From d93f5eebd78aa0db56708e9a6a0321b361fcf0f2 Mon Sep 17 00:00:00 2001
From: Mikhail Romanko <me@blankhex.com>
Date: Fri, 3 Jul 2026 10:51:26 +0300
Subject: [PATCH] Add CI and code checking makefile

---
 .github/workflows/ci.yaml | 79 +++++++++++++++++++++++++++++++++++++++
 Makefile.lint             | 29 ++++++++++++++
 2 files changed, 108 insertions(+)
 create mode 100644 .github/workflows/ci.yaml
 create mode 100644 Makefile.lint

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..369e537
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,79 @@
+name: CI
+
+on:
+  push:
+    branches: [trunk]
+  pull_request:
+    branches: [trunk]
+
+jobs:
+  build-and-analyze:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install tools
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y build-essential clang clang-tools clang-tidy cppcheck
+
+      - name: Build with GCC
+        run: |
+          make -f Makefile.posix clean
+          make -f Makefile.posix CC=gcc CFLAGS="-std=c99 -Wall -Wextra -Wpedantic -Werror -O2"
+
+      - name: Build with Clang
+        run: |
+          make -f Makefile.posix clean
+          make -f Makefile.posix CC=clang CFLAGS="-std=c99 -Wall -Wextra -Wpedantic -Werror -O2"
+
+      - name: Linting checks
+        run: |
+          echo "Running all linting checks..."
+          FAILED=0
+
+          # cppcheck
+          echo "=== Check 1/4: cppcheck ==="
+          if make -f Makefile.lint cppcheck; then
+            echo "cppcheck: PASSED"
+          else
+            echo "cppcheck: FAILED"
+            FAILED=1
+          fi
+
+          # clang-tidy
+          echo "=== Check 2/4: clang-tidy ==="
+          if make -f Makefile.lint clang-tidy; then
+            echo "clang-tidy: PASSED"
+          else
+            echo "clang-tidy: FAILED"
+            FAILED=1
+          fi
+
+          # scan-build
+          echo "=== Check 3/4: scan-build ==="
+          if make -f Makefile.lint scan-build; then
+            echo "scan-build: PASSED"
+          else
+            echo "scan-build: FAILED"
+            FAILED=1
+          fi
+
+          # security-check
+          echo "=== Check 4/4: security-check ==="
+          if make -f Makefile.lint security-check; then
+            echo "security-check: PASSED"
+          else
+            echo "security-check: FAILED"
+            FAILED=1
+          fi
+
+          # Final result
+          if [ $FAILED -ne 0 ]; then
+            echo "One or more linting checks failed."
+            exit 1
+          else
+            echo "All linting checks passed."
+          fi
\ No newline at end of file
diff --git a/Makefile.lint b/Makefile.lint
new file mode 100644
index 0000000..3897d63
--- /dev/null
+++ b/Makefile.lint
@@ -0,0 +1,29 @@
+# Makefile.lint - Individual linting targets
+
+.PHONY: all
+all: cppcheck clang-tidy scan-build security-check
+	@echo "All linting scheduled"
+
+.PHONY: cppcheck
+cppcheck:
+	@echo "Running cppcheck..."
+	@cppcheck --enable=warning,performance,portability --std=c99 --quiet -Iinclude -I. .
+
+.PHONY: clang-tidy
+clang-tidy:
+	@echo "Running clang-tidy..."
+	@for file in $$(find . -name "*.c" -type f); do \
+		clang-tidy "$$file" -- -I. -Iinclude -std=c99; \
+	done
+
+.PHONY: scan-build
+scan-build:
+	@echo "Running scan-build..."
+	@scan-build --status-bugs make -f Makefile.posix clean all CC=clang
+
+.PHONY: security-check
+security-check:
+	@echo "Scanning for unsafe C functions..."
+	@grep -rnE '\b(strcpy|strcat|sprintf|gets|scanf|sscanf|realpath|mktemp|tempnam|tmpnam|getwd|getlogin)\b' \
+		. --include="*.c" --include="*.h" | grep -v "^Binary file" && \
+		exit 1 || exit 0
\ No newline at end of file