# [PATCH 0/2] bump static-analysis ci image version 13 messages from 2026-07-26 to 2026-09-05. Participants: Jeff King, Junio C Hamano, Patrick Steinhardt, Elijah Newren, SZEDER Gábor. Thread: https://gitlist.dev/t/66066 ## Jeff King, 2026-07-26 08:32 Subject: [PATCH 0/2] bump static-analysis ci image version Message-ID: <20260726083254.GA3528497@coredump.intra.peff.net> ``` This is another way to fix the slow coccinelle run discussed in: https://lore.kernel.org/git/20260724091152.27794-2-tnyman@openai.com/ by using a newer version of coccinelle. We tweaked the code there to avoid the problem, so this isn't urgent. But it is worth doing to avoid running into the same problem again (and because in general I think it makes sense to run newer versions of our dev tools than older ones). The second patch is the interesting one. The first is a necessary clean-up (+cc Elijah as the relevant author there). [1/2]: bloom: silence CHECK_ASSERTION_SIDE_EFFECTS false positive [2/2]: ci: bump ubuntu image version for static-analysis job .github/workflows/main.yml | 4 ++-- .gitlab-ci.yml | 2 +- bloom.c | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) -Peff ``` ## Jeff King, 2026-07-26 08:37 Subject: [PATCH 1/2] bloom: silence CHECK_ASSERTION_SIDE_EFFECTS false positive Message-ID: <20260726083727.GA3529069@coredump.intra.peff.net> In-Reply-To: <20260726083254.GA3528497@coredump.intra.peff.net> ``` Using gcc 15, compiling with CHECK_ASSERTION_SIDE_EFFECTS=1 causes a complaint about this line in bloom.c having a side effect: assert(version == 1 || version == 2); I think this is pretty clearly a false positive, as those comparisons should not have side effects. The side-effect checker uses a magic definition of assert() that relies on the compiler's optimizer to drop a reference to an otherwise unused variable. And for whatever reason, gcc chooses not to do so here under -O2 (side note: if you have -O0 in your CFLAGS, that naturally creates many more false positives!). This code has been around for a while, but nobody seems to have noticed because we use an older version of the compiler in our static-analysis ci job, and it does not complain. Presumably very few people run this check locally on their more modern compilers. Let's silence the false positive to avoid confusion for anyone running locally, and to make it possible to upgrade the image we use for our static-analysis job. We could just switch to our custom ASSERT() here, but I think we can improve the code by integrating the assertion into the if/else cascade. That avoids repeating the logic about which versions are acceptable. Signed-off-by: Jeff King --- Building with clang or with "gcc -flto" seems to also silence the false positive. We might consider using those for the static-analysis job. But since in this instance we can both silence it and (IMHO) make the code nicer to read, I think it's reasonable to do so. We can leave tinkering with the assert() magic as a separate topic for anyone interested. bloom.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bloom.c b/bloom.c index c98d1672ad..caf22f9831 100644 --- a/bloom.c +++ b/bloom.c @@ -610,10 +610,10 @@ int bloom_filter_contains_vec(const struct bloom_filter *filter, uint32_t test_bloom_murmur3_seeded(uint32_t seed, const char *data, size_t len, int version) { - assert(version == 1 || version == 2); - if (version == 2) return murmur3_seeded_v2(seed, data, len); - else + else if (version == 1) return murmur3_seeded_v1(seed, data, len); + else + BUG("unexpected bloom version: %d", version); } -- 2.55.0.742.gf2bff09aa6 ``` ## Jeff King, 2026-07-26 08:39 Subject: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: <20260726083905.GB3529069@coredump.intra.peff.net> In-Reply-To: <20260726083254.GA3528497@coredump.intra.peff.net> ``` We recently ran into a case[1] where old versions of coccinelle ran very slowly, but newer ones are fine. The version we use in GitHub's CI was the old slow version, leading to timeouts of the static-analysis job. We get the old version because we ask for the ubuntu-22.04 image. That has coccinelle 1.1.1, but the "fast" improvement is in coccinelle 1.3.0, specifically their 58619b8fe (break up envs for e1 & e2, 2024-08-18). Bumping to ubuntu-25.10 would be enough to get that new version. But I don't see any need to ask for a specific version at all. We originally used a specific version because coccinelle wasn't available in ubuntu 20.04, so we pinned to 18.04 in d051ed77ee (.github/workflows/main.yml: run static-analysis on bionic, 2021-02-08). Later that got bumped in ef46584831 (ci: update 'static-analysis' to Ubuntu 22.04, 2022-08-23) when 18.04 support was dropped. It seems like the absence of coccinelle was a blip in 20.04, and we can just stick with "latest" going forward. I tested the result on GitHub's CI. I bumped the matching line in the GitLab definition, but didn't have a simple means of testing (but it's such a trivial change nothing could go wrong, right?). [1] https://lore.kernel.org/git/20260724091152.27794-2-tnyman@openai.com/ Signed-off-by: Jeff King --- .github/workflows/main.yml | 4 ++-- .gitlab-ci.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 85cfedf5b0..205325eb33 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -460,8 +460,8 @@ jobs: if: needs.ci-config.outputs.enabled == 'yes' env: jobname: StaticAnalysis - CI_JOB_IMAGE: ubuntu-22.04 - runs-on: ubuntu-22.04 + CI_JOB_IMAGE: ubuntu-latest + runs-on: ubuntu-latest concurrency: group: static-analysis-${{ github.ref }} cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 1c4d04da9d..0242283c3c 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -227,7 +227,7 @@ test:fuzz-smoke-tests: - ./ci/run-build-and-minimal-fuzzers.sh static-analysis: - image: ubuntu:22.04 + image: ubuntu:latest stage: analyze needs: [ ] variables: -- 2.55.0.742.gf2bff09aa6 ``` ## Junio C Hamano, 2026-07-26 16:34 Subject: Re: [PATCH 0/2] bump static-analysis ci image version Message-ID: In-Reply-To: <20260726083254.GA3528497@coredump.intra.peff.net> ``` Jeff King writes: > This is another way to fix the slow coccinelle run discussed in: > > https://lore.kernel.org/git/20260724091152.27794-2-tnyman@openai.com/ > > by using a newer version of coccinelle. > > We tweaked the code there to avoid the problem, so this isn't urgent. > But it is worth doing to avoid running into the same problem again (and > because in general I think it makes sense to run newer versions of our > dev tools than older ones). > > The second patch is the interesting one. The first is a necessary > clean-up (+cc Elijah as the relevant author there). Both are interesting. Thanks for doing this (with relevant archaeology as usual). ``` ## Patrick Steinhardt, 2026-08-07 10:24 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: In-Reply-To: <20260726083905.GB3529069@coredump.intra.peff.net> ``` On Sun, Jul 26, 2026 at 04:39:05AM -0400, Jeff King wrote: > We recently ran into a case[1] where old versions of coccinelle ran very > slowly, but newer ones are fine. The version we use in GitHub's CI was > the old slow version, leading to timeouts of the static-analysis job. > > We get the old version because we ask for the ubuntu-22.04 image. That > has coccinelle 1.1.1, but the "fast" improvement is in coccinelle 1.3.0, > specifically their 58619b8fe (break up envs for e1 & e2, 2024-08-18). I have been wondering about slow Coccinelle for a while now. Making things faster via a simple version upgrade is great, as it comes almost for free. But that being said, we also have a bunch of Coccinelle rules nowadays, and my gut feeling tells me that there's a bunch of them that aren't useful anymore. "refs", "object_id", "the_repository", "git_config_number", "index-compatibility" and "context_fn_ctx" all look like files that we could probably just get rid of because we have long done the migrations, and it's unlikely anybody still has patches that use the pre-migration variants. They'd of course require a bit of a deeper look, but that could be another way to speed up Coccinelle for us. Even though I cannot say for sure by how much, I didn't give it a test. Thanks! Patrick ``` ## Junio C Hamano, 2026-08-07 16:16 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: In-Reply-To: ``` Patrick Steinhardt writes: > They'd of course require a bit of a deeper look, but that could be > another way to speed up Coccinelle for us. Even though I cannot say for > sure by how much, I didn't give it a test. Another benefit is that it would reduce the programmer's burden, as it is not immediately apparent which rules are still relevant. I wonder if we can easily define the exit criteria when we introduce a new rule and document them, immediately next to the rules. You said "refs, object_id, the_repository, ... all look like we have long done with the migrations"; in retrospect, would it have been easily doable for those who introduced these rules to describe how we would declare "now migration is done"? If so, perhaps a good step forward may be to update tools/coccinelle/README to add such a rule. ... goes and looks ... The readme file clearly states that transformations needed for migrations are *not* regularly run. Is it possible that we have these rules you mentioned misclassified? ``` ## Elijah Newren, 2026-08-07 16:47 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: In-Reply-To: <20260726083905.GB3529069@coredump.intra.peff.net> ``` On Sun, Jul 26, 2026 at 1:39 AM Jeff King wrote: > > We recently ran into a case[1] where old versions of coccinelle ran very > slowly, but newer ones are fine. The version we use in GitHub's CI was > the old slow version, leading to timeouts of the static-analysis job. > > We get the old version because we ask for the ubuntu-22.04 image. That > has coccinelle 1.1.1, but the "fast" improvement is in coccinelle 1.3.0, > specifically their 58619b8fe (break up envs for e1 & e2, 2024-08-18). > > Bumping to ubuntu-25.10 would be enough to get that new version. But I > don't see any need to ask for a specific version at all. We originally > used a specific version because coccinelle wasn't available in ubuntu > 20.04, so we pinned to 18.04 in d051ed77ee (.github/workflows/main.yml: > run static-analysis on bionic, 2021-02-08). Later that got bumped in > ef46584831 (ci: update 'static-analysis' to Ubuntu 22.04, 2022-08-23) > when 18.04 support was dropped. > > It seems like the absence of coccinelle was a blip in 20.04, and we can > just stick with "latest" going forward. > > I tested the result on GitHub's CI. I bumped the matching line in the > GitLab definition, but didn't have a simple means of testing (but it's > such a trivial change nothing could go wrong, right?). > > [1] https://lore.kernel.org/git/20260724091152.27794-2-tnyman@openai.com/ > > Signed-off-by: Jeff King > --- > .github/workflows/main.yml | 4 ++-- > .gitlab-ci.yml | 2 +- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml > index 85cfedf5b0..205325eb33 100644 > --- a/.github/workflows/main.yml > +++ b/.github/workflows/main.yml > @@ -460,8 +460,8 @@ jobs: > if: needs.ci-config.outputs.enabled == 'yes' > env: > jobname: StaticAnalysis > - CI_JOB_IMAGE: ubuntu-22.04 > - runs-on: ubuntu-22.04 > + CI_JOB_IMAGE: ubuntu-latest > + runs-on: ubuntu-latest > concurrency: > group: static-analysis-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml > index 1c4d04da9d..0242283c3c 100644 > --- a/.gitlab-ci.yml > +++ b/.gitlab-ci.yml > @@ -227,7 +227,7 @@ test:fuzz-smoke-tests: > - ./ci/run-build-and-minimal-fuzzers.sh > > static-analysis: > - image: ubuntu:22.04 > + image: ubuntu:latest > stage: analyze > needs: [ ] > variables: > -- > 2.55.0.742.gf2bff09aa6 Makes sense to me; looks good. ``` ## SZEDER Gábor, 2026-08-08 17:31 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: In-Reply-To: <20260726083905.GB3529069@coredump.intra.peff.net> ``` On Sun, Jul 26, 2026 at 04:39:05AM -0400, Jeff King wrote: > We recently ran into a case[1] where old versions of coccinelle ran very > slowly, but newer ones are fine. The version we use in GitHub's CI was > the old slow version, leading to timeouts of the static-analysis job. > > We get the old version because we ask for the ubuntu-22.04 image. That > has coccinelle 1.1.1, but the "fast" improvement is in coccinelle 1.3.0, > specifically their 58619b8fe (break up envs for e1 & e2, 2024-08-18). I've built Docker images of various Coccinelle versions [1] years ago, and seeing this issue I've updated those images with more recent base image and Coccinelle versions. Using these to run 'make coccicheck' on 630cf86933, i.e. 'seen' on or around 2026-07-14, which contained a024a5818c (branch: add --delete-merged , 2026-07-14) with those problematic loop counter variables I got the following results: - 1.1.1: 1437.78user 56.66system 2:10.29elapsed 1146%CPU (0avgtext+0avgdata 223896maxresident)k - 1.2.0: ctrl-c after 2.5h. The bulk of the work was done in about 10 minutes, but processing 'builtin/branch.c' seemed to hang forever. - 1.3.1: 6532.81user 106.75system 9:35.04elapsed 1154%CPU (0avgtext+0avgdata 635592maxresident)k So my Coccinelle 1.1.1 didn't hang, moreover, it was about 4.5 times faster than 1.3.1. I got similar runtime differences between 1.1.1 and 1.3.1 when checking e.g. v2.55.0 or current master; in these cases 1.2.0 didn't hang, but took about the same time as 1.3.1. Am I doing something wrong? Or is everyone else is doing something wrong? :) [1] https://hub.docker.com/r/szeder/coccinelle/tags On a somewhat related note, for a while now we've been unnecessarily installing all the dependencies of the "build and test" jobs (compiler, build systems, apache, p4, jgit, etc.) for the various static analysis and the 'documentation' CI jobs as well. I think this is because 707d2f2fe8 (CI: use "$runs_on_pool", not "$jobname" to select packages & config, 2021-11-23) started installing all those dependencies for jobs using 'ubuntu-latest', including the 'documentation' job as well, though this side-effect was not mentioned in the commit message. The 'StaticAnalysis' and 'sparse' jobs were not affected at the time, because they were using a specific Ubuntu version, but then 0178420b9c (github-actions: run gcc-8 on ubuntu-20.04 image, 2022-11-25) came along and changed the pattern matching $runs_on_pool from 'ubuntu-latest' to 'ubuntu-*'. ``` ## Patrick Steinhardt, 2026-08-10 05:38 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: In-Reply-To: ``` On Fri, Aug 07, 2026 at 09:16:49AM -0700, Junio C Hamano wrote: > Patrick Steinhardt writes: > > > They'd of course require a bit of a deeper look, but that could be > > another way to speed up Coccinelle for us. Even though I cannot say for > > sure by how much, I didn't give it a test. > > Another benefit is that it would reduce the programmer's burden, as > it is not immediately apparent which rules are still relevant. > > I wonder if we can easily define the exit criteria when we introduce > a new rule and document them, immediately next to the rules. > > You said "refs, object_id, the_repository, ... all look like we have > long done with the migrations"; in retrospect, would it have been > easily doable for those who introduced these rules to describe how > we would declare "now migration is done"? If so, perhaps a good > step forward may be to update tools/coccinelle/README to add such a > rule. > > ... goes and looks ... > > The readme file clearly states that transformations needed for > migrations are *not* regularly run. Is it possible that we have > these rules you mentioned misclassified? For all I can see, both our Makefile and Meson simply take all Coccinelle files we have, concatenate and run those rules against our whole codebase. So I don't see any kind of classification at all? Ah, no, you're right. We have the ".pending" suffix that we do treat special. We only have a single one of those with "config_fn_ctx". Arguably, many of the others should've been classified as pending, too. But I think it's quite easy to miss that we even treat these kinds of files special. Taking a step back, I do have to wonder whether the Cocci files have been adding any kind of value in the first place. I myself introduced some of them in contexts where I made sweeping changes to our APIs, so that any in-flight topics can be trivially adjusted via Coccinelle. But I very much doubt that anyone ever used those to adapt their in-flight patch series at all. So maybe we should just not do that anymore? Patrick ``` ## Junio C Hamano, 2026-08-10 17:52 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: In-Reply-To: ``` Patrick Steinhardt writes: > Taking a step back, I do have to wonder whether the Cocci files have > been adding any kind of value in the first place. I myself introduced > some of them in contexts where I made sweeping changes to our APIs, so > that any in-flight topics can be trivially adjusted via Coccinelle. But > I very much doubt that anyone ever used those to adapt their in-flight > patch series at all. > > So maybe we should just not do that anymore? We still do catch when somebody writes "if (a == NULL)", no? ``` ## Patrick Steinhardt, 2026-08-11 05:02 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: In-Reply-To: ``` On Mon, Aug 10, 2026 at 10:52:21AM -0700, Junio C Hamano wrote: > Patrick Steinhardt writes: > > > Taking a step back, I do have to wonder whether the Cocci files have > > been adding any kind of value in the first place. I myself introduced > > some of them in contexts where I made sweeping changes to our APIs, so > > that any in-flight topics can be trivially adjusted via Coccinelle. But > > I very much doubt that anyone ever used those to adapt their in-flight > > patch series at all. > > > > So maybe we should just not do that anymore? > > We still do catch when somebody writes "if (a == NULL)", no? Yes! What I was trying to say is that we maybe shouldn't add Cocci files for temporary migrations anymore, but still keep (and extend) them for evertyhing where we want to consistently catch antipatterns going forward. Overall I have a feeling that I'm overthinking this though :) Maybe it ultimately doesn't matter too much and we just continue what we're doing and then clean up every once in a while when too much cruft has accumulated. Patrick ``` ## Jeff King, 2026-09-05 13:44 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: <20260905134424.GA3914039@coredump.intra.peff.net> In-Reply-To: ``` On Tue, Aug 11, 2026 at 07:02:42AM +0200, Patrick Steinhardt wrote: > On Mon, Aug 10, 2026 at 10:52:21AM -0700, Junio C Hamano wrote: > > Patrick Steinhardt writes: > > > > > Taking a step back, I do have to wonder whether the Cocci files have > > > been adding any kind of value in the first place. I myself introduced > > > some of them in contexts where I made sweeping changes to our APIs, so > > > that any in-flight topics can be trivially adjusted via Coccinelle. But > > > I very much doubt that anyone ever used those to adapt their in-flight > > > patch series at all. > > > > > > So maybe we should just not do that anymore? > > > > We still do catch when somebody writes "if (a == NULL)", no? > > Yes! What I was trying to say is that we maybe shouldn't add Cocci files > for temporary migrations anymore, but still keep (and extend) them for > evertyhing where we want to consistently catch antipatterns going > forward. > > Overall I have a feeling that I'm overthinking this though :) Maybe it > ultimately doesn't matter too much and we just continue what we're doing > and then clean up every once in a while when too much cruft has > accumulated. FWIW, I'd be happy to avoid coccinelle for transitions. The most important thing is for transitions to be brought to the developer's attention at all, so we don't quietly produce broken programs or continue adding callers of interfaces we're trying to get rid of. But bringing attention is often done trivially via the compiler (e.g., changing names or interfaces). Coccinelle can further suggest the actual fix, but most of the time that fix is either obvious, or easily explained in the commit message (and I feel like if any project can do so, we should be able to assume people can use pickaxe/blame to find the source of a change). So coccinelle can save some work in these cases, but I think it is a net loss overall compared to both the effort in writing the semantic patches, as well as the operational headaches. I do think there's still enough value in the enforcement of rules that can't easily be caught by the compiler. Style bits like "a == NULL" are an obvious example, but I think we have some "we offer functions X and Y, but you should usually use X unless you have a good reason". Though maybe even some of those can be simplified (stuff like oidclr() should be preferred over hashclr(), but maybe we are at a point where hashclr() can become a private function?). -Peff ``` ## Jeff King, 2026-09-05 13:52 Subject: Re: [PATCH 2/2] ci: bump ubuntu image version for static-analysis job Message-ID: <20260905135259.GB3914039@coredump.intra.peff.net> In-Reply-To: ``` On Sat, Aug 08, 2026 at 07:31:57PM +0200, SZEDER Gábor wrote: > Using these to run 'make coccicheck' on 630cf86933, i.e. 'seen' on or > around 2026-07-14, which contained a024a5818c (branch: add > --delete-merged , 2026-07-14) with those problematic loop > counter variables I got the following results: > > - 1.1.1: 1437.78user 56.66system 2:10.29elapsed 1146%CPU (0avgtext+0avgdata 223896maxresident)k > > - 1.2.0: ctrl-c after 2.5h. The bulk of the work was done in about > 10 minutes, but processing 'builtin/branch.c' seemed to > hang forever. > > - 1.3.1: 6532.81user 106.75system 9:35.04elapsed 1154%CPU (0avgtext+0avgdata 635592maxresident)k > > So my Coccinelle 1.1.1 didn't hang, moreover, it was about 4.5 times > faster than 1.3.1. I got similar runtime differences between 1.1.1 > and 1.3.1 when checking e.g. v2.55.0 or current master; in these cases > 1.2.0 didn't hang, but took about the same time as 1.3.1. > > Am I doing something wrong? Or is everyone else is doing something > wrong? :) I'd meant to circle back to this and get an answer, but ultimately...I don't have one. I was easily able to reproduce the forever-hang behavior building locally, and even bisected it. However IIRC I couldn't get 1.1.1 to build at all, so my bisect started a bit forward of that. So I'm a little curious why we get different results, but not enough to sink a bunch more time into building and timing coccinelle myself. Ultimately I think we'll end up on newer versions in the long run as old versions eventually become unavailable / uncompilable on newer platforms. So given mixed signals about timing, I think I'd still prefer moving forward in time as a general tie-breaker. > On a somewhat related note, for a while now we've been unnecessarily > installing all the dependencies of the "build and test" jobs > (compiler, build systems, apache, p4, jgit, etc.) for the various > static analysis and the 'documentation' CI jobs as well. > > I think this is because 707d2f2fe8 (CI: use "$runs_on_pool", not > "$jobname" to select packages & config, 2021-11-23) started installing > all those dependencies for jobs using 'ubuntu-latest', including the > 'documentation' job as well, though this side-effect was not mentioned > in the commit message. The 'StaticAnalysis' and 'sparse' jobs were > not affected at the time, because they were using a specific Ubuntu > version, but then 0178420b9c (github-actions: run gcc-8 on > ubuntu-20.04 image, 2022-11-25) came along and changed the pattern > matching $runs_on_pool from 'ubuntu-latest' to 'ubuntu-*'. It has always felt a little nuts to me that all of these CI jobs start with a vanilla base image and then "apt install" a bunch of packages. Surely there is some mechanism for caching that intermediate state as an image, at which point it is "free" to use it as the base for all of the jobs, whether they need all of it or not (modulo some extra bytes in the image, but to me that is way cheaper than the run-time cost of downloading and installing packages). I know Docker has some support for automatically caching intermediate image states, but I don't think any of that applies here. From its perspective, the all of our ci scripts are running and mutating the container. -Peff ```