mirror of
https://github.com/Cacti/spine.git
synced 2026-10-23 03:27:10 +09:00
86a062dd09
## Summary Consolidates the connector/build work from #613 and the broader test-infrastructure work extracted from #597 into one review: - discover MariaDB Connector/C first while retaining MySQL and Percona-compatible support - test MariaDB and MySQL Connector/C with strict GCC and Clang builds on Ubuntu 24.04 - add a real macOS 15 build and unit-test lane with portable Autotools platform detection - run unit tests under ASan/UBSan and ThreadSanitizer - enforce the measured 7% global coverage baseline and 70% changed-line coverage - add libFuzzer coverage for output parsing alongside the existing hostname parser - exercise the SNMPv3 integration suite against MariaDB and MySQL 8.4 - add cppcheck, shellcheck, DCO verification, CODEOWNERS, distcheck, and Linux-capability checks while retaining the repository-managed default CodeQL setup - expose a stable `CI / required` aggregate check for branch protection - pin runners and third-party actions and keep workflow permissions read-only by default ## Correctness fixes found by the new gates - reject truncated capability strings and poller-output SQL tuples instead of publishing partial data - make `bootstrap` fail closed and select `libtoolize`/`glibtoolize` portably - use Autoconf's canonical host for Darwin detection instead of an empty native-build alias - remove stale initialization/name-shadow findings and make read-only interfaces const-correct - make the ICMP parser test portable across Linux and BSD header names ## Verification - strict GCC and Clang builds: 4/4 unit targets passed - ASan/UBSan: 4/4 passed - ThreadSanitizer: 4/4 passed - macOS Clang/Homebrew build: 4/4 passed - MariaDB integration: passed - MySQL 8.4 integration: passed - both libFuzzer targets: passed sustained local runs - coverage: 7.2% global and 84% on changed lines - cppcheck, shellcheck, actionlint, DCO verification, and `git diff --check`: passed locally ## Post-merge repository settings After these workflows exist on `develop`, an administrator should require `CI / required`, Fuzz, Integration, Rocky Linux, and the repository-managed CodeQL/code-scanning result in the active ruleset; enable code-owner approval; and require the branch to be current (or use a merge queue). Enabling those settings before this PR merges would create required checks that the base branch cannot yet emit. Consolidates and supersedes #613. Closes #612. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Signed-off-by: TheWitness <thewitness@cacti.net> Signed-off-by: TheWitness <copilot@users.noreply.github.com> Co-authored-by: TheWitness <thewitness@cacti.net> Co-authored-by: TheWitness <copilot@users.noreply.github.com>
19 lines
1.0 KiB
Plaintext
19 lines
1.0 KiB
Plaintext
# Default review routing.
|
|
* @Cacti/cacti-developers
|
|
|
|
# CI, release and dependency policy changes need both implementation and
|
|
# security review. These requirements take effect when the repository ruleset
|
|
# enables code-owner approval.
|
|
/.github/ @Cacti/cacti-developers @Cacti/cacti-security
|
|
/configure.ac @Cacti/cacti-developers @Cacti/cacti-security
|
|
/Makefile.am @Cacti/cacti-developers @Cacti/cacti-security
|
|
/Dockerfile @Cacti/cacti-developers @Cacti/cacti-security
|
|
|
|
# High-risk runtime boundaries.
|
|
/sql.c @Cacti/cacti-developers @Cacti/cacti-security
|
|
/php.c @Cacti/cacti-developers @Cacti/cacti-security
|
|
/nft_popen.c @Cacti/cacti-developers @Cacti/cacti-security
|
|
/snmp.c @Cacti/cacti-developers @Cacti/cacti-security
|
|
/ping.c @Cacti/cacti-developers @Cacti/cacti-security
|
|
/poller.c @Cacti/cacti-developers @Cacti/cacti-security
|