Repository navigation
Add static and runtime verification tools against existing tests #15298
Description
/cc: @stephentoub @vijaykota @pgavlin @davidsh
We should augment our CI with static and runtime verification tools that can be enabled against our existing tests:
Windows:
- FXCop (edit: covered by https://github.com/dotnet/corefx/issues/14095)
- PREfast for Native code
- AppVerifier
Linux:
This should already be part of normal pre-commit procedures for all teams.
Could we make this an automated part of CI/Weekly testing?
Activity
stephentoub commentedon Sep 28, 2015
cc: @nguerrera, @mmitche
joshfree commentedon Oct 1, 2015
@steveharter could you take a look at this while you're working on CLANG debug switches?
steveharter commentedon Nov 10, 2015
Enabling the CLANG switches is under review. This was problematic due to various linker errors caused by header files including definitions not implemented for various ifdefs. dotnet/coreclr@master...steveharter:CMake
steveharter commentedon Nov 10, 2015
For CMAKE sanitizers Will create at least these new issues:
[-]Add runtime verification tools against existing tests[/-][+]Add static and runtime verification tools against existing tests[/+]CIPop commentedon Oct 24, 2016
Tracking adding static analyzers with this issue as well.
mellinoe commentedon Nov 11, 2016
@CIPop Of the things in the original issue, how much have we enabled now, and how much do we think still needs to be invested in? I know we have started running some build-time analyzers on the managed code, and we have at least done some offline (i.e. not build-time) analysis of the native code. Are there more things we should be adding to build-time validation?
CIPop commentedon Nov 11, 2016
@mellinoe I just opened the issue observing that these tools were missing but I am not aware of any changes that have been made since.
@steveharter might be able to answer your question.
I've converted this into a checkbox issue to better track progress.
weshaggard commentedon Dec 12, 2017
I believe we have all the tools we want enabled now and some tools just part of our security builds so we should be covered.