Static Analysis Tool Integration

/* Polyspace Bug Finder detects runtime errors statically */
/* Colours: Red = definite bug, Orange = possible bug, Green = proved safe */

#include 

uint32_t g_table[10];

/* Polyspace RED: Out-of-bounds array access */
void bad_access(uint8_t idx) {
    g_table[idx] = 0u;  /* idx can be 0-255 but table is [10] → definite OOB */
}

/* Polyspace ORANGE: Possible division by zero */
uint32_t divide(uint32_t a, uint32_t b) {
    return a / b;  /* orange: b might be 0; add guard */
}

/* Fixed: Polyspace GREEN — proves no runtime error */
uint32_t divide_safe(uint32_t a, uint32_t b) {
    if (b == 0u) { return 0u; }
    return a / b;
}

/* Polyspace also detects:
   - Integer overflow (signed)
   - NULL pointer dereference
   - Use of uninitialised variable
   - Infinite loop (Code Prover)
   - Unreachable code
   - Non-terminating function call

   Configuration: polyspace-bug-finder -sources src/ -checkers all-misra
                  -misra-c:2012 -results-dir results/polyspace            */

# GitLab CI: static analysis gates for MISRA-C:2012 compliance
# Runs on every merge request

stages: [build, static_analysis, report]

misra_check:
  stage: static_analysis
  image: pclint-plus:latest
  script:
    # Run PC-lint on all source files; output MISRA violations to file
    - pclint-plus -DMISRA_C_2012 -w3 src/*.c > lint_results.txt 2>&1
    # Count mandatory violations (must be 0)
    - mandatory=$(grep -c "MISRA.*mandatory" lint_results.txt || true)
    - echo "Mandatory violations: $mandatory"
    - if [ "$mandatory" -gt "0" ]; then exit 1; fi
    # Count required violations (must stay below threshold)
    - required=$(grep -c "MISRA.*required" lint_results.txt || true)
    - echo "Required violations: $required (threshold: 50)"
    - if [ "$required" -gt "50" ]; then exit 1; fi
  artifacts:
    paths: [lint_results.txt]
    reports:
      codequality: lint_results.txt
  allow_failure: false  # mandatory: blocks merge

polyspace_bugfinder:
  stage: static_analysis
  script:
    - polyspace-bug-finder -sources src/ -checkers all-misra -misra-c:2012
    - polyspace-results-export -format csv -output results.csv
    - python3 ci/check_polyspace_results.py results.csv  # assert no reds
  artifacts:
    paths: [results.csv, polyspace_results/]