Fix #14006 (CI: use cppcheck sarif output in github)

Author: danmar

.github/workflows/selfcheck.yml

@@ -187,3 +187,41 @@ jobs:
         with:
           name: Callgrind Output
           path: ./callgrind.*
+
+  build_extra: # extra warnings
+    # certain suppressed warnings are saved in sarif report that is uploaded to github
+    # to allow manual inspection
+    # these warnings do not make CI red, by intention.
+    # * tests the github integration
+    # * more comfortable release procedure
+
+    strategy:
+      fail-fast: false # Prefer quick result
+
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Build Cppcheck
+        run: |
+          make CXXFLAGS=-O2 MATCOMPILER=yes -j$(nproc)
+
+      - name: Run Cppcheck
+        run: |
+          ./cppcheck -D__CPPCHECK__ -D__GNUC__ -DCHECK_INTERNAL -DHAVE_RULES --std=c++11 --library=cppcheck-lib --library=qt --enable=style --inconclusive --inline-suppr --suppress=useStlAlgorithm --suppress=*:externals/picojson.h --suppress=normalCheckLevelMaxBranches cli gui/*.cpp lib --output-format=sarif 2> results.sarif
+
+      - name: Results
+        run: |
+          cat results.sarif
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: results
+          path: results.sarif
+
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

cli/cppcheckexecutor.cpp

@@ -109,7 +109,8 @@ namespace {
                     // rule.properties.precision, rule.properties.problem.severity
                     picojson::object properties;
                     properties["precision"] = picojson::value(sarifPrecision(finding));
-                    double securitySeverity = 0;
+                    /* skipped: "security-severity" caused error when uploading to github
+		    double securitySeverity = 0;
                     if (finding.severity == Severity::error && !ErrorLogger::isCriticalErrorId(finding.id))
                         securitySeverity = 9.9; // We see undefined behavior
                     //else if (finding.severity == Severity::warning)
@@ -119,6 +120,7 @@ namespace {
                         const picojson::array tags{picojson::value("security")};
                         properties["tags"] = picojson::value(tags);
                     }
+		    */
                     rule["properties"] = picojson::value(properties);
                     // rule.defaultConfiguration.level
                     picojson::object defaultConfiguration;
@@ -139,8 +141,8 @@ namespace {
                 artifactLocation["uri"] = picojson::value(location.getfile(false));
                 physicalLocation["artifactLocation"] = picojson::value(artifactLocation);
                 picojson::object region;
-                region["startLine"] = picojson::value(static_cast<int64_t>(location.line));
-                region["startColumn"] = picojson::value(static_cast<int64_t>(location.column));
+                region["startLine"] = picojson::value(static_cast<int64_t>(std::max(1,location.line)));
+                region["startColumn"] = picojson::value(static_cast<int64_t>(std::max(1U,location.column)));
                 region["endLine"] = region["startLine"];
                 region["endColumn"] = region["startColumn"];
                 physicalLocation["region"] = picojson::value(region);