ci: add modular production workflow pipeline #462 by somethingwithproof · Pull Request #512 · Cacti/spine

somethingwithproof · 2026-03-14T23:10:25Z

Summary

Replaces the single ci.yml with a comprehensive, modular CI pipeline covering build verification, static analysis, security, coverage, fuzzing, integration testing, and release verification across all supported platforms.

Closes #462

Workflows (10)

On every PR and push

Workflow	What it does
`ci.yml`	Build matrix: gcc/clang on Ubuntu 22.04/24.04 with ASan+UBSan+LSan, macOS 13/14/15, Windows/Cygwin
`static-analysis.yml`	cppcheck + clang-tidy with SARIF upload
`coverage.yml`	gcov coverage reporting with minimum gate
`integration.yml`	MariaDB integration + Docker test suites (smoke, output_regex, db_column_detect)
`codeql.yml`	GitHub CodeQL semantic analysis
`fuzzing.yml`	CLI robustness smoke tests
`perf-regression.yml`	Performance baseline tracking

Scheduled

Workflow	Schedule	What it does
`nightly.yml`	Daily 2:30 AM	TSan, valgrind memcheck, scan-build, extended sanitizer + leak detection
`security-posture.yml`	Weekly Monday	Workflow policy validation, unsafe API guardrail
`codeql.yml`	Weekly Monday	Deep semantic analysis

On release tags

Workflow	What it does
`release-verification.yml`	SBOM generation via anchore/sbom-action

Build matrix coverage

Platform	Compiler	Sanitizers	Frequency
Ubuntu 22.04	gcc	hardened (-D_FORTIFY_SOURCE=3, stack protector)	Every PR
Ubuntu 24.04	gcc	hardened	Every PR
Ubuntu 22.04	clang	ASan + UBSan	Every PR
Ubuntu 24.04	clang	ASan + UBSan	Every PR
Ubuntu 22.04	clang	ASan + LSan	Every PR
Ubuntu 24.04	clang	ASan + LSan	Every PR
Ubuntu 22.04	clang	TSan	Nightly
Ubuntu 24.04	clang	TSan	Nightly
macOS 13 (Intel)	Apple clang	none	Every PR
macOS 14 (M1)	Apple clang	none	Every PR
macOS 15 (M3)	Apple clang	none	Every PR
Windows (Cygwin)	gcc	none	Every PR

Build system fixes

Makefile.am: added noinst_HEADERS for dependency tracking, EXTRA_DIST with all test fixtures and scripts, CLEANFILES, check-unit target, direct cppcheck (no Docker dependency)
configure.ac: removed duplicate AC_PROG_CC, removed deprecated AC_HEADER_TIME, fixed bash-isms in MySQL detection ([[ ]] -> test)

Security

All GitHub Actions pinned to full commit SHA
All run blocks use set -euo pipefail
Permissions scoped to contents: read by default
security-events: write only where needed (CodeQL, SARIF upload)

Copilot

Pull request overview

This PR modernizes and hardens the repository’s CI/CD posture by adding a modular suite of GitHub Actions workflows for build/test, security scanning, static analysis, coverage, performance regression checks, and release verification—plus supporting scripts and baselines (including an “unsafe C API additions” guardrail).

Changes:

Adds dedicated workflows for static analysis, security posture, CodeQL, coverage gating, performance regression checks, fuzzing, nightly heavy checks, integration, and release verification.
Expands the main CI workflow with a multi-OS/multi-sanitizer build+test matrix, portability smoke checks, and an unsafe C API addition guard.
Introduces helper scripts for SARIF conversion, workflow policy enforcement, leak trend gating, and provides baseline/config files used by these jobs.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/workflows/static-analysis.yml	Adds actionlint/shell lint/codespell/clang-tidy/scan-build/cppcheck jobs and SARIF upload.
.github/workflows/security-posture.yml	Adds TruffleHog, Semgrep, Scorecard, and workflow policy enforcement.
.github/workflows/release-verification.yml	Adds hardened release build verification, ELF hardening checks, SBOM generation, and provenance attestation.
.github/workflows/perf-regression.yml	Adds baseline-gated CLI + SNMP performance benchmarking.
.github/workflows/nightly.yml	Adds nightly TSAN/ASAN+UBSAN/valgrind/fuzz smoke and leak-trend enforcement.
.github/workflows/integration.yml	Adds MariaDB-backed integration job scaffolding and artifact collection.
.github/workflows/fuzzing.yml	Adds PR/scheduled CLI argument fuzz smoke using ASAN/UBSAN builds.
.github/workflows/coverage.yml	Adds GCC coverage generation + minimum coverage gate and artifacts.
.github/workflows/codeql.yml	Adds CodeQL init/build/analyze for c-cpp with scheduled runs.
.github/workflows/ci.yml	Reworks CI into a hardened matrix, portability smoke, and unsafe API guard job.
.github/scripts/cppcheck_to_sarif.py	Converts cppcheck text output to SARIF for code scanning ingestion.
.github/scripts/clang_tidy_to_sarif.py	Converts clang-tidy text output to SARIF for code scanning ingestion.
.github/scripts/check-workflow-policy.py	Enforces pinned actions, strict bash settings, and curl-pipe allowlisting.
.github/scripts/check-unsafe-api-additions.sh	Blocks newly introduced banned C APIs in diffs.
.github/scripts/check-leak-trend.py	Parses sanitizer/valgrind logs and enforces nightly leak baselines.
.github/perf-baseline.json	Baselines and thresholds for perf regression gating.
.github/nightly-leak-baseline.json	Baselines for sanitizer/valgrind leak trend gating.
.github/instructions/instructions.md	Updates contributor/CI guidance and documents the unsafe API guardrail.
.github/cppcheck-baseline.txt	Baseline file used to detect cppcheck regressions.
.codespell-ignore-words.txt	Adds ignored spelling token(s) for codespell.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

somethingwithproof · 2026-03-16T21:13:52Z

.github/workflows/security-posture.yml

+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y golang-go


Fixed -- added mkdir -p before go install.

somethingwithproof · 2026-03-16T21:13:53Z

.github/workflows/ci.yml

+      - name: Gate nightly-only matrix rows
+        id: gate
+        run: |
+          set -euo pipefail
+          if [[ "${{ matrix.nightly_only }}" == 'true' && "${{ github.event_name }}" != 'schedule' && "${{ github.event_name }}" != 'workflow_dispatch' ]]; then
+            echo "run=false" >> "${GITHUB_OUTPUT}"
+            echo "::notice::Skipping nightly-only matrix row for event '${{ github.event_name }}'."
+          else
+            echo "run=true" >> "${GITHUB_OUTPUT}"
+          fi



Acknowledged -- will move gating to job-level condition in a follow-up.

somethingwithproof · 2026-03-16T21:13:54Z

.github/scripts/check-unsafe-api-additions.sh

+if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
+	git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}" || true
+	base_commit="$(git merge-base HEAD "origin/${GITHUB_BASE_REF}" 2>/dev/null || true)"
+fi
+
+if [[ -z "${base_commit}" ]]; then
+	base_commit="$(git rev-parse HEAD~1 2>/dev/null || git rev-list --max-parents=0 HEAD)"
+fi


Fixed -- increased fetch depth for reliable merge-base.

somethingwithproof · 2026-03-16T21:13:56Z

.github/scripts/check-unsafe-api-additions.sh

+	base_commit="$(git rev-parse HEAD~1 2>/dev/null || git rev-list --max-parents=0 HEAD)"
+fi
+
+banned_regex='(sprintf|vsprintf|strcpy|strcat|gets)\s*\('


Fixed -- added word boundaries to avoid false positives on fgets/fputs.

somethingwithproof · 2026-03-16T21:13:57Z

.github/workflows/static-analysis.yml

+
+      - name: Install actionlint
+        run: |
+          set -euo pipefail


Fixed -- added mkdir -p.

somethingwithproof · 2026-03-24T07:34:52Z

This PR has no file overlap with #511 or #513. Safe to merge independently in any order.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Copilot AI review requested due to automatic review settings March 14, 2026 23:10

Copilot started reviewing on behalf of somethingwithproof March 14, 2026 23:10 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

somethingwithproof marked this pull request as draft March 20, 2026 10:00

somethingwithproof marked this pull request as ready for review March 24, 2026 08:58

somethingwithproof force-pushed the issue-462-gha-pipeline-hardening branch from 86e5bec to 677f074 Compare March 25, 2026 02:27

somethingwithproof marked this pull request as draft March 25, 2026 10:07

somethingwithproof force-pushed the issue-462-gha-pipeline-hardening branch 4 times, most recently from 577bac0 to ba984ab Compare March 26, 2026 02:43

This was referenced Mar 26, 2026

[Security] Enable CFI/LTO Hardening and Automated SBOM Generation #481

Open

Fedora systems have more compiler warnings #232

Open

somethingwithproof force-pushed the issue-462-gha-pipeline-hardening branch 3 times, most recently from c866a3d to 0028985 Compare March 26, 2026 06:35

ci: add comprehensive CI/CD pipeline with security hardening (Cacti#462)

1fd75e0

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof mentioned this pull request Mar 26, 2026

fix: comprehensive security hardening and code quality improvements #522

Closed

somethingwithproof force-pushed the issue-462-gha-pipeline-hardening branch from 0028985 to 1fd75e0 Compare March 26, 2026 07:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add modular production workflow pipeline #462#512

ci: add modular production workflow pipeline #462#512
somethingwithproof wants to merge 1 commit intoCacti:developfrom
somethingwithproof:issue-462-gha-pipeline-hardening

somethingwithproof commented Mar 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

somethingwithproof Mar 16, 2026

Uh oh!

somethingwithproof Mar 16, 2026

Uh oh!

somethingwithproof Mar 16, 2026

Uh oh!

somethingwithproof Mar 16, 2026

Uh oh!

somethingwithproof Mar 16, 2026

Uh oh!

somethingwithproof commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

somethingwithproof commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Workflows (10)

On every PR and push

Scheduled

On release tags

Build matrix coverage

Build system fixes

Security

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

somethingwithproof Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

somethingwithproof commented Mar 14, 2026 •

edited

Loading