From: Michal Nowak <mnowak@isc.org>
Date: Mon, 22 Jun 2026 16:25:16 +0000 (+0200)
Subject: Run scan-build static analysis in CI
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=597f798fade09169d5ca9b61070c03c78fc3728c;p=thirdparty%2Fbind9.git

Run scan-build static analysis in CI

scan-build was a silent no-op: the native file pinned CC to a name
ccc-analyzer never intercepts.  Run meson and ninja under scan-build
with --use-cc, drop the native file and LTO, and gate on all default
checkers via --status-bugs.

Assisted-by: Claude:claude-opus-4-8
---

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b5a39505318..d5d6a4ca7bb 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -920,24 +920,26 @@ coccinelle:
 
 # Jobs for scan-build builds on Debian 13 "trixie" (amd64)
 
-.scan_build: &scan_build
-  - ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)"
-                  --keep-cc
-                  --status-bugs
-                  --keep-going
-                  -o scan-build.reports ninja -C build
-
 scan-build:
   <<: *other_checks_job
   variables:
-    CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled --native-file ci/clang-trixie.ini"
   before_script:
     - *list_installed_package_versions
   script:
-    - *configure
-    - *scan_build
+    # --exclude build drops findings in Meson's feature-probe programs,
+    # which are the only thing analyzed during setup.
+    - ${SCAN_BUILD} --use-cc=${CLANG}
+                    --exclude build
+                    meson setup --libdir=lib -Dcmocka=enabled -Ddeveloper=enabled
+                    -Dleak-detection=enabled -Doptimization=1 -Didn=enabled
+                    -Dnamed-lto=disabled build
+    # Gate on the full set of default checkers.
+    - ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)"
+                    --use-cc=${CLANG}
+                    --status-bugs
+                    --keep-going
+                    -o scan-build.reports ninja -C build
   artifacts:
     paths:
       - scan-build.reports/