Merge branch 'main' into remove_unused_includes

Author: vil02

.github/workflows/CI-cygwin.yml

@@ -37,12 +37,12 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Set up Cygwin
-        uses: cygwin/cygwin-install-action@master
+        uses: cygwin/cygwin-install-action@v6
         with:
           site: https://mirrors.cicku.me/cygwin/
           platform: ${{ matrix.platform }}

.github/workflows/CI-mingw.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 19 # max + 3*std of the last 7K runs
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -49,7 +49,7 @@ jobs:
             mingw-w64-x86_64-gcc
 
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.24
         with:
           key: ${{ github.workflow }}-${{ github.job }}-${{ matrix.os }}
 

.github/workflows/CI-unixish-docker.yml

@@ -43,7 +43,7 @@ jobs:
       image: ${{ matrix.image }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -66,13 +66,13 @@ jobs:
       # needs to be called after the package installation since
       # - it doesn't call "apt-get update"
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.24
         with:
           key: ${{ github.workflow }}-${{ matrix.image }}
 
       - name: Run CMake
         run: |
-          cmake -S . -B cmake.output -Werror=dev -DHAVE_RULES=On -DBUILD_TESTING=On -DBUILD_GUI=${{ matrix.with_gui }} -DWITH_QCHART=On -DBUILD_TRIAGE=${{ matrix.with_gui }} -DCMAKE_COMPILE_WARNING_AS_ERROR=On -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+          cmake -S . -B cmake.output -Werror=dev --warn-uninitialized -DHAVE_RULES=On -DBUILD_TESTING=On -DBUILD_GUI=${{ matrix.with_gui }} -DWITH_QCHART=On -DBUILD_TRIAGE=${{ matrix.with_gui }} -DCMAKE_COMPILE_WARNING_AS_ERROR=On -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
 
       - name: CMake build
         if: matrix.full_build
@@ -96,7 +96,7 @@ jobs:
       image: ${{ matrix.image }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -114,7 +114,7 @@ jobs:
       # needs to be called after the package installation since
       # - it doesn't call "apt-get update"
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.24
         with:
           key: ${{ github.workflow }}-${{ matrix.image }}
 

.github/workflows/CI-unixish.yml

@@ -31,7 +31,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -47,29 +47,30 @@ jobs:
           modules: 'qtcharts'
           setup-python: 'false'
           cache: true
-          aqtversion: '==3.1.*'  # TODO: remove when aqtinstall 3.2.2 is available
 
       - name: Run CMake
         run: |
           rem TODO: enable rules?
-          rem specify Release build so matchcompiler is used
-          cmake -S . -B build -Werror=dev -DCMAKE_BUILD_TYPE=Release -DCMAKE_COMPILE_WARNING_AS_ERROR=On -DBUILD_TESTING=Off -DBUILD_GUI=On -DWITH_QCHART=On -DBUILD_TRIAGE=On -DBUILD_ONLINE_HELP=On -DCMAKE_INSTALL_PREFIX=cppcheck-cmake-install -DCMAKE_COMPILE_WARNING_AS_ERROR=On || exit /b !errorlevel!
+          cmake -S . -B build -Werror=dev --warn-uninitialized -DCMAKE_BUILD_TYPE=Debug -DCMAKE_COMPILE_WARNING_AS_ERROR=On -DBUILD_TESTING=Off -DBUILD_GUI=On -DWITH_QCHART=On -DBUILD_TRIAGE=On -DBUILD_ONLINE_HELP=On -DISABLE_DMAKE=On -DCMAKE_INSTALL_PREFIX=cppcheck-cmake-install -DCMAKE_COMPILE_WARNING_AS_ERROR=On || exit /b !errorlevel!
 
-      - name: Build GUI release
+      - name: Build GUI
         run: |
-          cmake --build build --target cppcheck-gui --config Release || exit /b !errorlevel!
+          cmake --build build --config Debug --target cppcheck-gui || exit /b !errorlevel!
 
+      # TODO: can this be done in CMake?
       - name: Deploy GUI
         run: |
-          windeployqt build\bin\Release || exit /b !errorlevel!
-          del build\bin\Release\cppcheck-gui.ilk || exit /b !errorlevel!
-          del build\bin\Release\cppcheck-gui.pdb || exit /b !errorlevel!
+          windeployqt --no-translations build\bin\Debug || exit /b !errorlevel!
+          del build\bin\Debug\cppcheck-gui.pdb || exit /b !errorlevel!
 
       # TODO: run GUI tests
 
       - name: Run CMake install
         run: |
-          cmake --build build --target install
+          rem TODO: the Qt DLLs are not being installed
+          cmake --build build --config Debug --target install
+          rem TODO: validate the installed files
+          rem TODO: the structure does not match an actual Windows installation
 
   build_cmake_cxxstd:
     strategy:
@@ -81,7 +82,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -92,7 +93,7 @@ jobs:
 
       - name: Run CMake
         run: |
-          cmake -S . -B build.cxxstd -Werror=dev -G "Visual Studio 17 2022" -A x64 -DCMAKE_CXX_STANDARD=${{ matrix.cxxstd }} -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=On -DCMAKE_COMPILE_WARNING_AS_ERROR=On || exit /b !errorlevel!
+          cmake -S . -B build.cxxstd -Werror=dev --warn-uninitialized -A x64 -DCMAKE_CXX_STANDARD=${{ matrix.cxxstd }} -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=On -DCMAKE_COMPILE_WARNING_AS_ERROR=On || exit /b !errorlevel!
 
       - name: Build
         run: |
@@ -107,7 +108,7 @@ jobs:
       CMAKE_VERSION_FULL: 3.22.6
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -128,17 +129,16 @@ jobs:
           modules: 'qtcharts'
           setup-python: 'false'
           cache: true
-          aqtversion: '==3.1.*'  # TODO: remove when aqtinstall 3.2.2 is available
 
       - name: Run CMake (without GUI)
         run: |
           :: TODO: enable DHAVE_RULES?
-          cmake-${{ env.CMAKE_VERSION_FULL }}-windows-x86_64\bin\cmake.exe -S . -B cmake.output -G "Visual Studio 17 2022" -A x64 -DHAVE_RULES=Off -DBUILD_TESTING=On
+          cmake-${{ env.CMAKE_VERSION_FULL }}-windows-x86_64\bin\cmake.exe -S . -B cmake.output -A x64 -DHAVE_RULES=Off -DBUILD_TESTING=On
 
       - name: Run CMake (with GUI)
         run: |
           :: TODO: enable DHAVE_RULES?
-          cmake-${{ env.CMAKE_VERSION_FULL }}-windows-x86_64\bin\cmake.exe -S . -B cmake.output.gui -G "Visual Studio 17 2022" -A x64 -DHAVE_RULES=Off -DBUILD_TESTING=On -DBUILD_GUI=On -DWITH_QCHART=On -DBUILD_TRIAGE=On
+          cmake-${{ env.CMAKE_VERSION_FULL }}-windows-x86_64\bin\cmake.exe -S . -B cmake.output.gui -A x64 -DHAVE_RULES=Off -DBUILD_TESTING=On -DBUILD_GUI=On -DWITH_QCHART=On -DBUILD_TRIAGE=On
 
   build:
     strategy:
@@ -154,13 +154,13 @@ jobs:
       PCRE_VERSION: 8.45
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Set up Python
         if: matrix.config == 'release'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.14'
           check-latest: true
@@ -172,7 +172,7 @@ jobs:
 
       - name: Cache PCRE
         id: cache-pcre
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             externals\pcre.h
@@ -219,7 +219,7 @@ jobs:
 
       - name: Run Debug test
         if: matrix.config == 'debug'
-        run: .\bin\debug\testrunner.exe || exit /b !errorlevel!
+        run: .\bin\debug\testrunner.exe -t || exit /b !errorlevel!
 
       - name: Build CLI release configuration using MSBuild
         if: matrix.config == 'release'
@@ -272,7 +272,7 @@ jobs:
       - name: Test SEH wrapper
         if: matrix.config == 'release'
         run: |
-          cmake -S . -B build.cmake.seh -Werror=dev -DBUILD_TESTING=On -DCMAKE_COMPILE_WARNING_AS_ERROR=On || exit /b !errorlevel!
+          cmake -S . -B build.cmake.seh -Werror=dev --warn-uninitialized -DBUILD_TESTING=On -DCMAKE_COMPILE_WARNING_AS_ERROR=On || exit /b !errorlevel!
           cmake --build build.cmake.seh --target test-sehwrapper || exit /b !errorlevel!
           :: TODO: how to run this without copying the file?
           copy build.cmake.seh\bin\Debug\test-sehwrapper.exe . || exit /b !errorlevel!

.github/workflows/CI-windows.yml

@@ -19,7 +19,7 @@ jobs:
   convert_via_pandoc:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -38,15 +38,15 @@ jobs:
         with:
           args: --output=output/manual-premium.pdf man/manual-premium.md
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: output
           path: output
 
   manpage:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -59,7 +59,7 @@ jobs:
         run: |
           make man
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cppcheck.1
           path: cppcheck.1

.github/workflows/asan.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'danmar' }}
+    if: ${{ github.repository_owner == 'cppcheck-opensource' }}
     steps:
     - name: Build Fuzzers
       id: build
@@ -27,7 +27,7 @@ jobs:
         dry-run: false
         language: c++
     - name: Upload Crash
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts

.github/workflows/buildman.yml

@@ -27,7 +27,7 @@ jobs:
       QT_VERSION: 6.10.0
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -61,7 +61,7 @@ jobs:
 
       - name: Prepare CMake
         run: |
-          cmake -S . -B cmake.output -Werror=dev -DHAVE_RULES=On -DBUILD_TESTING=On -DBUILD_GUI=On -DWITH_QCHART=On -DBUILD_TRIAGE=On -DENABLE_CHECK_INTERNAL=On -DCMAKE_GLOBAL_AUTOGEN_TARGET=On -DDISABLE_DMAKE=On -DCPPCHK_GLIBCXX_DEBUG=Off -DCMAKE_COMPILE_WARNING_AS_ERROR=On
+          cmake -S . -B cmake.output -Werror=dev --warn-uninitialized -DHAVE_RULES=On -DBUILD_TESTING=On -DBUILD_GUI=On -DWITH_QCHART=On -DBUILD_TRIAGE=On -DENABLE_CHECK_INTERNAL=On -DCMAKE_GLOBAL_AUTOGEN_TARGET=On -DDISABLE_DMAKE=On -DCPPCHK_GLIBCXX_DEBUG=Off -DCMAKE_COMPILE_WARNING_AS_ERROR=On
         env:
           CC: clang-22
           CXX: clang++-22
@@ -86,7 +86,7 @@ jobs:
         run: |
           cmake --build cmake.output --target run-clang-tidy-csa 2> /dev/null
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: success() || failure()
         with:
           name: Compilation Database

.github/workflows/cifuzz.yml

@@ -0,0 +1,53 @@
+# Automated code review of pull requests using Claude
+#
+# A member/owner/collaborator requests a review by writing a PR comment
+# containing "@claude review".
+#
+# pull_request_target is not used because the Claude GitHub App token exchange
+# rejects OIDC tokens from that event (401 "Invalid OIDC token").
+#
+# issue_comment runs the workflow file from the default branch with access to
+# secrets. The PR code is never checked out or executed.
+name: claude-review
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  review:
+    if: |
+      github.event.issue.pull_request &&
+      contains(github.event.comment.body, '@claude review') &&
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+
+    runs-on: ubuntu-24.04
+
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+
+    steps:
+    # checks out the base branch, not the PR head
+    - uses: actions/checkout@v7
+      with:
+        fetch-depth: 1
+
+    - name: Claude review
+      uses: anthropics/claude-code-action@v1
+      with:
+        anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+        prompt: |
+          REPO: ${{ github.repository }}
+          PR NUMBER: ${{ github.event.issue.number }}
+
+          Review this pull request. Focus on correctness bugs, potential
+          false positives/false negatives in checkers, performance problems
+          and missing tests. Be concise and only report real issues.
+
+          Use `gh pr diff` to see the changes. Post specific issues as inline
+          comments with `mcp__github_inline_comment__create_inline_comment`
+          and post a short overall summary with `gh pr comment`.
+        claude_args: |
+          --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"