[PATCH 0/2] bump static-analysis ci image version

[PATCH 0/2] bump static-analysis ci image version

[Jeff King]

This is another way to fix the slow coccinelle run discussed in:

  https://lore.kernel.org/git/20260724091152.27794-2-tnyman@openai.com/

by using a newer version of coccinelle.

We tweaked the code there to avoid the problem, so this isn't urgent.
But it is worth doing to avoid running into the same problem again (and
because in general I think it makes sense to run newer versions of our
dev tools than older ones).

The second patch is the interesting one. The first is a necessary
clean-up (+cc Elijah as the relevant author there).

  [1/2]: bloom: silence CHECK_ASSERTION_SIDE_EFFECTS false positive
  [2/2]: ci: bump ubuntu image version for static-analysis job

 .github/workflows/main.yml | 4 ++--
 .gitlab-ci.yml             | 2 +-
 bloom.c                    | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

-Peff

[PATCH 1/2] bloom: silence CHECK_ASSERTION_SIDE_EFFECTS false positive

[Jeff King]

Using gcc 15, compiling with CHECK_ASSERTION_SIDE_EFFECTS=1 causes a
complaint about this line in bloom.c having a side effect:

	assert(version == 1 || version == 2);

I think this is pretty clearly a false positive, as those comparisons
should not have side effects. The side-effect checker uses a magic
definition of assert() that relies on the compiler's optimizer to drop a
reference to an otherwise unused variable. And for whatever reason, gcc
chooses not to do so here under -O2 (side note: if you have -O0 in your
CFLAGS, that naturally creates many more false positives!).

This code has been around for a while, but nobody seems to have noticed
because we use an older version of the compiler in our static-analysis
ci job, and it does not complain. Presumably very few people run this
check locally on their more modern compilers.

Let's silence the false positive to avoid confusion for anyone running
locally, and to make it possible to upgrade the image we use for our
static-analysis job.

We could just switch to our custom ASSERT() here, but I think we can
improve the code by integrating the assertion into the if/else cascade.
That avoids repeating the logic about which versions are acceptable.

Signed-off-by: Jeff King <peff@peff.net>
---
Building with clang or with "gcc -flto" seems to also silence the false
positive. We might consider using those for the static-analysis job.
But since in this instance we can both silence it and (IMHO) make the
code nicer to read, I think it's reasonable to do so. We can leave
tinkering with the assert() magic as a separate topic for anyone
interested.

 bloom.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bloom.c b/bloom.c
index c98d1672ad..caf22f9831 100644
--- a/bloom.c
+++ b/bloom.c
@@ -610,10 +610,10 @@ int bloom_filter_contains_vec(const struct bloom_filter *filter,
 uint32_t test_bloom_murmur3_seeded(uint32_t seed, const char *data, size_t len,
 				   int version)
 {
-	assert(version == 1 || version == 2);
-
 	if (version == 2)
 		return murmur3_seeded_v2(seed, data, len);
-	else
+	else if (version == 1)
 		return murmur3_seeded_v1(seed, data, len);
+	else
+		BUG("unexpected bloom version: %d", version);
 }
-- 
2.55.0.742.gf2bff09aa6

[PATCH 2/2] ci: bump ubuntu image version for static-analysis job

[Jeff King]

We recently ran into a case[1] where old versions of coccinelle ran very
slowly, but newer ones are fine. The version we use in GitHub's CI was
the old slow version, leading to timeouts of the static-analysis job.

We get the old version because we ask for the ubuntu-22.04 image. That
has coccinelle 1.1.1, but the "fast" improvement is in coccinelle 1.3.0,
specifically their 58619b8fe (break up envs for e1 & e2, 2024-08-18).

Bumping to ubuntu-25.10 would be enough to get that new version. But I
don't see any need to ask for a specific version at all. We originally
used a specific version because coccinelle wasn't available in ubuntu
20.04, so we pinned to 18.04 in d051ed77ee (.github/workflows/main.yml:
run static-analysis on bionic, 2021-02-08). Later that got bumped in
ef46584831 (ci: update 'static-analysis' to Ubuntu 22.04, 2022-08-23)
when 18.04 support was dropped.

It seems like the absence of coccinelle was a blip in 20.04, and we can
just stick with "latest" going forward.

I tested the result on GitHub's CI. I bumped the matching line in the
GitLab definition, but didn't have a simple means of testing (but it's
such a trivial change nothing could go wrong, right?).

[1] https://lore.kernel.org/git/20260724091152.27794-2-tnyman@openai.com/

Signed-off-by: Jeff King <peff@peff.net>
---
 .github/workflows/main.yml | 4 ++--
 .gitlab-ci.yml             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 85cfedf5b0..205325eb33 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -460,8 +460,8 @@ jobs:
     if: needs.ci-config.outputs.enabled == 'yes'
     env:
       jobname: StaticAnalysis
-      CI_JOB_IMAGE: ubuntu-22.04
-    runs-on: ubuntu-22.04
+      CI_JOB_IMAGE: ubuntu-latest
+    runs-on: ubuntu-latest
     concurrency:
       group: static-analysis-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1c4d04da9d..0242283c3c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -227,7 +227,7 @@ test:fuzz-smoke-tests:
     - ./ci/run-build-and-minimal-fuzzers.sh
 
 static-analysis:
-  image: ubuntu:22.04
+  image: ubuntu:latest
   stage: analyze
   needs: [ ]
   variables:
-- 
2.55.0.742.gf2bff09aa6

Re: [PATCH 0/2] bump static-analysis ci image version

[Junio C Hamano]

Jeff King <peff@peff.net> writes:

> This is another way to fix the slow coccinelle run discussed in:
>
>   https://lore.kernel.org/git/20260724091152.27794-2-tnyman@openai.com/
>
> by using a newer version of coccinelle.
>
> We tweaked the code there to avoid the problem, so this isn't urgent.
> But it is worth doing to avoid running into the same problem again (and
> because in general I think it makes sense to run newer versions of our
> dev tools than older ones).
>
> The second patch is the interesting one. The first is a necessary
> clean-up (+cc Elijah as the relevant author there).

Both are interesting.  Thanks for doing this (with relevant
archaeology as usual).