Add static analysis workflow

.codechecker.json

@@ -0,0 +1,22 @@
+{
+    "analyze": [
+        "-d",
+        "clang-diagnostic-reserved-macro-identifier",
+        "-d",
+        "clang-diagnostic-reserved-identifier",
+        "-d",
+        "cert-err33-c",
+        "-d",
+        "clang-diagnostic-sign-compare",
+        "-d",
+        "clang-diagnostic-implicit-int-float-conversion",
+        "-d",
+        "clang-diagnostic-switch-enum",
+        "--analyzers",
+        "clangsa",
+        "clang-tidy",
+        "gcc",
+        "-i",
+        ".codechecker.skipfile"
+    ]
+}

.codechecker.skipfile

@@ -0,0 +1,2 @@
++*/flutter-pi/src
+-*

.github/workflows/codeql-buildscript.sh

@@ -1,6 +1,23 @@
 #!/usr/bin/env bash
 
-sudo apt install -y cmake libgl1-mesa-dev libgles2-mesa-dev libegl1-mesa-dev libdrm-dev libgbm-dev ttf-mscorefonts-installer fontconfig libsystemd-dev libinput-dev libudev-dev  libxkbcommon-dev
-mkdir build && cd build
-cmake ..
-make -j`nproc`
+# gstreamer and libc++ want different versions of libunwind-dev.
+# We explicitly install the version that gstreamer wants so
+# we don't get install errors.
+
+sudo apt-get install -y --no-install-recommends \
+    git cmake pkg-config ninja-build clang clang-tools \
+    libgl-dev libgles-dev libegl-dev libvulkan-dev libdrm-dev libgbm-dev libsystemd-dev libinput-dev libudev-dev libxkbcommon-dev \
+    libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
+    libunwind-dev
+
+$WRAPPER cmake \
+    -S . -B build \
+    -GNinja \
+    -DCMAKE_BUILD_TYPE=Debug \
+    -DBUILD_GSTREAMER_VIDEO_PLAYER_PLUGIN=ON \
+    -DBUILD_GSTREAMER_AUDIO_PLAYER_PLUGIN=ON \
+    -DENABLE_VULKAN=ON \
+    -DENABLE_SESSION_SWITCHING=ON \
+    -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
+
+$WRAPPER cmake --build build

.github/workflows/fail_on_error.py → .github/workflows/fail_on_warning.py

@@ -20,13 +20,18 @@ def codeql_sarif_contain_error(filename):
                 rule_index = res['rule']['index']
             else:
                 continue
+
             try:
                 rule_level = rules_metadata[rule_index]['defaultConfiguration']['level']
-            except IndexError as e:
-                print(e, rule_index, len(rules_metadata))
-            else:
-                if rule_level == 'error':
-                    return True
+            except LookupError:
+                # According to the SARIF schema (https://www.schemastore.org/schemas/json/sarif-2.1.0-rtm.6.json),
+                # the defalt level is "warning" if not specified.
+                rule_level = 'warning'
+
+            if rule_level == 'error':
+                return True
+            elif rule_level == 'warning':
+                return True
     return False
 
 if __name__ == "__main__":

.github/workflows/static-analysis.yml

@@ -0,0 +1,58 @@
+name: "Static Analysis"
+
+on:
+  push:
+    branches: [ "main", "master" ]
+  schedule:
+    - cron: '0 0 * * *'
+  pull_request:
+    branches: '*'
+
+jobs:
+  codechecker:
+    name: CodeChecker
+
+    # Use latest Ubuntu 24.04 for latest GCC.
+    # CodeChecker requires gcc >= 13.0.0.
+    # ubuntu-latest is ubuntu 22.04 (atm)
+    runs-on: ubuntu-24.04
+
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+
+    - name: Install Deps, Configure and Build
+      run: |
+        ./.github/workflows/codeql-buildscript.sh
+
+    - name: Run CodeChecker
+      uses: ardera/CodeChecker-Action@master
+      id: codechecker
+      with:
+        ctu: true
+        logfile: ${{ github.workspace }}/build/compile_commands.json
+        config: ${{ github.workspace }}/.codechecker.json
+
+    - uses: actions/upload-artifact@v4
+      id: upload
+      with:
+        name: "CodeChecker Bug Reports"
+        path: ${{ steps.codechecker.outputs.result-html-dir }}
+
+    - name: Fail on Warnings
+      if: ${{ steps.codechecker.outputs.warnings == 'true' }}
+      run: |
+        cat <<EOF >>$GITHUB_STEP_SUMMARY
+        ## ⚠️ CodeChecker found warnings
+        Please see the 'CodeChecker Bug Reports' artifact for more details:
+        - ${{ steps.upload.outputs.artifact-url }}
+        EOF
+
+        exit 1

.gitignore

@@ -1,6 +1,7 @@
 /.vscode
 /build
 /out
+/.codechecker
 
 # CMake docs says it should not be checked in.
 CMakeUserPresets.json

CMakeLists.txt

@@ -162,13 +162,14 @@ target_link_libraries(flutterpi_module PUBLIC
 )
 
 target_include_directories(flutterpi_module PUBLIC
-  ${CMAKE_SOURCE_DIR}/third_party/flutter_embedder_header/include
   ${CMAKE_SOURCE_DIR}/src
   ${CMAKE_BINARY_DIR}
+  ${CMAKE_SOURCE_DIR}/third_party/mesa3d/include
+  ${CMAKE_SOURCE_DIR}/third_party/flutter_embedder_header/include
 )
 
 target_compile_options(flutterpi_module PUBLIC
-  $<$<CONFIG:Debug>:-O0 -Wall -Wextra -Wno-sign-compare -Werror -ggdb -U_FORTIFY_SOURCE -DDEBUG>
+  $<$<CONFIG:Debug>:-O0 -Wall -Wextra -Wno-sign-compare -Wswitch-enum -Wformat -Wdouble-promotion -Wno-overlength-strings -Wno-gnu-zero-variadic-macro-arguments -pedantic -Werror -ggdb -U_FORTIFY_SOURCE -DDEBUG>
   $<$<CONFIG:RelWithDebInfo>:-O3 -Wall -Wextra -Wno-sign-compare -ggdb -DNDEBUG>
   $<$<CONFIG:Release>:-O3 -Wall -Wextra -Wno-sign-compare -DNDEBUG>
 )
@@ -237,6 +238,7 @@ if (ENABLE_VULKAN)
     target_sources(flutterpi_module PRIVATE
       src/vk_gbm_render_surface.c
       src/vk_renderer.c
+      src/vulkan.c
     )
     target_link_libraries(flutterpi_module PUBLIC
       PkgConfig::VULKAN

CMakePresets.json

@@ -7,15 +7,58 @@
             "description": "Sets Ninja generator, build and install directory",
             "generator": "Ninja",
             "binaryDir": "${sourceDir}/out/build/${presetName}",
+            "hidden": true,
             "cacheVariables": {
                 "CMAKE_BUILD_TYPE": "Debug",
                 "CMAKE_INSTALL_PREFIX": "${sourceDir}/out/install/${presetName}",
+                "TRY_ENABLE_OPENGL": false,
                 "ENABLE_OPENGL": true,
+                "TRY_ENABLE_VULKAN": false,
+                "ENABLE_VULKAN": true,
+                "BUILD_GSTREAMER_VIDEO_PLAYER_PLUGIN": true,
+                "TRY_BUILD_GSTREAMER_VIDEO_PLAYER_PLUGIN": false,
                 "BUILD_GSTREAMER_AUDIO_PLAYER_PLUGIN": true,
+                "TRY_BUILD_GSTREAMER_AUDIO_PLAYER_PLUGIN": false,
                 "BUILD_SENTRY_PLUGIN": true,
                 "ENABLE_TESTS": true
             }
         },
+        {
+            "name": "default-clang",
+            "displayName": "Default OpenGL host build (clang)",
+            "description": "Sets Ninja generator, build and install directory",
+            "generator": "Ninja",
+            "binaryDir": "${sourceDir}/out/build/${presetName}",
+            "inherits": "default",
+            "cacheVariables": {
+                "CMAKE_C_COMPILER": "clang",
+                "CMAKE_CXX_COMPILER": "clang++"
+            }
+        },
+        {
+            "name": "default-clang-20",
+            "displayName": "Default OpenGL host build (clang-20)",
+            "description": "Sets Ninja generator, build and install directory",
+            "generator": "Ninja",
+            "binaryDir": "${sourceDir}/out/build/${presetName}",
+            "inherits": "default",
+            "cacheVariables": {
+                "CMAKE_C_COMPILER": "clang-20",
+                "CMAKE_CXX_COMPILER": "clang++-20"
+            }
+        },
+        {
+            "name": "default-gcc",
+            "displayName": "Default OpenGL host build (gcc)",
+            "description": "Sets Ninja generator, build and install directory",
+            "generator": "Ninja",
+            "binaryDir": "${sourceDir}/out/build/${presetName}",
+            "inherits": "default",
+            "cacheVariables": {
+                "CMAKE_C_COMPILER": "gcc",
+                "CMAKE_CXX_COMPILER": "g++"
+            }
+        },
         {
             "name": "cross-aarch64-default",
             "displayName": "OpenGL AArch64 cross-build",
@@ -41,4 +84,4 @@
             }
         }
     ]
-}
+}