Skip to content

Commit 4e93394

Browse files
kwvgkwvg
authored
sdk%lint: introduce CodeQL and semgrep linters, add shim, derivation, disambiguation rules, resolve violations, add common helper for lint infra (#5)
2 parents 0238912 + 7c25840 commit 4e93394

163 files changed

Lines changed: 1984 additions & 559 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build_msrv.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
name: MSRV (1.85)
2+
3+
on:
4+
push:
5+
branches: [develop]
6+
pull_request:
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
10+
cancel-in-progress: true
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
lint:
17+
name: Lint
18+
runs-on: ubuntu-24.04
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v6
23+
with:
24+
fetch-depth: 0
25+
26+
- name: Install Rust toolchain
27+
uses: dtolnay/rust-toolchain@1.85.0
28+
29+
- name: Set up Node.js
30+
uses: actions/setup-node@v5
31+
with:
32+
node-version: 24
33+
34+
- name: Set up Python
35+
uses: actions/setup-python@v6
36+
with:
37+
python-version-file: pyproject.toml
38+
39+
- name: Install Python dependencies
40+
run: pip install ".[dev]"
41+
42+
- name: Install CodeQL
43+
id: setup-codeql
44+
uses: github/codeql-action/setup-codeql@v4.36.2
45+
with:
46+
tools: linked
47+
48+
- name: Setup CodeQL
49+
run: echo "$(dirname '${{ steps.setup-codeql.outputs.codeql-path }}')" >> "$GITHUB_PATH"
50+
51+
- name: Restore cargo registry
52+
uses: actions/cache/restore@v5
53+
with:
54+
path: |
55+
~/.cargo/registry
56+
~/.cargo/git
57+
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
58+
restore-keys: cargo-deps-
59+
60+
- name: Restore CodeQL caches
61+
id: codeql-cache
62+
uses: actions/cache/restore@v5
63+
with:
64+
path: |
65+
contrib/codeql/.cache
66+
~/.codeql
67+
key: codeql-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pkgs/**/*.rs', 'contrib/codeql/**/*.ql', 'contrib/codeql/**/*.qll', 'Cargo.lock') }}
68+
69+
- name: Run linters
70+
run: python3 contrib/lint/all_lint.py
71+
72+
- name: Save CodeQL caches
73+
if: success() && steps.codeql-cache.outputs.cache-hit != 'true'
74+
uses: actions/cache/save@v5
75+
with:
76+
path: |
77+
contrib/codeql/.cache
78+
~/.codeql
79+
key: codeql-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pkgs/**/*.rs', 'contrib/codeql/**/*.ql', 'contrib/codeql/**/*.qll', 'Cargo.lock') }}
80+
81+
- name: Check PR commit messages
82+
if: github.event_name == 'pull_request'
83+
run: >
84+
python3 contrib/lint/lint_unconv.py
85+
-r "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
86+
87+
build:
88+
name: Build and test
89+
runs-on: ubuntu-24.04
90+
91+
steps:
92+
- name: Checkout
93+
uses: actions/checkout@v6
94+
95+
- name: Install Rust toolchain
96+
uses: dtolnay/rust-toolchain@1.85.0
97+
98+
- name: Restore cargo registry
99+
uses: actions/cache/restore@v5
100+
with:
101+
path: |
102+
~/.cargo/registry
103+
~/.cargo/git
104+
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
105+
restore-keys: cargo-deps-
106+
107+
- name: Build workspace
108+
run: cargo build --workspace --features full,_internal
109+
110+
- name: Test workspace
111+
run: cargo test --workspace --features full,_internal

‎.github/workflows/build_nightly.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ jobs:
4949
path: |
5050
~/.cargo/registry
5151
~/.cargo/git
52-
key: cargo-deps-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}
53-
restore-keys: cargo-deps-${{ runner.os }}-${{ runner.arch }}-
52+
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
53+
restore-keys: cargo-deps-
5454

5555
- name: Restore build artifacts
5656
uses: actions/cache@v5
@@ -96,4 +96,4 @@ jobs:
9696
path: |
9797
~/.cargo/registry
9898
~/.cargo/git
99-
key: cargo-deps-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}
99+
key: cargo-deps-${{ hashFiles('Cargo.lock') }}

‎.github/workflows/build_stable.yml‎

Lines changed: 4 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Build on MSRV and stable
1+
name: Build on stable
22

33
on:
44
workflow_call:
@@ -21,34 +21,6 @@ permissions:
2121
contents: read
2222

2323
jobs:
24-
msrv:
25-
name: ubuntu-24.04-arm (MSRV)
26-
runs-on: ubuntu-24.04-arm
27-
28-
steps:
29-
- name: Checkout
30-
uses: actions/checkout@v6
31-
with:
32-
fetch-depth: 1
33-
34-
- name: Install Rust toolchain
35-
uses: dtolnay/rust-toolchain@1.85.0
36-
37-
- name: Restore cargo registry
38-
uses: actions/cache/restore@v5
39-
with:
40-
path: |
41-
~/.cargo/registry
42-
~/.cargo/git
43-
key: cargo-deps-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}
44-
restore-keys: cargo-deps-${{ runner.os }}-${{ runner.arch }}-
45-
46-
- name: Build package
47-
run: cargo build -p ${{ inputs.package }} --features ${{ inputs.features }}
48-
49-
- name: Test package
50-
run: cargo test -p ${{ inputs.package }} --features ${{ inputs.features }}
51-
5224
stable:
5325
strategy:
5426
fail-fast: false
@@ -79,8 +51,8 @@ jobs:
7951
path: |
8052
~/.cargo/registry
8153
~/.cargo/git
82-
key: cargo-deps-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}
83-
restore-keys: cargo-deps-${{ runner.os }}-${{ runner.arch }}-
54+
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
55+
restore-keys: cargo-deps-
8456

8557
- name: Restore build artifacts
8658
uses: actions/cache@v5
@@ -103,4 +75,4 @@ jobs:
10375
path: |
10476
~/.cargo/registry
10577
~/.cargo/git
106-
key: cargo-deps-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}
78+
key: cargo-deps-${{ hashFiles('Cargo.lock') }}

‎.github/workflows/lint_all.yml‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎.github/workflows/pr_comment.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: Comment on PRs
22

33
on:
44
push:
5+
branches: [develop]
56
pull_request_target:
67
types: [synchronize, opened, reopened, closed]
78

‎.github/workflows/pr_tag.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: Tag PRs
22

33
on:
44
push:
5+
branches: [develop]
56
pull_request_target:
67
types: [synchronize, opened, reopened]
78
schedule:

‎CLAUDE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ The full guide is at [`docs/guide_rust.md`](./docs/guide_rust.md). Key points:
99
- **Naming**: `UpperCamelCase` for types/traits/enum variants, `snake_case` for functions/variables/modules,
1010
`SCREAMING_SNAKE_CASE` for constants. Acronyms as words (`TxId` not `TXID`). Getters omit `get_` prefix.
1111
- **Type safety**: newtypes over primitives when semantics differ, enums over booleans, make invalid states
12-
unrepresentable. Derive `Clone`, `Debug`, `PartialEq`, `Eq`, `Hash`, `Default` eagerly.
12+
unrepresentable. Derive `Clone`, `Debug`, `PartialEq`, `Eq`, `Hash` eagerly.
1313
- **Error handling**: never `.unwrap()` or `.expect()` in library code. Propagate with `?`. Domain error enums implement
1414
`Display`. Lowercase messages without trailing punctuation. Use `#[expect]` over `#[allow]`.
1515
- **Ownership**: prefer borrowing over cloning, accept `&str` over `&String`, `&[T]` over `&Vec<T>`. Let the caller

‎contrib/codeql/.gitignore‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# CodeQL related
2+
.codeql
3+
.cache
4+
*.testproj/
5+
*.actual
6+
7+
# Generated source-line data
8+
lib/source_lines.qll
9+
10+
# Test files / folders
11+
test.ql
12+
test-*.ql
13+
**/testing/**
14+
**/*.testproj/*

‎contrib/codeql/attrib.ql‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* Copyright (c) 2026-present, The Dash Core developers
3+
* SPDX-License-Identifier: MIT
4+
* See the accompanying file LICENSE or https://opensource.org/license/MIT
5+
*
6+
* @name Attribute and derivation rules
7+
* @description Enforcement of required traits per feasible type.
8+
* @kind problem
9+
* @problem.severity warning
10+
* @id base-sdk/attrib-rules
11+
* @tags style
12+
* @precision high
13+
*/
14+
15+
import lib.filters
16+
import lib.fmt
17+
import lib.policy
18+
import lib.traits
19+
import rust
20+
21+
/** Gets a comma-separated list of missing required traits for `t`. */
22+
string missingTraits(TypeItem t) {
23+
isCheckableType(t) and
24+
result =
25+
concat(string trait |
26+
trait = requiredTrait() and
27+
not implementsTrait(t, trait) and
28+
not isSuppressed(t, trait)
29+
|
30+
trait, ", " order by trait
31+
) and
32+
result != ""
33+
}
34+
35+
from TypeItem t, string message
36+
where
37+
isCheckableType(t) and
38+
(
39+
exists(string missing |
40+
missing = missingTraits(t) and
41+
message = fmt("missing required derivations: {0}", missing)
42+
)
43+
or
44+
// Serde: every non-exempt type must derive Serialize + Deserialize.
45+
not isSerdeExempt(t) and
46+
exists(string missing |
47+
missing =
48+
concat(string trait |
49+
trait = requiredSerdeTrait() and
50+
not implementsSerdeTrait(t, trait)
51+
|
52+
trait, ", " order by trait
53+
) and
54+
missing != "" and
55+
message = fmt("missing serde derivations: {0}", missing)
56+
)
57+
)
58+
select t, message

‎contrib/codeql/codeql-pack.lock.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/concepts:
5+
version: 0.0.25
6+
codeql/controlflow:
7+
version: 2.0.35
8+
codeql/dataflow:
9+
version: 2.1.7
10+
codeql/mad:
11+
version: 1.0.51
12+
codeql/regex:
13+
version: 1.0.51
14+
codeql/rust-all:
15+
version: 0.2.15
16+
codeql/ssa:
17+
version: 2.0.27
18+
codeql/threat-models:
19+
version: 1.0.51
20+
codeql/tutorial:
21+
version: 1.0.51
22+
codeql/typeinference:
23+
version: 0.0.32
24+
codeql/typetracking:
25+
version: 2.0.35
26+
codeql/util:
27+
version: 2.0.38
28+
compiled: false

0 commit comments

Comments
 (0)