CodeChecker

Codechecker static analysis: https://codechecker.ci.qt.io

In this ticket we'll gather what more is left to be done and discuss on issues we're facing, decisions, and priorities.

DONE

• Compiling QtBase Nightly, 5.15 and dev branches.
• Compiling QtDeclarative Nightly.
• Sending notifications for new issues found in dev to Teams channel #CodeChecker.
• Arranging storage of results so that we can compare two arbitrary builds.
• Excluding 3rd party code from the analysis.
• Parallel builds - Analyzing and building Qt now takes 30min to 1h.
• Exclude the bootstrap_tools target from the analysis. Reason is that it builds the same code without threads support and other limitations, possibly confusing the analyzer.
• Cleanup storage and do not store unneeded directories. Currently every build needs >1GB, which does not scale. Auto-deleting both shadow build and results directories. Nothing is needed after things are stored in CodeChecker's database.
• Automate and verify host's setup scripts. CodeChecker is automatically setup with script provision.sh.
  • CodeChecker now gets its private port forwarded to regular HTTP port 80 at codechecker.ci.qt.io
• Enabling cross-translation-unit analysis (option -ctu). This gives much more depth to the results. Quite unstable, fails to analyze plenty of files. Fortunately there is the flag -ctu-reanalyze-on-failure that does regular analysis if CTU fails.
• Disabled bugprone-sizeof-expression checker from clang-tidy since it gives tons of false positives. Reported to LLVM and to CodeChecker.
• Publicise the static HTML reports to testresults, e.g. https://testresults.qt.io/codechecker/release_analyses/v5_15_2/
• Script to trigger analysis on every release.
• HTTPS
• Gerrit integration
• LDAP auth (docs here)
• Upgrade to latest CodeChecker
• Provisioning script tested and working on a freshly provisioned Ubuntu-20.04 host
• Host automatically updates its configuration from the gitlab repo
• Regular CodeChecker database backup

Aim for the Stars

• Write a custom configuration for clang-tidy that makes sense for Qt.
• Support more analyzers than the default ones (clangsa and clang-tidy).
  • clazy

NODO (abandoned or unnecessary stuff)

• Send an error email if a module repo fails to compile against current qtbase-dev?
• Before sending notifications about the individual issues on Teams, send a summary message, something like "qtbase dev build completed in 5h, 4 new issues found, 3 old issues have been fixed".