mirror of
https://github.com/Cacti/spine.git
synced 2026-10-23 03:27:10 +09:00
86a062dd09
## Summary Consolidates the connector/build work from #613 and the broader test-infrastructure work extracted from #597 into one review: - discover MariaDB Connector/C first while retaining MySQL and Percona-compatible support - test MariaDB and MySQL Connector/C with strict GCC and Clang builds on Ubuntu 24.04 - add a real macOS 15 build and unit-test lane with portable Autotools platform detection - run unit tests under ASan/UBSan and ThreadSanitizer - enforce the measured 7% global coverage baseline and 70% changed-line coverage - add libFuzzer coverage for output parsing alongside the existing hostname parser - exercise the SNMPv3 integration suite against MariaDB and MySQL 8.4 - add cppcheck, shellcheck, DCO verification, CODEOWNERS, distcheck, and Linux-capability checks while retaining the repository-managed default CodeQL setup - expose a stable `CI / required` aggregate check for branch protection - pin runners and third-party actions and keep workflow permissions read-only by default ## Correctness fixes found by the new gates - reject truncated capability strings and poller-output SQL tuples instead of publishing partial data - make `bootstrap` fail closed and select `libtoolize`/`glibtoolize` portably - use Autoconf's canonical host for Darwin detection instead of an empty native-build alias - remove stale initialization/name-shadow findings and make read-only interfaces const-correct - make the ICMP parser test portable across Linux and BSD header names ## Verification - strict GCC and Clang builds: 4/4 unit targets passed - ASan/UBSan: 4/4 passed - ThreadSanitizer: 4/4 passed - macOS Clang/Homebrew build: 4/4 passed - MariaDB integration: passed - MySQL 8.4 integration: passed - both libFuzzer targets: passed sustained local runs - coverage: 7.2% global and 84% on changed lines - cppcheck, shellcheck, actionlint, DCO verification, and `git diff --check`: passed locally ## Post-merge repository settings After these workflows exist on `develop`, an administrator should require `CI / required`, Fuzz, Integration, Rocky Linux, and the repository-managed CodeQL/code-scanning result in the active ruleset; enable code-owner approval; and require the branch to be current (or use a merge queue). Enabling those settings before this PR merges would create required checks that the base branch cannot yet emit. Consolidates and supersedes #613. Closes #612. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Signed-off-by: TheWitness <thewitness@cacti.net> Signed-off-by: TheWitness <copilot@users.noreply.github.com> Co-authored-by: TheWitness <thewitness@cacti.net> Co-authored-by: TheWitness <copilot@users.noreply.github.com>
31 lines
874 B
Bash
Executable File
31 lines
874 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Verify that every commit in a revision range has a Signed-off-by trailer
|
|
# matching that commit's author. This enforces the Developer Certificate of
|
|
# Origin without granting a third-party action access to the repository.
|
|
set -euo pipefail
|
|
|
|
if [[ $# -ne 1 || -z $1 ]]; then
|
|
echo "usage: $0 <git-revision-range>" >&2
|
|
exit 2
|
|
fi
|
|
|
|
range=$1
|
|
failures=0
|
|
|
|
while IFS= read -r commit; do
|
|
author=$(git show -s --format='%an <%ae>' "$commit")
|
|
if ! git show -s --format='%B' "$commit" \
|
|
| git interpret-trailers --parse \
|
|
| grep -Fqi "Signed-off-by: $author"; then
|
|
echo "${commit}: missing Signed-off-by: ${author}" >&2
|
|
failures=$((failures + 1))
|
|
fi
|
|
done < <(git rev-list --reverse "$range")
|
|
|
|
if ((failures > 0)); then
|
|
echo "$failures commit(s) failed the DCO check." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "All commits in $range have matching Signed-off-by trailers."
|