Skip to content

v0.6.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Aug 23:22
v0.6.2
c836a68
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

cfusa v0.6.2

Architecture-plan loop: eleven tracked improvement issues (#203–#213),
eight shipped across eight PRs (#215–#218, #220–#223); #206/#207
deliberately deferred per their own issue scoping; #211 (Windows/MSVC)
resolved as a scoping decision rather than an implementation — see
below. Minor-version-worthy in spirit (new user-facing flags/commands),
kept as a patch bump per policy. 47/47 test suites pass, self-check
clean (0 errors).

Added

  • A shared, comment/string-literal-aware line-stripping primitive
    (cfusa_lex_strip_line(), include/cfusa/lex.h/src/lex.c) replacing
    ad hoc per-rule comment/string state machines — space-blanks (never
    deletes) comment/string content so column positions are preserved and
    tokens never glue together across a stripped comment. (#203)
  • A single tree-walk / single file-read engine for line-scan rules
    (cfusa_engine_register_line_rule() / cfusa_engine_run_line_rules())
    — collapsed 54 independent cfusa_walk_sources() call sites (one per
    rule) into one walk-and-dispatch pass per cfusa check/lint/
    analyze/cyber run. (#204)
  • #if 0 preprocessor-lite awareness — code inside an
    unconditionally-disabled #if 0 block is no longer scanned by
    line-based rules, removing a class of false positives on intentionally
    dead/documentation code. (#205)
  • cfusa baseline and .fusa-baseline.json — snapshot a project's
    current findings to exclude them from the exit-code gate, so an
    existing codebase can adopt c-FuSa without gating on its full
    pre-existing backlog. Composes with .fusa-dispositions.json. (#208)
  • cfusa check --changed-since <git-ref> — scopes a report to only
    findings on lines actually changed since <ref> (via git diff --unified=0), for gating a pull request on newly-introduced findings
    rather than a project's full existing backlog. Independent of, and
    composable with, baseline/dispositions. (#209)
  • cfusa fix remediation-guidance coverage expanded from 19 to the
    full 39 lint/analyze/cyber rules    , plus a real --dry-run/--apply
    auto-rewrite for CFUSA-CY006 (free-without-NULL) — conservatively
    scoped to a bare free(<simple-lvalue>); call, and safe to re-run
    since it skips a pointer already NULL'd on the next line. (#210)
  • cfusa explain <RULE-ID> (and cfusa explain --list) — prints a
    rule's category, standard/clause citation, description, and remediation
    guidance in one place; rule-id lookup is case-insensitive and tolerates
    a missing CFUSA- prefix. (#212)
  • A first-party GitHub Action (action.yml, usable as uses: SoundMatt/c-FuSa@<tag>) — installs a pinned cfusa release binary,
    runs cfusa check, and uploads SARIF to the code-scanning tab, with
    dir/version/strict/changed-since/fail-on-error inputs.
    Dogfooded against this repo itself in CI
    (.github/workflows/action-smoke-test.yml). (#213)

Documented

  • Windows/MSVC support was audited and deliberately deferred, not
    implemented.     fork()/pipe()/execvp() subprocess spawning (4
    files), the opendir()/readdir()-based tree walk underlying every
    rule, and getopt_long (all 44 cmd_*.c files) have no direct Windows
    equivalent — this is a systemic, cross-cutting port, not a bounded
    feature. WSL2 already runs today's cfusa unmodified and is the
    recommended path; see issue #211 for the full audit and rationale.

Installation

# Linux (amd64)
curl -Lo cfusa https://github.com/SoundMatt/c-FuSa/releases/download/v0.6.2/cfusa-linux-amd64
chmod +x cfusa && sudo mv cfusa /usr/local/bin/

# macOS (arm64)
curl -Lo cfusa https://github.com/SoundMatt/c-FuSa/releases/download/v0.6.2/cfusa-darwin-arm64
chmod +x cfusa && sudo mv cfusa /usr/local/bin/

# From source
cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --install build

Verify

cfusa version
cfusa qualify

What's Changed

  • feat: shared lexer/classifier replacing per-rule comment/string state machines by @SoundMatt in #215
  • feat: single-pass walk-and-lex engine for line-scan rules by @SoundMatt in #216
  • feat: #if 0 preprocessor-lite awareness in the shared lexer by @SoundMatt in #217
  • feat: findings baseline / suppress-existing-debt mode by @SoundMatt in #218
  • feat: git-diff-scoped analysis (cfusa check --changed-since) by @SoundMatt in #220
  • feat: expand cfusa fix rule coverage + CY006 real autofix by @SoundMatt in #221
  • feat: cfusa explain command by @SoundMatt in #222
  • feat: first-party GitHub Action for cfusa check + SARIF upload by @SoundMatt in #223
  • chore: bump v0.6.1 -> v0.6.2 by @SoundMatt in #224

Full Changelog: v0.6.1...v0.6.2

Contributors

SoundMatt
Assets 6
Loading