sysfce2 · pull · Sep 12, 2024 · Oct 22, 2024 · Jul 5, 2024 · Oct 22, 2024
diff --git a/.clang-format b/.clang-format
@@ -0,0 +1,22 @@
+---
+BasedOnStyle: Google
+
+AccessModifierOffset: -2
+AlignArrayOfStructures: Right
+AlignConsecutiveBitFields: AcrossEmptyLines
+AlignConsecutiveMacros: AcrossEmptyLines
+AlignEscapedNewlines: Right
+AlignOperands: DontAlign
+AllowShortFunctionsOnASingleLine: Empty
+AllowShortIfStatementsOnASingleLine: Never
+AllowShortLambdasOnASingleLine: Empty
+AllowShortLoopsOnASingleLine: false
+ColumnLimit: 120
+DerivePointerAlignment: false
+IndentCaseLabels: false
+IndentPPDirectives: AfterHash
+IndentWidth: 4
+InsertNewlineAtEOF: true
+PointerAlignment: Right
+PPIndentWidth: 2
+SortIncludes: Never
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,21 +1,16 @@
 name: Build
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 jobs:
-  ci:
+  build:
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - name: Ubuntu 20 GCC
-            os: ubuntu-20.04
-            compiler: gcc
-            cxx-compiler: g++
-
           - name: Ubuntu GCC ASAN
             os: ubuntu-latest
             compiler: gcc
@@ -30,27 +25,34 @@ jobs:
             cmake-args: -D MZ_SANITIZER=Undefined
             codecov: ubuntu_gcc_undefined
 
-          - name: Ubuntu GCC MSAN
+          - name: Ubuntu Clang MSAN
             os: ubuntu-latest
-            compiler: gcc
-            cxx-compiler: g++
-            cmake-args: -D MZ_SANITIZER=Memory
-            codecov: ubuntu_gcc_msan
+            compiler: clang-20
+            cxx-compiler: clang++-20
+            # Disable OpenSSL since it is not built with MSAN
+            # Fetch third-party libraries and don't use system libraries so they can be intrumented
+            cmake-args: -GNinja -DMZ_SANITIZER=Memory -DMZ_OPENSSL=OFF -DMZ_FORCE_FETCH_LIBS=ON
+            packages: ninja-build clang-20 llvm-20 libclang-rt-20-dev
+            gcov-exec: llvm-cov-20 gcov
+            build-config: Debug
+            # https://github.com/llvm/llvm-project/issues/55785
+            msan-options: use_sigaltstack=0
+            # Coverage disabled for clang-20, errors
 
           # No code coverage on release builds
-          - name: Ubuntu 20 Clang
-            os: ubuntu-20.04
+          - name: Ubuntu 22 Clang
+            os: ubuntu-22.04
             compiler: clang
             cxx-compiler: clang++
             deploy: true
             deploy-name: linux
 
-          - name: Ubuntu 20 Clang 6.0
-            os: ubuntu-20.04
-            compiler: clang-6.0
-            cxx-compiler: clang++-6.0
-            version: "6.0"
-            packages: llvm-6.0 clang-6.0
+          - name: Ubuntu 22 Clang 11
+            os: ubuntu-22.04
+            compiler: clang-11
+            cxx-compiler: clang++-11
+            version: "11"
+            packages: llvm-11 clang-11
 
           - name: Ubuntu GCC
             os: ubuntu-latest
@@ -59,12 +61,12 @@ jobs:
             cmake-args: -D MZ_CODE_COVERAGE=ON
             codecov: ubuntu_gcc
 
+          # out-of-source build
           - name: Ubuntu GCC OSB
             os: ubuntu-latest
             compiler: gcc
             cxx-compiler: g++
             build-dir: ../build
-            build-src-dir: ../minizip-ng
 
           - name: Ubuntu Clang
             os: ubuntu-latest
@@ -111,6 +113,15 @@ jobs:
             packages: clang-14 llvm-14
             gcov-exec: llvm-cov-14 gcov
 
+          - name: Ubuntu Clang No Ppmd
+            os: ubuntu-latest
+            compiler: clang-14
+            cxx-compiler: clang++-14
+            cmake-args: -D MZ_CODE_COVERAGE=ON -D MZ_PPMD=OFF
+            codecov: ubuntu_clang_no_ppmd
+            packages: clang-14 llvm-14
+            gcov-exec: llvm-cov-14 gcov
+
           - name: Ubuntu Clang No Pkcrypt
             os: ubuntu-latest
             compiler: clang-14
@@ -214,7 +225,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: Install packages (macOS)
       if: runner.os == 'macOS'
@@ -233,10 +244,59 @@ jobs:
         choco uninstall --no-progress strawberryperl
         choco install ninja --no-progress
 
+    - name: Set LLVM_BUILD_DIR for LLVM C++ libraries (MSAN)
+      if: contains(matrix.name, 'MSAN') && startsWith(matrix.compiler, 'clang')
+      run: |
+        echo "LLVM_BUILD_DIR=`pwd`/llvm-project/build" >> $GITHUB_ENV
+
+    - name: Get latest hash change for LLVM C++ libraries (MSAN)
+      if: contains(matrix.name, 'MSAN') && startsWith(matrix.compiler, 'clang')
+      id: llvm-remote-hash
+      run: |
+        HASH=$(git ls-remote https://github.com/llvm/llvm-project refs/heads/release/20.x | cut -f1)
+        if [ -z "$HASH" ]; then
+          echo "Failed to fetch LLVM remote hash"
+          exit 1
+        fi
+        echo "value=$HASH" >> $GITHUB_OUTPUT
+
+    - name: Cache LLVM C++ libraries (MSAN)
+      if: contains(matrix.name, 'MSAN') && startsWith(matrix.compiler, 'clang')
+      id: cache-llvm
+      uses: actions/cache@v5
+      with:
+        path: |
+          ${{ env.LLVM_BUILD_DIR }}/lib
+          ${{ env.LLVM_BUILD_DIR }}/include
+        key: cache-llvm-${{ matrix.os }}-${{ runner.arch }}-${{ matrix.compiler }}-${{ steps.llvm-remote-hash.outputs.value }}
+
+    - name: Compile LLVM C++ libraries (MSAN)
+      if: contains(matrix.name, 'MSAN') && startsWith(matrix.compiler, 'clang') && steps.cache-llvm.outputs.cache-hit != 'true'
+      run: |
+        # Sparse-checkout only the folders we need
+        git clone --depth=1 --filter=blob:none https://github.com/llvm/llvm-project --no-checkout --branch release/20.x
+        cd llvm-project
+        git sparse-checkout set cmake runtimes libc libcxx libcxxabi llvm/cmake
+        git checkout
+        cmake -S runtimes -B build -G Ninja \
+          -DCMAKE_BUILD_TYPE=Release \
+          -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
+          -DLLVM_USE_SANITIZER=MemoryWithOrigins \
+          -DLIBCXXABI_USE_LLVM_UNWINDER=OFF \
+          -DLIBCXX_ENABLE_STATIC=OFF \
+          -DLIBCXX_INCLUDE_BENCHMARKS=OFF \
+          -DLLVM_INCLUDE_TESTS=OFF \
+          -DLLVM_INCLUDE_DOCS=OFF
+        cmake --build build -j5 -- cxx cxxabi
+      env:
+        CFLAGS: -O2
+        CC: ${{ matrix.compiler }}
+        CXX: ${{ matrix.cxx-compiler }}
+
     - name: Generate project files
       shell: bash
       run: |
-        cmake -S ${{ matrix.build-src-dir || '.' }} -B ${{ matrix.build-dir || '.' }} ${{ matrix.cmake-args }} \
+        cmake -S . -B ${{ matrix.build-dir || '.' }} ${{ matrix.cmake-args }} \
           -D MZ_BUILD_TESTS=ON \
           -D MZ_BUILD_UNIT_TESTS=ON \
           -D BUILD_SHARED_LIBS=OFF \
@@ -253,9 +313,11 @@ jobs:
     - name: Run test cases
       run: ctest --output-on-failure -C ${{ matrix.build-config || 'Release' }}
       working-directory: ${{ matrix.build-dir }}
-
+      env:
+        MSAN_OPTIONS: ${{ matrix.msan-options || 'verbosity=0' }}
+
     - name: Setup python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       if: always() && matrix.codecov
       with:
         python-version: '3.x'
@@ -264,35 +326,31 @@ jobs:
       shell: bash
       if: always() && matrix.codecov
       run: |
-        python3 -u -m pip install gcovr
-        python3 -m gcovr \
+        pip install gcovr
+        python -m gcovr \
           --exclude-unreachable-branches \
           --gcov-ignore-parse-errors \
           --gcov-executable "${{ matrix.gcov-exec || 'gcov' }}" \
-          --root ${{ matrix.build-src-dir || '.' }} \
+          --root . \
           --xml \
-          --output coverage.xml \
+          --output coverage-${{ matrix.codecov }}.xml \
           --verbose
 
     - name: Upload coverage report
-      uses: codecov/codecov-action@v4
-      if: always() && matrix.codecov && env.CODECOV_TOKEN != ''
+      uses: actions/upload-artifact@v6
+      if: always() && matrix.codecov
       with:
-        token: ${{ secrets.CODECOV_TOKEN }}
-        flags: ${{ matrix.codecov }}
-        name: ${{ matrix.name }}
-        directory: ${{ matrix.build-src-dir || '.' }}
-        verbose: true
-        fail_ci_if_error: true
-      env:
-        CODECOV_TOKEN: "${{ secrets.CODECOV_TOKEN }}"
+        name: Coverage Report - ${{ matrix.name }}
+        path: coverage-${{ matrix.codecov }}.xml
+        if-no-files-found: ignore
+        retention-days: 2
 
     - name: Package release (Ubuntu/macOS)
       if: (runner.os == 'Linux' || runner.os == 'macOS') && matrix.deploy && startsWith(github.ref, 'refs/tags/')
       run: ls -R mini*zip | tar -czvf minizip-ng-${{ matrix.deploy-name }}.tar.gz -T -
 
     - name: Upload release (Ubuntu/macOS)
-      uses: svenstaro/upload-release-action@2.9.0
+      uses: svenstaro/upload-release-action@2.11.5
       if: (runner.os == 'Linux' || runner.os == 'macOS') && matrix.deploy && startsWith(github.ref, 'refs/tags/') && env.GITHUB_TOKEN != ''
       with:
         asset_name: minizip-ng-${{ matrix.deploy-name }}.tar.gz
@@ -308,7 +366,7 @@ jobs:
       run: 7z a -tzip minizip-ng-${{ matrix.deploy-name }}.zip ./Release/mini*zip.exe
 
     - name: Upload release (Windows)
-      uses: svenstaro/upload-release-action@2.9.0
+      uses: svenstaro/upload-release-action@2.11.5
       if: runner.os == 'Windows' && matrix.deploy && startsWith(github.ref, 'refs/tags/') && env.GITHUB_TOKEN != ''
       with:
         asset_name: minizip-ng-${{ matrix.deploy-name }}.zip
@@ -318,3 +376,40 @@ jobs:
         overwrite: true
       env:
         GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+  coverage:
+    name: Upload Coverage Reports
+    runs-on: ubuntu-latest
+    needs: build
+    if: always() && !cancelled()
+    steps:
+      - name: Download all reports
+        uses: actions/download-artifact@v7
+        with:
+          pattern: Coverage Report - *
+          merge-multiple: true
+
+      - name: Collect coverage report paths
+        shell: bash
+        run: |
+          shopt -s nullglob
+          files=(coverage-*.xml)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "No coverage reports found, skipping upload."
+            exit 0
+          fi
+          printf '%s\n' "${files[@]}"
+          IFS=','
+          echo "COVERAGE_REPORTS=${files[*]}" >> $GITHUB_ENV
+
+      - name: Publish coverage reports
+        uses: codecov/codecov-action@v6
+        if: env.COVERAGE_REPORTS != '' && env.CODECOV_TOKEN != ''
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ${{ env.COVERAGE_REPORTS }}
+          name: ${{ github.workflow }}-${{ github.event_name }}
+          verbose: true
+          fail_ci_if_error: true
+        env:
+          CODECOV_TOKEN: "${{ secrets.CODECOV_TOKEN }}"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -2,6 +2,7 @@ name: CodeQL
 on:
   push:
   pull_request:
+  workflow_dispatch:
   schedule:
     - cron: '0 1 * * 4'
 concurrency:
@@ -17,20 +18,21 @@ jobs:
       security-events: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
         fetch-depth: 2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
+      with:
+        languages: c-cpp
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
@@ -1,5 +1,5 @@
 name: OSS-Fuzz
-on: [pull_request]
+on: [pull_request, workflow_dispatch]
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -21,7 +21,7 @@ jobs:
         dry-run: true
 
     - name: Upload Crash
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: failure()
       with:
         name: artifacts

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -0,0 +1,32 @@
+name: Lint
+on: [workflow_dispatch, pull_request]
+env:
+  TERM: xterm-256color
+  CLANG_VERSION: 19
+
+jobs:
+  clang-format:
+    name: Clang-Format
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install clang-format
+      run: |
+        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
+        UBCN=$(lsb_release --short --codename)
+        sudo add-apt-repository "deb https://apt.llvm.org/${UBCN}/ llvm-toolchain-${UBCN}-${CLANG_VERSION} main"
+        sudo apt update || true
+        sudo apt install -y clang-format-${CLANG_VERSION}
+
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+        lfs: true
+
+    - name: Run clang-format
+      run: |
+        if ! git clang-format-${CLANG_VERSION} --binary=clang-format-${CLANG_VERSION} --diff --commit=origin/develop
+        then
+          echo -e "\033[1;31mCode style does not match clang-format"
+          exit 1
+        fi