cppcheck.yml

name: cppcheck

on:
  workflow_call:
    inputs:
      preset:
        description: 'CMake configure preset (must produce compile_commands.json)'
        type: string
        default: 'clang-release'
      use_nix_conan:
        description: >-
          Run cppcheck inside a Nix shell with optional Conan install.
        type: boolean
        required: false
        default: false
      nix_runner:
        description: >-
          Runner label used when use_nix_conan=true (Linux/macOS only; Windows is rejected).
        type: string
        required: false
        default: ubuntu-latest
      nix_path:
        description: NIX_PATH passed to install-nix-action (pin nixpkgs source/channel).
        type: string
        required: false
        default: nixpkgs=channel:nixos-unstable
      nix_packages:
        description: Space-separated nixpkgs package names used for commands (cmake, ninja, conan, cppcheck, etc.).
        type: string
        required: false
        default: cmake ninja pkg-config conan python3 clang cppcheck
      conan_install:
        description: Run conan install before run-cppcheck.sh.
        type: boolean
        required: false
        default: true
      conanfile:
        description: >-
          Optional explicit Conan file path. If empty, conanfile.py or conanfile.txt at repo root is auto-detected.
        type: string
        required: false
        default: ''
      conan_profile:
        description: Conan profile to use for install (default profile is auto-detected/refreshed).
        type: string
        required: false
        default: default
      conan_install_args:
        description: Extra CLI args appended to conan install (space-separated).
        type: string
        required: false
        default: --build=missing
      conan_output_folder:
        description: Output folder for Conan generator files.
        type: string
        required: false
        default: build/conan
      default_setup_script:
        description: >-
          Optional repo-relative bash script run after checkout before configure.
          devenv/scripts/install-boost.sh uses the cached install-boost composite action.
        type: string
        required: false
        default: ''
      setup_boost:
        description: Install Boost via cached install-boost action (recommended).
        type: boolean
        required: false
        default: false
      boost_components:
        description: Boost components for vcpkg (comma-separated).
        type: string
        required: false
        default: property-tree
    secrets:
      checkout_token:
        description: >-
          Optional token with read access to private submodules (PAT or GitHub App installation token).
          When omitted, GITHUB_TOKEN is used (public submodules only).
        required: false

permissions:
  contents: read

jobs:
  full-project:
    name: full project
    if: ${{ !inputs.use_nix_conan }}
    runs-on: ubuntu-latest
    steps:
      - &checkout
        name: Checkout code
        uses: actions/checkout@v6.0.3
        with:
          submodules: 'recursive'
          token: ${{ secrets.checkout_token || secrets.GITHUB_TOKEN }}

      - &trust_workspace
        name: Trust workspace for git
        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"

      - &setup_dependencies
        name: Setup dependencies
        if: inputs.setup_boost || inputs.default_setup_script != ''
        uses: devmarkusb/devenv/.github/actions/setup-dependencies@main
        with:
          setup_boost: ${{ inputs.setup_boost }}
          boost_components: ${{ inputs.boost_components }}
          default_setup_script: ${{ inputs.default_setup_script }}

      - name: Run cppcheck
        shell: bash
        env:
          PRESET: ${{ inputs.preset }}
        run: ./devenv/scripts/run-cppcheck.sh "${PRESET}"

  full-project-nix:
    name: full project (nix+conan)
    if: ${{ inputs.use_nix_conan }}
    runs-on: ${{ inputs.nix_runner }}
    steps:
      - *checkout

      - *trust_workspace

      - name: Validate runner
        shell: bash
        env:
          RUNNER_NAME: ${{ inputs.nix_runner }}
        run: |
          set -euo pipefail
          if [[ "${RUNNER_NAME}" == windows* ]]; then
            echo "::error::cppcheck.yml with use_nix_conan=true does not support Windows runners."
            exit 1
          fi

      - *setup_dependencies

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          nix_path: ${{ inputs.nix_path }}

      - name: Run cppcheck (nix + conan)
        shell: bash
        env:
          PRESET: ${{ inputs.preset }}
          NIX_PACKAGES: ${{ inputs.nix_packages }}
          CONAN_INSTALL_ENABLED: ${{ toJSON(inputs.conan_install) }}
          CONANFILE_INPUT: ${{ inputs.conanfile }}
          CONAN_PROFILE: ${{ inputs.conan_profile }}
          CONAN_INSTALL_ARGS: ${{ inputs.conan_install_args }}
          CONAN_OUTPUT_FOLDER: ${{ inputs.conan_output_folder }}
        run: |
          set -euo pipefail

          read -r -a package_names <<< "${NIX_PACKAGES}"
          if [[ ${#package_names[@]} -eq 0 ]]; then
            echo "::error::nix_packages is empty."
            exit 1
          fi

          installables=()
          for package_name in "${package_names[@]}"; do
            installables+=("nixpkgs#${package_name}")
          done

          run_in_nix() {
            nix shell "${installables[@]}" --command "$@"
          }

          echo "Tool versions:"
          run_in_nix cmake --version
          run_in_nix ninja --version
          run_in_nix conan --version
          run_in_nix cppcheck --version

          if [[ "${CONAN_INSTALL_ENABLED}" == "true" ]]; then
            conanfile_path="${CONANFILE_INPUT}"
            if [[ -z "${conanfile_path}" ]]; then
              if [[ -f "conanfile.py" ]]; then
                conanfile_path="conanfile.py"
              elif [[ -f "conanfile.txt" ]]; then
                conanfile_path="conanfile.txt"
              fi
            fi

            if [[ -n "${conanfile_path}" ]]; then
              read -r -a conan_extra_args <<< "${CONAN_INSTALL_ARGS}"
              run_in_nix conan profile detect --force
              run_in_nix conan install \
                "${conanfile_path}" \
                --profile "${CONAN_PROFILE}" \
                --output-folder "${CONAN_OUTPUT_FOLDER}" \
                "${conan_extra_args[@]}"
            else
              echo "No conanfile.py/conanfile.txt found; skipping conan install."
            fi
          fi

          run_in_nix ./devenv/scripts/run-cppcheck.sh "${PRESET}"