Merge pull request #3320 from hathach/more-sast

fix warnings

1 files changed, 34 insertions, 32 deletions

diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
index 0af8ac42c..7e74f77ce 100644
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -2,15 +2,30 @@ name: Static Analysis
 on:
   workflow_dispatch:
   push:
-    branches:
-      - master
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'hw/bsp/**'
+      - '.github/workflows/static_analysis.yml'
   pull_request:
-    types: [opened, synchronize, reopened]
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'hw/bsp/**'
+      - '.github/workflows/static_analysis.yml'
 
 permissions:
   actions: read
   contents: read
   security-events: write
+#  pull-requests: write
+#  checks: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   CodeQL:
@@ -50,36 +65,23 @@ jobs:
         uses: github/codeql-action/analyze@v4
         with:
           category: CodeQL
-          upload: always
+          upload: false
         id: analyze
 
-#      - name: Filter out unwanted errors and warnings
-#        uses: advanced-security/filter-sarif@v1
-#        with:
-#          patterns: |
-#            -**:cpp/path-injection
-#            -**:cpp/world-writable-file-creation
-#            -**:cpp/poorly-documented-function
-#            -**:cpp/potentially-dangerous-function
-#            -**:cpp/use-of-goto
-#            -**:cpp/integer-multiplication-cast-to-long
-#            -**:cpp/comparison-with-wider-type
-#            -**:cpp/leap-year/*
-#            -**:cpp/ambiguously-signed-bit-field
-#            -**:cpp/suspicious-pointer-scaling
-#            -**:cpp/suspicious-pointer-scaling-void
-#            -**:cpp/unsigned-comparison-zero
-#            -**/third*party/**
-#            -**/3rd*party/**
-#            -**/external/**
-#          input: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
-#          output: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
-#
-#      - name: Upload SARIF
-#        uses: github/codeql-action/upload-sarif@v4
-#        with:
-#          sarif_file: ${{ steps.analyze.outputs.sarif-output }}
-#          category: CodeQL
+      - name: Filter SARIF report
+        uses: advanced-security/filter-sarif@v1
+        with:
+          patterns: |
+            -hw/mcu/**
+            -lib/**
+          input: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
+          output: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: ${{ steps.analyze.outputs.sarif-output }}
+          category: CodeQL
 
       - name: Upload artifact
         uses: actions/upload-artifact@v5
@@ -122,7 +124,7 @@ jobs:
           mkdir -p build
           cmake examples -B build -G Ninja -DBOARD=${{ matrix.board }} -DCMAKE_BUILD_TYPE=MinSizeRel
           cmake --build build
-          pvs-studio-analyzer analyze -f build/compile_commands.json -j --exclude-path hw/mcu/ --exclude-path lib/
+          pvs-studio-analyzer analyze -R .PVS-Studio/.pvsconfig -f build/compile_commands.json --exclude-path hw/mcu/ --exclude-path lib/ -j
           plog-converter -t sarif -o pvs-studio-${{ matrix.board }}.sarif PVS-Studio.log
 
       - name: Upload SARIF