Commit Graph

8 Commits

Author SHA1 Message Date
Matti Paaso
c69a56646f Replace hard coded branch value with environment variable
Axvion analysis will be run also in release branches and this
prevents results to be mixed between brnaches.

Task-number: QTQAINFRA-7599
Pick-to: 6.11 6.10 6.8
Change-Id: I5766d234bce2054d0dc6999ae1cac3f05c197d0e
Reviewed-by: Aku Pietikäinen <aku.pietikainen@qt.io>
Reviewed-by: Toni Saario <toni.saario@qt.io>
2025-12-13 11:04:50 +02:00
hjk
740e232f16 Disable more Axivion rules
This disables 12 more generally Mostly Harmless warnings to have a
realistic chance to get down to a base line of zero violations.

Later we can re-evaluate the disabled rules one by one and re-enable
them if wanted.

Change-Id: Id9fc2e4013fb7c59040868fea54f14dcda6cefe0
Reviewed-by: Matti Paaso <matti.paaso@qt.io>
2025-12-12 06:21:41 +01:00
hjk
679593460e Disable Axivion reports for Qt-Security-QDataStreamOperatorRead
This currently flags 294 occurences in Qt Core as errors, practically
all of them related to the implemenation of QDataStream related
functionality.

I think this generally at the wrong level, certainly for Qt Core,
but also for user code: operator>> is (besides operator<<)
/the/ main reason to use the QDataStream class, so if we consider
this risky, QDataStream itself should not be used, i.e. it would
be better to flagging code that creates QDataStream objects not
every use of operator>> of such objects.

Change-Id: If758bde3a77f64cc8c06f8328459dfcd2d94dc8f
Reviewed-by: Matti Paaso <matti.paaso@qt.io>
2025-11-22 20:41:08 +01:00
hjk
23cf42d87a Disable Axivion reports for Qt-FunctionArgsByValueRef
This is an unfortunate combination of clazy-function-args-by-ref and
clazy-function-args-by-value.

function-args-by-ref fixes are almost always safe to apply. They
actually may save an unbounded amount of cycles, and there are typically
only a few of them.

On the other hand, function-args-by-value is a mixed bag: There are a
lot of them and the expected gain is small: It's typically trading one
or two register for one register and a "hot" location on the stack.
Especially when passing down such objects to a through a sequence of
function calls this is not even necessarily a clear win on all
architecture.

In any case it should be considered that especially in the Qt context
changing signatures of public functions is not cheap, if possible
at all.

Change-Id: I281ea086fb15e0a045316591d9af620b5e730f4a
Reviewed-by: Matti Paaso <matti.paaso@qt.io>
Reviewed-by: Alex Blasche <alexander.blasche@qt.io>
2025-11-06 08:12:35 +01:00
Matti Paaso
9e2db25bd5 Enable CWE checks to Axivion configuration
Task-number: QTQAINFRA-7401
Pick-to: 6.8 6.5
Change-Id: I3173acc2941e3811aeb7e56752a56125f00d8f89
Reviewed-by: Jukka Jokiniva <jukka.jokiniva@qt.io>
2025-10-17 11:24:19 +03:00
Matti Paaso
f2303b428f Update Axivion analysis configuration
Update QR rule set and add user name mapping into email to enable
erosion notification.

Task-number: QTQAINFRA-7222
Change-Id: I98fa2f278c3fea7dde61477841ef03ce10223d58
Reviewed-by: Jukka Jokiniva <jukka.jokiniva@qt.io>
2025-09-12 09:03:47 +03:00
Matti Paaso
0ac0b15489 Provisioning: Add sourceserver_remote_url into Axivion config
When running Axivion analysis on virtual machine, analysis will
update sourceserver_gitdir and source_server_remote_url into
result database. If these are missing from configuration,
analysis will use work area values for these and those does
not work on dashboard.

Task-number: QTQAINFRA-6262
Change-Id: I00df7eade6de1a12a6bb59cbd24374dd0cedd715
Reviewed-by: Toni Saario <toni.saario@qt.io>
2024-11-23 08:40:35 +02:00
Mate Barany
32a3103706 Upload the Axivion config files to gerrit
To review and comment on the rules.

Task-number: QTQAINFRA-6577
Change-Id: I3c4f85e307533346d393ed32adccb75c106d882e
Reviewed-by: Simo Fält <simo.falt@qt.io>
2024-10-01 11:51:49 +03:00