From 75c55ba1a0edaf25bd0924c6a0b89567a6e2cfe4 Mon Sep 17 00:00:00 2001 From: Vamsi-2581 <245859299+Vamsi-2581@users.noreply.github.com> Date: Sat, 31 Oct 2026 18:03:21 +0530 Subject: [PATCH 1/6] fix(action): handle supported Ubuntu LLVM versions --- action.yml | 53 ++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 46 insertions(+), 7 deletions(-) diff --git a/action.yml b/action.yml index 99557467..f893fb9b 100644 --- a/action.yml +++ b/action.yml @@ -91,18 +91,57 @@ runs: # --------------------------------------------------------------- - name: Install LLVM ${{ inputs.llvm-version }} shell: bash + env: + LLVM_VERSION: ${{ inputs.llvm-version }} run: | + CODENAME=$(. /etc/os-release && printf '%s' "${VERSION_CODENAME}") + if [[ ! "${LLVM_VERSION}" =~ ^[0-9]+$ ]] || (( 10#${LLVM_VERSION} < 19 )); then + echo "::error::llvm-version must be a numeric LLVM major version of 19 or newer." + exit 1 + fi + + case "${CODENAME}" in + jammy|noble) + case "${LLVM_VERSION}" in + 19|20|21|22|23) + ;; + *) + echo "::error::Ubuntu 22.04 (jammy) and 24.04 (noble) support versioned apt.llvm.org packages for LLVM 19 through 23. Choose one of those versions." + exit 1 + ;; + esac + ;; + resolute) + case "${LLVM_VERSION}" in + 21|22|23) + ;; + *) + echo "::error::Ubuntu 26.04 (resolute) provides versioned LLVM packages 21, 22, and 23 from apt.llvm.org. Use ubuntu-22.04 or ubuntu-24.04 for LLVM 20, or set llvm-version to 21, 22, or 23." + exit 1 + ;; + esac + ;; + *) + echo "::error::Unsupported Ubuntu release '${CODENAME}'. Supported runner images are ubuntu-22.04 (jammy) and ubuntu-24.04 (noble) with LLVM 19-23, and ubuntu-26.04 (resolute) with LLVM 21-23." + exit 1 + ;; + esac + sudo apt-get update - wget -qO - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - CODENAME=$(lsb_release -cs) - sudo apt-add-repository "deb http://apt.llvm.org/${CODENAME}/ llvm-toolchain-${CODENAME}-${{ inputs.llvm-version }} main" + sudo apt-get install -y --no-install-recommends ca-certificates curl gnupg + sudo install -d -m 0755 /etc/apt/keyrings + curl --fail --silent --show-error --location https://apt.llvm.org/llvm-snapshot.gpg.key | + sudo gpg --dearmor --batch --yes --output /etc/apt/keyrings/llvm.gpg + sudo chmod 0644 /etc/apt/keyrings/llvm.gpg + echo "deb [signed-by=/etc/apt/keyrings/llvm.gpg] https://apt.llvm.org/${CODENAME}/ llvm-toolchain-${CODENAME}-${LLVM_VERSION} main" | + sudo tee /etc/apt/sources.list.d/llvm.list sudo apt-get update sudo apt-get install -y --no-install-recommends \ cmake ninja-build python3 build-essential \ - llvm-${{ inputs.llvm-version }} \ - llvm-${{ inputs.llvm-version }}-dev \ - clang-${{ inputs.llvm-version }} \ - libclang-${{ inputs.llvm-version }}-dev + llvm-${LLVM_VERSION} \ + llvm-${LLVM_VERSION}-dev \ + clang-${LLVM_VERSION} \ + libclang-${LLVM_VERSION}-dev # --------------------------------------------------------------- # 2. Cache + Build the analyzer From 7dc9a7a4db8b896ddcce647e5f925280b832a7d8 Mon Sep 17 00:00:00 2001 From: Vamsi-2581 <245859299+Vamsi-2581@users.noreply.github.com> Date: Sat, 31 Oct 2026 18:03:23 +0530 Subject: [PATCH 2/6] docs(action): document Ubuntu runner compatibility --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 5713f5dc..44d12625 100644 --- a/README.md +++ b/README.md @@ -64,6 +64,8 @@ GitHub Actions consumer example is available at: If you publish tags for this repository, other projects can consume it directly: +**Supported Ubuntu runners:** Ubuntu 22.04 (`jammy`) and 24.04 (`noble`) support versioned LLVM packages 19–23. Ubuntu 26.04 (`resolute`) supports versions 21–23; set `llvm-version` to one of those versions. Unsupported runner and LLVM combinations fail before package installation with a diagnostic. + ```yaml name: Stack Analysis From b0922f075e0fe204c695ecd8d47fc0143b0b521f Mon Sep 17 00:00:00 2001 From: Hugo Date: Sat, 31 Oct 2026 22:47:22 +0100 Subject: [PATCH 3/6] fix(action): ask apt.llvm.org for the LLVM branch instead of a codename table The two case blocks restated which LLVM branches apt.llvm.org publishes for each Ubuntu release, a table that goes stale with every LLVM or Ubuntu release. Request the branch's Release file instead: a 200 lets the installation go on, while any other status, or no answer at all, stops the step with the URL and the status before the LLVM source is added. --- action.yml | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-) diff --git a/action.yml b/action.yml index f893fb9b..79814d35 100644 --- a/action.yml +++ b/action.yml @@ -100,35 +100,15 @@ runs: exit 1 fi - case "${CODENAME}" in - jammy|noble) - case "${LLVM_VERSION}" in - 19|20|21|22|23) - ;; - *) - echo "::error::Ubuntu 22.04 (jammy) and 24.04 (noble) support versioned apt.llvm.org packages for LLVM 19 through 23. Choose one of those versions." - exit 1 - ;; - esac - ;; - resolute) - case "${LLVM_VERSION}" in - 21|22|23) - ;; - *) - echo "::error::Ubuntu 26.04 (resolute) provides versioned LLVM packages 21, 22, and 23 from apt.llvm.org. Use ubuntu-22.04 or ubuntu-24.04 for LLVM 20, or set llvm-version to 21, 22, or 23." - exit 1 - ;; - esac - ;; - *) - echo "::error::Unsupported Ubuntu release '${CODENAME}'. Supported runner images are ubuntu-22.04 (jammy) and ubuntu-24.04 (noble) with LLVM 19-23, and ubuntu-26.04 (resolute) with LLVM 21-23." - exit 1 - ;; - esac - sudo apt-get update sudo apt-get install -y --no-install-recommends ca-certificates curl gnupg + # apt.llvm.org publishes a different set of LLVM branches for each Ubuntu release: ask it. + release_url="https://apt.llvm.org/${CODENAME}/dists/llvm-toolchain-${CODENAME}-${LLVM_VERSION}/Release" + status=$(curl --silent --head --location --output /dev/null --write-out '%{http_code}' "${release_url}") || status="unreachable" + if [[ "${status}" != 200 ]]; then + echo "::error::Cannot find LLVM ${LLVM_VERSION} packages for '${CODENAME}' at ${release_url} (status: ${status})." + exit 1 + fi sudo install -d -m 0755 /etc/apt/keyrings curl --fail --silent --show-error --location https://apt.llvm.org/llvm-snapshot.gpg.key | sudo gpg --dearmor --batch --yes --output /etc/apt/keyrings/llvm.gpg From 0c7eeee93c908d9c646b7bdb6a7066c90f63e684 Mon Sep 17 00:00:00 2001 From: Hugo Date: Sat, 31 Oct 2026 22:47:22 +0100 Subject: [PATCH 4/6] fix(action): accept LLVM 20 only, the version the analyzer builds with LLVM 21 stops the build in coretrace-compiler v0.10.0, which the analyzer pins, and the analyzer's own sources use llvm::Attribute::NoCapture, which LLVM 21 removed. LLVM 19 fails in ResourceFactCollector.cpp. CI builds and tests LLVM 20 only, so reject any other llvm-version before apt runs, and name ubuntu-24.04, where the action is tested, when a runner has no LLVM 20 packages. --- action.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/action.yml b/action.yml index 79814d35..228e8b99 100644 --- a/action.yml +++ b/action.yml @@ -95,8 +95,8 @@ runs: LLVM_VERSION: ${{ inputs.llvm-version }} run: | CODENAME=$(. /etc/os-release && printf '%s' "${VERSION_CODENAME}") - if [[ ! "${LLVM_VERSION}" =~ ^[0-9]+$ ]] || (( 10#${LLVM_VERSION} < 19 )); then - echo "::error::llvm-version must be a numeric LLVM major version of 19 or newer." + if [[ "${LLVM_VERSION}" != 20 ]]; then + echo "::error::The analyzer builds with LLVM 20 only; got llvm-version '${LLVM_VERSION}'." exit 1 fi @@ -106,7 +106,7 @@ runs: release_url="https://apt.llvm.org/${CODENAME}/dists/llvm-toolchain-${CODENAME}-${LLVM_VERSION}/Release" status=$(curl --silent --head --location --output /dev/null --write-out '%{http_code}' "${release_url}") || status="unreachable" if [[ "${status}" != 200 ]]; then - echo "::error::Cannot find LLVM ${LLVM_VERSION} packages for '${CODENAME}' at ${release_url} (status: ${status})." + echo "::error::Cannot find LLVM ${LLVM_VERSION} packages for '${CODENAME}' at ${release_url} (status: ${status}). The action is tested on ubuntu-24.04." exit 1 fi sudo install -d -m 0755 /etc/apt/keyrings From 8bb1d8afbc5ef17b95ad14364cc8fe03d207ed69 Mon Sep 17 00:00:00 2001 From: Hugo Date: Sat, 31 Oct 2026 22:47:22 +0100 Subject: [PATCH 5/6] docs(action): document that llvm-version accepts LLVM 20 only The input stays, so that workflows passing llvm-version: 20 keep working. --- action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/action.yml b/action.yml index 228e8b99..d6101a9a 100644 --- a/action.yml +++ b/action.yml @@ -65,7 +65,7 @@ inputs: required: false default: "true" llvm-version: - description: "LLVM version to install." + description: "LLVM version to install. The analyzer builds with LLVM 20 only." required: false default: "20" From fec2908bc846e99958b9750216227285fe922d66 Mon Sep 17 00:00:00 2001 From: Hugo Date: Sat, 31 Oct 2026 22:47:22 +0100 Subject: [PATCH 6/6] docs(readme): move the action's runner note under Notes and require LLVM 20 The note sat between the sentence that introduces the workflow example and the example itself, and advertised LLVM 19 to 23 and Ubuntu 26.04. Describe what the action does instead, in the Notes list that follows the example: LLVM 20 from apt.llvm.org, tested on ubuntu-24.04, and an early error for any other version or a runner without LLVM 20 packages. --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 44d12625..0f0d00be 100644 --- a/README.md +++ b/README.md @@ -64,8 +64,6 @@ GitHub Actions consumer example is available at: If you publish tags for this repository, other projects can consume it directly: -**Supported Ubuntu runners:** Ubuntu 22.04 (`jammy`) and 24.04 (`noble`) support versioned LLVM packages 19–23. Ubuntu 26.04 (`resolute`) supports versions 21–23; set `llvm-version` to one of those versions. Unsupported runner and LLVM combinations fail before package installation with a diagnostic. - ```yaml name: Stack Analysis @@ -99,6 +97,9 @@ jobs: ``` Notes: +- The action installs LLVM 20 from apt.llvm.org, the version the analyzer builds with, and is tested + on `ubuntu-24.04`. With another `llvm-version`, or on a runner for which apt.llvm.org publishes no + LLVM 20 packages, such as `ubuntu-26.04`, it stops with an error before installing LLVM. - SARIF is generated by default (`sarif-file`) and can be uploaded automatically (`upload-sarif: "true"`). - Each SARIF rule carries the CWE tags of its diagnostics. A rule that detects a security weakness also carries the `security` tag and a `security-severity` score, so code scanning lists its