Run scan-build static analysis in CI

scan-build was a silent no-op: the native file pinned CC to a name
ccc-analyzer never intercepts.  Run meson and ninja under scan-build
with --use-cc, drop the native file and LTO, and gate on all default
checkers via --status-bugs.

Assisted-by: Claude:claude-opus-4-8

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b5a395053184bc75663ef5389599a273abc1fc57..d5d6a4ca7bbc3358930b853e1f6b15ae7abe4df1 100644 (file)
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -920,24 +920,26 @@ coccinelle:
 
 # Jobs for scan-build builds on Debian 13 "trixie" (amd64)
 
-.scan_build: &scan_build
-  - ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)"
-                  --keep-cc
-                  --status-bugs
-                  --keep-going
-                  -o scan-build.reports ninja -C build
-
 scan-build:
   <<: *other_checks_job
   variables:
-    CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled --native-file ci/clang-trixie.ini"
   before_script:
     - *list_installed_package_versions
   script:
-    - *configure
-    - *scan_build
+    # --exclude build drops findings in Meson's feature-probe programs,
+    # which are the only thing analyzed during setup.
+    - ${SCAN_BUILD} --use-cc=${CLANG}
+                    --exclude build
+                    meson setup --libdir=lib -Dcmocka=enabled -Ddeveloper=enabled
+                    -Dleak-detection=enabled -Doptimization=1 -Didn=enabled
+                    -Dnamed-lto=disabled build
+    # Gate on the full set of default checkers.
+    - ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)"
+                    --use-cc=${CLANG}
+                    --status-bugs
+                    --keep-going
+                    -o scan-build.reports ninja -C build
   artifacts:
     paths:
       - scan-build.reports/