/exhaustive-analysis.yml

# .github/workflows/exhaustive-analysis.yml
# Thorough static analysis for releases and scheduled runs
---
name: Exhaustive Analysis

on:
  # Run on release branches and tags
  push:
    branches:
      - "release/**"
    tags:
      - "v*"

  # Nightly exhaustive analysis
  schedule:
    - cron: "0 3 * * *" # 3 AM UTC daily

  # Manual trigger
  workflow_dispatch:

permissions:
  contents: read
  issues: write
  pull-requests: write

env:
  BUILD_TYPE: Release

jobs:
  exhaustive-lint:
    name: Exhaustive Static Analysis
    runs-on: ubuntu-latest
    timeout-minutes: 90

    steps:
      - name: Checkout Code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
        with:
          fetch-depth: 0

      - name: MegaLinter (Exhaustive)
        uses: oxsecurity/megalinter/flavors/c_cpp@55a59b24a441e0e1943080d4a512d827710d4a9d
        id: ml
        env:
          VALIDATE_ALL_CODEBASE: true
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DISABLE_LINTERS: SPELL_CSPELL
          DISABLE_ERRORS: false
          # Exhaustive cppcheck analysis
          C_CPPCHECK_ARGUMENTS: >-
            --check-level=exhaustive
            --inline-suppr
            --enable=warning,style,performance,portability
            --std=c99
            --platform=unix64
            --suppress=missingIncludeSystem
            --suppress=missingInclude

      - name: Archive Exhaustive Reports
        if: always()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
        with:
          name: megalinter-exhaustive-reports
          path: |
            megalinter-reports
            mega-linter.log
          retention-days: 30

      - name: Create Issue on Failure
        if: failure() && github.event_name == 'schedule'
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        with:
          script: |
            const runUrl = `https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}`;
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: '🔍 Exhaustive Static Analysis Failed',
              body: `The nightly exhaustive static analysis has detected issues.

              **Run:** ${runUrl}
              **Date:** ${new Date().toISOString()}

              Please review the analysis reports in the workflow artifacts.`,
              labels: ['automated', 'static-analysis']
            });

  build-release:
    name: Build & Test (Release Config)
    runs-on: ubuntu-latest
    needs: exhaustive-lint
    if: success()

    steps:
      - name: Checkout Code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
        with:
          fetch-depth: 0

      - name: Install Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libcap-dev \
            lcov \
            cpputest

      - name: Set up Python
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548
        with:
          python-version: "3.11"

      - name: Install gcovr
        run: pip install gcovr

      - name: Configure CMake (Release)
        run: |
          cmake -S ${{ github.workspace }}/source \
            -B ${{ github.workspace }}/build \
            -DCMAKE_BUILD_TYPE=Release \
            -DOpENer_PLATFORM:STRING="POSIX" \
            -DBUILD_SHARED_LIBS:BOOL=OFF \
            -DOpENer_TRACES:BOOL=OFF \
            -DOpENer_TESTS:BOOL=ON \
            -DCPPUTEST_HOME:PATH=/usr \
            -DCMAKE_C_FLAGS="-O2 -Wall -Wextra -Werror"

      - name: Build
        run: cmake --build "${{ github.workspace }}/build" --config Release -j "$(nproc)"

      - name: Test
        working-directory: ${{ github.workspace }}/build
        run: ctest -C Release --output-on-failure --parallel "$(nproc)"

      - name: Generate Release Coverage
        run: |
          gcovr --html-details --output coverage-release.html
          gcovr --cobertura --output coverage-release.xml
          gcovr --print-summary | tee coverage-release-summary.txt

      - name: Upload Release Artifacts
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
        with:
          name: release-build-artifacts
          path: |
            ${{ github.workspace }}/build
            coverage-release*.html
            coverage-release.xml
            coverage-release-summary.txt
          retention-days: 90