Fixes for key material zeroization across JCE and JNI, PBKDF input validation #523
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Clang Static Analyzer (scan-build) | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| # Cancel superseded in-progress runs for the same PR. In-progress | |
| # push runs are never cancelled, though a still-queued push run may | |
| # be superseded by a newer queued one. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| scan-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Install scan-build (part of clang-tools) | |
| - name: Install scan-build | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y clang-tools | |
| # Cache the installed wolfSSL build. The key matches the one built | |
| # in linux-common.yml for the same configure flags, so this job | |
| # shares the cache with the main CI matrix. | |
| - name: Build native wolfSSL (cached) | |
| uses: ./.github/actions/build-wolfssl-cached | |
| with: | |
| configure: '--enable-jni --enable-all' | |
| # Setup Java (the makefile needs JAVA_HOME for the JNI headers) | |
| - name: Setup java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'zulu' | |
| java-version: '11' | |
| # Copy appropriate makefile for Linux | |
| - name: Copy makefile | |
| run: cp makefile.linux makefile | |
| # Run scan-build over the native JNI C files. The default make | |
| # target compiles only the native library, so no JUnit jars or | |
| # LD_LIBRARY_PATH are needed since no Java builds or tests run. | |
| - name: Run scan-build | |
| env: | |
| PREFIX: ${{ github.workspace }}/build-dir | |
| run: | | |
| scan-build --status-bugs -o scan-build-reports make | |
| # Upload scan-build results as artifacts | |
| - name: Upload scan-build results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: scan-build-reports | |
| path: scan-build-reports/ | |
| # Show scan-build results in logs | |
| - name: Show scan-build results | |
| if: always() | |
| run: | | |
| if [ -d "scan-build-reports" ]; then | |
| echo "=== Scan-build analysis complete ===" | |
| find scan-build-reports -name "*.html" -exec echo "Report: {}" \; | |
| if find scan-build-reports -name "*.html" | head -1 | xargs grep -l "No bugs found" > /dev/null 2>&1; then | |
| echo "✅ No static analysis issues found" | |
| else | |
| echo "⚠️ Static analysis issues detected - check artifacts" | |
| find scan-build-reports -name "*.txt" -exec cat {} \; || true | |
| fi | |
| else | |
| echo "No scan-build reports generated" | |
| fi |