+
+ {% if cov %}
+ {% for key, hk, label in [('line_pct','line_cov','Line Cov'),('func_pct','func_cov','Func Cov'),('branch_pct','branch_cov','Branch Cov')] %}
+
+
{{ '%.1f'|format(cov[key]) }}%
+ {% if prev and prev[hk] is not none %}
{{ delta(cov[key], prev[hk], true) }}
{% endif %}
+
{{ label }}
+
+ {% endfor %}
+ {% else %}
+
N/A
Coverage
+ {% endif %}
+
+
+
+
+
+
+
+
+
+{# ── CodeQL tab ── #}
+
+ {% if codeql_rows %}
+
+
+
+
+
+
Severity ↕
Rule ↕
Message ↕
Location ↕
+
+ {% for r in codeql_rows %}
+
+
{{ r.severity|upper }}
+
{{ r.name }}
+
{{ r.message }}
+
{{ r.path }}{% if r.start_line %}:{{ r.start_line }}{% endif %}
+
+ {% endfor %}
+
+
+ {% else %}
+
No CodeQL findings — clean code!
+ {% endif %}
+
+
+{# ── Clang-Tidy tab ── #}
+
+ {% if clang_rows %}
+
+
+
+
+
+
Severity ↕
Check ↕
Message ↕
Location ↕
+
+ {% for r in clang_rows %}
+
+
{{ r.severity|upper }}
+
{{ r.check }}
+
{{ r.message }}
+
{{ r.path }}{% if r.line %}:{{ r.line }}{% endif %}
+
+ {% endfor %}
+
+
+ {% else %}
+
No Clang-Tidy warnings — clean code!
+ {% endif %}
+
+
+{# ── Coverage tab ── #}
+
+ {% if cov %}
+
+ {% for key, label, detail_key in [('line_pct','Line Coverage','lines'),('func_pct','Function Coverage','funcs'),('branch_pct','Branch Coverage','branches')] %}
+
+
{{ '%.1f'|format(cov[key]) }}%
+
{{ label }}
+
{{ cov[detail_key] }}
+
+ {% endfor %}
+
+ {% if cov_files %}
+
+
File
Lines ↕
Functions ↕
Branches ↕
Lines (hit/total)
+
+ {% for f in cov_files %}
+
+
{{ f.file|basename }}
+
+
+ {{ '%.1f'|format(f.line_pct) }}%
+
+
+
+ {{ '%.1f'|format(f.func_pct) }}%
+
+
+
+ {{ '%.1f'|format(f.branch_pct) }}%
+
+
{{ f.lh }}/{{ f.lf }}
+
+ {% endfor %}
+
+
+ {% endif %}
+ {% else %}
+
No coverage data. Run bazel coverage //:calculator_test
+ {% endif %}
+
+
+{# ── KPI tab ── #}
+
+ {% if history|length < 2 %}
+
{{ history|length }} run(s) recorded. Trends appear after 2+ runs.
+ {% else %}
+
Error Fix KPIs
+
+ {% for label, key, hib, unit in [('CodeQL Findings','codeql',false,''),('Clang-Tidy Warnings','clang_tidy',false,''),('Line Coverage','line_cov',true,'%'),('Branch Coverage','branch_cov',true,'%')] %}
+ {% set curr = history[-1][key] %}
+ {% set prv = history[-2][key] %}
+ {% set orig = history[0][key] %}
+
+
{% if curr is not none %}{{ ('%.1f'|format(curr) ~ unit) if curr is float else (curr|string ~ unit) }}{% else %}N/A{% endif %}
+ {% if curr is not none and prv is not none %}
{{ delta(curr, prv, hib) }} vs prev
{% endif %}
+
{{ label }}
+ {% if curr is not none and orig is not none and orig != 0 %}
+ {% set rate = ((orig - curr) / orig * 100) if not hib else ((curr - orig) / orig * 100) %}
+ {{ '%+.1f'|format(rate) }}% vs start
+ {% endif %}
+
+
+ {% endfor %}
+
+
+
Trend Sparklines
+
+ {% set max_cq = [history|map(attribute='codeql')|select('number')|list|max, 1]|max %}
+
+
CodeQL findings
+
+ {% for s in history %}
+ {% set h = ((s.codeql or 0) / max_cq * 30)|int %}
+
+ {% endfor %}
+
+
+
+
Line coverage %
+
+ {% for s in history %}
+ {% set h = ((s.line_cov or 0) / 100 * 30)|int %}
+
+ {% endfor %}
+
+
+
+
+
Run History
+
+
Date
CodeQL
Clang-Tidy
Line Cov
Func Cov
Branch Cov
+
+ {% for snap in history|reverse %}
+ {% set idx = (history|length - 1) - loop.index0 %}
+ {% set ps = history[idx - 1] if idx > 0 else none %}
+ {% set is_latest = loop.first %}
+
+
{{ snap.date }}{% if is_latest %} now{% endif %}
+
{{ snap.codeql if snap.codeql is not none else 'N/A' }}{% if ps and snap.codeql is not none and ps.codeql is not none %} {{ delta(snap.codeql, ps.codeql, false) }}{% endif %}
+
{{ snap.clang_tidy if snap.clang_tidy is not none else 'N/A' }}{% if ps and snap.clang_tidy is not none and ps.clang_tidy is not none %} {{ delta(snap.clang_tidy, ps.clang_tidy, false) }}{% endif %}
+
{% if snap.line_cov is not none %}{{ '%.1f'|format(snap.line_cov) }}%{% if ps and ps.line_cov is not none %} {{ delta(snap.line_cov, ps.line_cov, true) }}{% endif %}{% else %}N/A{% endif %}
+
{% if snap.func_cov is not none %}{{ '%.1f'|format(snap.func_cov) }}%{% if ps and ps.func_cov is not none %} {{ delta(snap.func_cov, ps.func_cov, true) }}{% endif %}{% else %}N/A{% endif %}
+
{% if snap.branch_cov is not none %}{{ '%.1f'|format(snap.branch_cov) }}%{% if ps and ps.branch_cov is not none %} {{ delta(snap.branch_cov, ps.branch_cov, true) }}{% endif %}{% else %}N/A{% endif %}
+
+ {% endfor %}
+
+
+ {% endif %}
+
+
+
+
+
diff --git a/quality/dashboard/generate_dashboard.py b/quality/dashboard/generate_dashboard.py
new file mode 100644
index 000000000..f5b354fc9
--- /dev/null
+++ b/quality/dashboard/generate_dashboard.py
@@ -0,0 +1,439 @@
+#!/usr/bin/env python3
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+"""Unified quality dashboard: CodeQL MISRA + Clang-Tidy + Coverage.
+
+Adapted from the CICD reference implementation. Key differences vs the original:
+ - Reads CodeQL findings from SARIF files (communication only produces SARIF,
+ not CSV).
+ - Reads clang-tidy reports from both *.AspectRulesLintClangTidy.out (aspect_
+ rules_lint v2, used by this repo) and *.AspectRulesLintClangTidy.report
+ (newer versions), so it is forward-compatible.
+ - No Bazel workspace resolution or --serve mode (CI-only).
+
+Usage (CI, called from nightly_quality.yml):
+ python3 quality/dashboard/generate_dashboard.py \\
+ --sarif-dir _quality/codeql \\
+ --clang-tidy-dir _quality/clang_tidy \\
+ --lcov /tmp/coverage_zip/extracted/artifacts/coverage_report.dat \\
+ --history _quality/data/quality_history.json \\
+ --html _quality/index.html \\
+ --github-summary
+"""
+
+import argparse
+import json
+import os
+import pathlib
+import re
+import sys
+from collections import Counter
+from datetime import datetime, timezone
+
+from jinja2 import Environment, FileSystemLoader
+from markupsafe import Markup
+
+_TEMPLATE_DIR = pathlib.Path(__file__).parent
+
+# ── Helpers exposed to the Jinja2 template ────────────────────────────────────
+_SEV_COLOUR = {
+ "critical": "#c0392b", "high": "#e74c3c", "error": "#e74c3c",
+ "warning": "#e67e22", "medium": "#e67e22", "low": "#f1c40f",
+ "recommendation": "#3498db", "note": "#95a5a6",
+}
+_SEV_ORDER = {
+ "critical": 0, "high": 1, "error": 1, "warning": 2, "medium": 2,
+ "low": 3, "recommendation": 4, "note": 4,
+}
+
+
+def _sev_colour(s: str) -> str:
+ return _SEV_COLOUR.get(str(s).lower(), "#95a5a6")
+
+
+def _cov_colour(pct) -> str:
+ pct = float(pct or 0)
+ return "#27ae60" if pct >= 90 else ("#e67e22" if pct >= 70 else "#e74c3c")
+
+
+def _delta_badge(curr, prev, higher_is_better: bool) -> Markup:
+ try:
+ diff = float(curr) - float(prev)
+ except (TypeError, ValueError):
+ return Markup("")
+ if diff == 0:
+ return Markup('=')
+ improved = (diff < 0) if not higher_is_better else (diff > 0)
+ cls = "trend-dn" if improved else "trend-up"
+ sym = "↓" if diff < 0 else "↑"
+ fmt = f"{abs(diff):.1f}" if abs(diff) != int(abs(diff)) else str(int(abs(diff)))
+ return Markup(f'{sym}{fmt}')
+
+
+# ── Data parsers ──────────────────────────────────────────────────────────────
+
+def load_codeql_sarif(sarif_dir: pathlib.Path) -> list[dict]:
+ """Load CodeQL findings from SARIF files.
+
+ The communication repo's codeql_lint.py outputs SARIF only (CSV was
+ removed). This function parses SARIF v2.1.0 as produced by CodeQL and
+ returns rows in the same schema that dashboard.html.j2 expects:
+ name, description, severity, message, path, start_line.
+ """
+ if not sarif_dir or not sarif_dir.exists():
+ return []
+ rows = []
+ for sarif_path in sarif_dir.rglob("*.sarif"):
+ try:
+ data = json.loads(sarif_path.read_text(encoding="utf-8", errors="replace"))
+ for run in data.get("runs", []):
+ rules = {
+ r["id"]: r
+ for r in run.get("tool", {}).get("driver", {}).get("rules", [])
+ }
+ for result in run.get("results", []):
+ rule_id = result.get("ruleId", "unknown")
+ rule = rules.get(rule_id, {})
+ message = result.get("message", {}).get("text", "")
+ # Prefer the result-level severity; fall back to the rule's
+ # default configuration level, then to "warning".
+ severity = (
+ result.get("level")
+ or rule.get("defaultConfiguration", {}).get("level")
+ or "warning"
+ )
+ locs = result.get("locations", [{}])
+ loc = locs[0].get("physicalLocation", {}) if locs else {}
+ uri = loc.get("artifactLocation", {}).get("uri", "")
+ line = str(loc.get("region", {}).get("startLine", ""))
+ rows.append({
+ "name": rule.get("name", rule_id),
+ "description": rule.get("shortDescription", {}).get("text", ""),
+ "severity": severity,
+ "message": message,
+ "path": uri,
+ "start_line": line,
+ })
+ except Exception:
+ pass
+ return sorted(rows, key=lambda r: _SEV_ORDER.get(r["severity"].lower(), 99))
+
+
+_CT_FULL_RE = re.compile(r'^(.+?):(\d+):\d+: (warning|error): (.+?) \[([^\]]+)\]\s*$')
+_CT_SIMPLE_RE = re.compile(r'^(warning|error): (.+?) \[([^\]]+)\]\s*$')
+
+
+def load_clang_tidy(search_dir: pathlib.Path) -> list[dict]:
+ """Load clang-tidy findings.
+
+ Handles both:
+ *.AspectRulesLintClangTidy.out – aspect_rules_lint v2 (current repo)
+ *.AspectRulesLintClangTidy.report – newer aspect_rules_lint versions
+ """
+ if not search_dir or not search_dir.exists():
+ return []
+ findings, seen = [], set()
+ patterns = (
+ "*.AspectRulesLintClangTidy.out",
+ "*.AspectRulesLintClangTidy.report",
+ )
+ for pattern in patterns:
+ for report_file in search_dir.rglob(pattern):
+ for line in report_file.read_text(encoding="utf-8", errors="replace").splitlines():
+ m = _CT_FULL_RE.match(line)
+ if m:
+ fpath, lineno, sev, msg, check = m.groups()
+ key = (fpath, lineno, check, msg[:80])
+ if key not in seen:
+ seen.add(key)
+ findings.append({
+ "path": fpath, "line": lineno,
+ "severity": sev, "message": msg, "check": check,
+ })
+ continue
+ m = _CT_SIMPLE_RE.match(line)
+ if m:
+ sev, msg, check = m.groups()
+ key = ("", "", check, msg[:80])
+ if key not in seen:
+ seen.add(key)
+ findings.append({
+ "path": "", "line": "",
+ "severity": sev, "message": msg, "check": check,
+ })
+ return sorted(findings, key=lambda r: (0 if r["severity"] == "error" else 1, r["path"]))
+
+
+def load_lcov(path: pathlib.Path) -> tuple[dict, list[dict]]:
+ if not path or not path.is_file():
+ return {}, []
+ files, cur = [], None
+ for raw in path.read_text(encoding="utf-8", errors="replace").splitlines():
+ line = raw.strip()
+ if line.startswith("SF:"):
+ cur = {"file": line[3:], "lf": 0, "lh": 0, "fnf": 0, "fnh": 0,
+ "brf": 0, "brh": 0, "_lf": 0, "_lh": 0}
+ elif cur is None:
+ continue
+ elif line.startswith("DA:"):
+ parts = line[3:].split(",")
+ cur["_lf"] += 1
+ if len(parts) >= 2:
+ try:
+ if int(parts[1]) > 0:
+ cur["_lh"] += 1
+ except ValueError:
+ pass
+ elif line.startswith("LF:"):
+ cur["lf"] = int(line[3:] or 0)
+ elif line.startswith("LH:"):
+ cur["lh"] = int(line[3:] or 0)
+ elif line.startswith("FNF:"):
+ cur["fnf"] = int(line[4:] or 0)
+ elif line.startswith("FNH:"):
+ cur["fnh"] = int(line[4:] or 0)
+ elif line.startswith("BRF:"):
+ cur["brf"] = int(line[4:] or 0)
+ elif line.startswith("BRH:"):
+ cur["brh"] = int(line[4:] or 0)
+ elif line == "end_of_record":
+ if cur["lf"] == 0:
+ cur["lf"] = cur["_lf"]
+ if cur["lh"] == 0:
+ cur["lh"] = cur["_lh"]
+ files.append(cur)
+ cur = None
+
+ def pct(h, f):
+ return round(100.0 * h / f, 1) if f else 0.0
+
+ for f in files:
+ f["line_pct"] = pct(f["lh"], f["lf"])
+ f["func_pct"] = pct(f["fnh"], f["fnf"])
+ f["branch_pct"] = pct(f["brh"], f["brf"])
+
+ lf = sum(f["lf"] for f in files)
+ lh = sum(f["lh"] for f in files)
+ fnf = sum(f["fnf"] for f in files)
+ fnh = sum(f["fnh"] for f in files)
+ brf = sum(f["brf"] for f in files)
+ brh = sum(f["brh"] for f in files)
+ summary = {
+ "line_pct": pct(lh, lf), "func_pct": pct(fnh, fnf), "branch_pct": pct(brh, brf),
+ "lines": f"{lh}/{lf}", "funcs": f"{fnh}/{fnf}", "branches": f"{brh}/{brf}",
+ }
+ return summary, sorted(files, key=lambda f: f["line_pct"])
+
+
+def load_history(path: pathlib.Path) -> list[dict]:
+ if not path or not path.exists():
+ return []
+ try:
+ data = json.loads(path.read_text(encoding="utf-8"))
+ return data if isinstance(data, list) else []
+ except (json.JSONDecodeError, OSError):
+ return []
+
+
+def save_history(path: pathlib.Path, history: list[dict]) -> None:
+ path.parent.mkdir(parents=True, exist_ok=True)
+ path.write_text(json.dumps(history, indent=2), encoding="utf-8")
+ print(f"History saved: {path} ({len(history)} runs)")
+
+
+# ── HTML rendering ────────────────────────────────────────────────────────────
+
+def render_dashboard(
+ codeql_rows, clang_rows, cov_summary, cov_files, history, timestamp,
+) -> str:
+ env = Environment(loader=FileSystemLoader(str(_TEMPLATE_DIR)), autoescape=True)
+ env.globals["sev_colour"] = _sev_colour
+ env.globals["cov_colour"] = _cov_colour
+ env.globals["delta"] = _delta_badge
+ env.filters["basename"] = lambda p: pathlib.Path(p).name or p
+ env.tests["number"] = lambda x: isinstance(x, (int, float)) and x is not None
+ tmpl = env.get_template("dashboard.html.j2")
+ return tmpl.render(
+ timestamp=timestamp,
+ codeql_rows=codeql_rows,
+ codeql_counts=Counter(r["severity"].lower() for r in codeql_rows),
+ clang_rows=clang_rows,
+ clang_counts=Counter(r["severity"] for r in clang_rows),
+ clang_errors=sum(1 for r in clang_rows if r["severity"] == "error"),
+ cov=cov_summary or None,
+ cov_files=cov_files,
+ history=history,
+ prev=history[-2] if len(history) >= 2 else None,
+ )
+
+
+# ── GitHub Actions step summary ───────────────────────────────────────────────
+
+def write_github_summary(
+ codeql_rows, clang_rows, cov_summary, history, summary_path,
+) -> None:
+ lines = ["## Quality Dashboard\n", "### CodeQL (MISRA C++)\n"]
+ if not codeql_rows:
+ lines.append("**No findings.** :white_check_mark:\n")
+ else:
+ counts = Counter(r["severity"].lower() for r in codeql_rows)
+ lines += [
+ f"**Total: {len(codeql_rows)} findings**\n",
+ "| Severity | Count |",
+ "|----------|------:|",
+ ]
+ for sev in ["critical", "high", "error", "warning", "medium", "low",
+ "recommendation", "note"]:
+ if sev in counts:
+ lines.append(f"| {sev.capitalize()} | {counts[sev]} |")
+
+ lines += ["", "### Clang-Tidy\n"]
+ if not clang_rows:
+ lines.append("**No warnings.** :white_check_mark:\n")
+ else:
+ counts = Counter(r["severity"] for r in clang_rows)
+ lines += [
+ f"**Total: {len(clang_rows)} warnings**\n",
+ "| Severity | Count |",
+ "|----------|------:|",
+ ]
+ for sev in ["error", "warning"]:
+ if sev in counts:
+ lines.append(f"| {sev.capitalize()} | {counts[sev]} |")
+
+ lines += ["", "### Coverage\n"]
+ if cov_summary:
+ lines += [
+ "| Metric | Value |",
+ "|--------|-------|",
+ f"| Lines | {cov_summary['line_pct']:.1f}% ({cov_summary['lines']}) |",
+ f"| Functions | {cov_summary['func_pct']:.1f}% ({cov_summary['funcs']}) |",
+ f"| Branches | {cov_summary['branch_pct']:.1f}% ({cov_summary['branches']}) |",
+ ]
+ else:
+ lines.append("Coverage data not available.\n")
+
+ if len(history) >= 2:
+ prev, curr = history[-2], history[-1]
+ lines += [
+ "", "### KPI Trend vs Previous Run\n",
+ "| Metric | Prev | Now | Δ |",
+ "|--------|------|-----|---|",
+ ]
+ for label, key, hib in [
+ ("CodeQL findings", "codeql", False),
+ ("Clang-Tidy warnings", "clang_tidy", False),
+ ("Line coverage %", "line_cov", True),
+ ("Branch coverage %", "branch_cov", True),
+ ]:
+ pv, cv = prev.get(key), curr.get(key)
+ if pv is not None and cv is not None:
+ diff = cv - pv
+ sym = "↓" if diff < 0 else ("↑" if diff > 0 else "=")
+ good = (diff < 0) if not hib else (diff > 0)
+ icon = "✅" if good else ("⚠️" if diff != 0 else "")
+ fmt = (f"{abs(diff):.1f}" if isinstance(diff, float)
+ else str(abs(int(diff))))
+ lines.append(f"| {label} | {pv} | {cv} | {sym}{fmt} {icon} |")
+ lines.append(
+ f"\n_Tracking since {history[0].get('date', 'start')} ({len(history)} runs)_"
+ )
+
+ with open(summary_path, "a", encoding="utf-8") as fh:
+ fh.write("\n".join(lines) + "\n")
+
+
+# ── Entry point ───────────────────────────────────────────────────────────────
+
+def main() -> int:
+ parser = argparse.ArgumentParser(description="Generate unified quality dashboard")
+ parser.add_argument(
+ "--sarif-dir", default="",
+ help="Directory containing CodeQL SARIF files (*.sarif)",
+ )
+ parser.add_argument(
+ "--clang-tidy-dir", default="",
+ help="Directory containing clang-tidy report files "
+ "(*.AspectRulesLintClangTidy.out or .report)",
+ )
+ parser.add_argument(
+ "--lcov", default="",
+ help="Path to LCOV .dat coverage data file",
+ )
+ parser.add_argument(
+ "--html", default="dashboard.html",
+ help="Output HTML dashboard path",
+ )
+ parser.add_argument(
+ "--github-summary", action="store_true",
+ help="Append markdown summary to $GITHUB_STEP_SUMMARY",
+ )
+ parser.add_argument(
+ "--history", default="",
+ help="Path to KPI history JSON file (read before, updated after rendering)",
+ )
+ args = parser.parse_args()
+
+ sarif_dir = pathlib.Path(args.sarif_dir) if args.sarif_dir else pathlib.Path("")
+ clang_tidy_dir = (pathlib.Path(args.clang_tidy_dir)
+ if args.clang_tidy_dir else pathlib.Path(""))
+ lcov_path = pathlib.Path(args.lcov) if args.lcov else pathlib.Path("")
+ html_path = pathlib.Path(args.html)
+ hist_path = pathlib.Path(args.history) if args.history else None
+
+ html_path.parent.mkdir(parents=True, exist_ok=True)
+
+ codeql_rows = load_codeql_sarif(sarif_dir)
+ clang_rows = load_clang_tidy(clang_tidy_dir)
+ cov_summary, cov_files = load_lcov(lcov_path)
+ timestamp = datetime.now(tz=timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+
+ history = load_history(hist_path) if hist_path else []
+ history.append({
+ "date": timestamp,
+ "codeql": len(codeql_rows),
+ "clang_tidy": len(clang_rows),
+ "line_cov": cov_summary.get("line_pct") if cov_summary else None,
+ "func_cov": cov_summary.get("func_pct") if cov_summary else None,
+ "branch_cov": cov_summary.get("branch_pct") if cov_summary else None,
+ })
+ if hist_path:
+ save_history(hist_path, history)
+
+ html_path.write_text(
+ render_dashboard(codeql_rows, clang_rows, cov_summary, cov_files,
+ history, timestamp),
+ encoding="utf-8",
+ )
+
+ print(f"Dashboard written: {html_path}")
+ print(f" CodeQL: {len(codeql_rows)} findings")
+ print(f" Clang-Tidy: {len(clang_rows)} warnings")
+ if cov_summary:
+ print(f" Coverage: {cov_summary['line_pct']:.1f}% lines "
+ f"{cov_summary['func_pct']:.1f}% funcs "
+ f"{cov_summary['branch_pct']:.1f}% branches")
+ else:
+ print(" Coverage: N/A")
+
+ if args.github_summary:
+ write_github_summary(
+ codeql_rows, clang_rows, cov_summary, history,
+ os.environ.get("GITHUB_STEP_SUMMARY", "/dev/null"),
+ )
+
+ return 0
+
+
+if __name__ == "__main__":
+ sys.exit(main())
diff --git a/quality/static_analysis/codeql_lint.py b/quality/static_analysis/codeql_lint.py
index 2903245d6..db2d24aa2 100644
--- a/quality/static_analysis/codeql_lint.py
+++ b/quality/static_analysis/codeql_lint.py
@@ -35,11 +35,40 @@ def main():
parser.add_argument(
"--target",
)
+ parser.add_argument(
+ "--analyze-jobs",
+ type=int,
+ default=None,
+ help="Number of threads for 'codeql database analyze' (-j). Omit to let CodeQL decide.",
+ )
+ parser.add_argument(
+ "--analyze-ram",
+ type=int,
+ default=None,
+ help="RAM cap in MB for 'codeql database analyze' (--ram). Omit to use the CodeQL default.",
+ )
+ parser.add_argument(
+ "--analyze-timeout",
+ type=int,
+ default=None,
+ help="Per-query timeout in minutes for 'codeql database analyze' (--timeout). Omit to use the CodeQL default.",
+ )
args = parser.parse_args()
code_ql_path = args.codeql_path
config_path = args.config_path
target = args.target
+
+ # Build optional resource-cap flags for 'database analyze'.
+ # These are intentionally left unset for local runs and only passed
+ # explicitly in CI (see codeql.yml) to match runner constraints.
+ _analyze_flags = ""
+ if args.analyze_jobs is not None:
+ _analyze_flags += f" -j {args.analyze_jobs}"
+ if args.analyze_ram is not None:
+ _analyze_flags += f" --ram {args.analyze_ram}"
+ if args.analyze_timeout is not None:
+ _analyze_flags += f" --timeout {args.analyze_timeout}"
source_root = os.environ["BUILD_WORKING_DIRECTORY"]
os.makedirs(TMP_PATH_FOR_DATABASES, exist_ok=True)
@@ -60,13 +89,32 @@ def main():
bazel_command += _get_action_env_extension(necessary_codeql_environment)
subprocess.run(f"{bazel_command} {target}", shell=True, env=env, cwd=source_root, check=True)
- os.system(f"{code_ql_path} database finalize -j=0 -- {database_location}")
+ # Finalize: compile tracing data into the queryable database.
+ subprocess.run(
+ f"{code_ql_path} database finalize -j=0 -- {database_location}",
+ shell=True, check=False)
output_base = _get_bazel_info(source_root).get('output_path')
- os.system(
- f"{code_ql_path} database analyze -j=0 {database_location} --format=sarifv2.1.0 --output={output_base}/codeql.sarif")
- os.system(
- f"{code_ql_path} database analyze -j=0 {database_location} --format=csv --output={output_base}/codeql.csv")
+
+ # Analyze: run MISRA/AUTOSAR queries and produce SARIF and CSV.
+ # Resource-cap flags (--ram, --timeout, -j) are injected via CLI
+ # args so they apply only when explicitly set (e.g. in CI).
+ # SARIF is consumed by the CI quality dashboard; CSV is kept for
+ # direct human readability.
+ subprocess.run(
+ f"{code_ql_path} database analyze"
+ f"{_analyze_flags}"
+ f" {database_location}"
+ f" --format=sarifv2.1.0 --output={output_base}/codeql.sarif",
+ shell=True, check=False,
+ timeout=5400) # 90-minute hard ceiling as a last-resort safety net
+ subprocess.run(
+ f"{code_ql_path} database analyze"
+ f"{_analyze_flags}"
+ f" {database_location}"
+ f" --format=csv --output={output_base}/codeql.csv",
+ shell=True, check=False,
+ timeout=5400)
# @todo it is possible to generate here also a full MISRA compliance report, which we could do in the future.
# path/to/.sarif