chore: import upstream snapshot with attribution

2026-07-13 12:28:05 +08:00
commit 41cb1c0170
1830 changed files with 38276124 additions and 0 deletions
@@ -0,0 +1,51 @@
+# Reusable: lint only (cppcheck + clang-format).
+# Security-static and CodeQL gate are separate — see _security.yml.
+name: Lint & Security
+
+on:
+  workflow_call: {}
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      # Tests must pass or fail — no SKIPs except genuinely platform-specific
+      # ones (SKIP_PLATFORM / #ifdef). Fails the lint phase on any plain SKIP().
+      - name: No-skips policy (tests pass or fail)
+        run: bash scripts/check-no-test-skips.sh
+
+      - name: Install build deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev cmake
+
+      - name: Install LLVM 20
+        run: |
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+          echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" | sudo tee /etc/apt/sources.list.d/llvm-20.list
+          sudo apt-get update
+          sudo apt-get install -y clang-format-20
+
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        id: cppcheck-cache
+        with:
+          path: /opt/cppcheck
+          key: cppcheck-2.20.0-ubuntu-amd64
+
+      - name: Build cppcheck 2.20.0
+        if: steps.cppcheck-cache.outputs.cache-hit != 'true'
+        run: |
+          git clone --depth 1 --branch 2.20.0 https://github.com/danmar/cppcheck.git /tmp/cppcheck
+          cmake -S /tmp/cppcheck -B /tmp/cppcheck/build -DCMAKE_BUILD_TYPE=Release -DHAVE_RULES=OFF -DCMAKE_INSTALL_PREFIX=/opt/cppcheck
+          cmake --build /tmp/cppcheck/build -j$(nproc)
+          cmake --install /tmp/cppcheck/build
+
+      - name: Add cppcheck to PATH
+        run: echo "/opt/cppcheck/bin" >> "$GITHUB_PATH"
+
+      - name: Lint (cppcheck + clang-format, no clang-tidy — enforced locally)
+        run: scripts/lint.sh --ci CLANG_FORMAT=clang-format-20