ci(cppcheck-all, cppcheck-differential): add cppcheck

[kminoda]

Description

Add cppcheck for GitHub Actions

• cppcheck-differential: A workflow that is applied only to the pull request, mainly to check if the modified files are cppcheck-error-free. This only checks limited items in cppcheck to make it pass in the current codebase, aiming at setting this CI mandatory ASAP.
• cppcheck-all: A workflow that is intended to run on all files under Autoware Universe, mainly to monitor the remaining cppcheck errors. This may also be run manually as well.

Future improvements would include

• Address the errors pointed out in cppcheck-all to achieve cppcheck-error-free Autoware Universe
• Apply cppcheck not only to Autoware Universe but also to other implementations (e.g. autoware_common)
• Summarize the results of cppcheck-all to motivate each engineers to address the warnings

Related links

• TIER IV INTERNAL JIRA LINK

Tests performed

See the results of GitHub Actions

Notes for reviewers

We would eventually like to apply most of the important cppcheck items, but for now I created a huge .cppcheck_suppression file to suppress all the errors.

Interface changes

None

ROS Topic Changes

None

ROS Parameter Changes

None

Effects on system behavior

None

Pre-review checklist for the PR author

The PR author must check the checkboxes below when creating the PR.

• I've confirmed the contribution guidelines.
• The PR follows the pull request guidelines.

In-review checklist for the PR reviewers

The PR reviewers must check the checkboxes below before approval.

• The PR follows the pull request guidelines.
• The PR has been properly tested.
• The PR has been reviewed by the code owners.

Post-review checklist for the PR author

The PR author must check the checkboxes below before merging.

• There are no open discussions or they are tracked via tickets.
• The PR is ready for merge.

After all checkboxes are checked, anyone who has write access can merge the PR.

[kminoda]

@veqcc @TakaHoribe Hi, would you review this PR?

[veqcc]

@kminoda
Thank you for your quick actions!!

My first question is, are all the features listed in .cppcheck_suppressions expected to pass immediately? Or, will be mandatory in the near future, like in several months?

If you are willing to make it mandatory as soon as possible, I think we should choose the features more carefully.
In other words, what happens if someone makes a change on a file which already has cppcheck warnings.

[kminoda]

@veqcc Hi, thank you for the comment!

.cppcheck_suppressions is the list of items to "ignore" rather than to "include". So no, those features are not expected to pass immediately.

The idea behind this is to suppress all (and only) the errors in the latest Autoware Universe so that we can make the CI mandatory as soon as this PR is merged. The list contains all the warning items in the latest Autoware Universe, so at least we can avoid an unexpected additional warning from cppcheck.

(BTW the only risk I can see is the case when cppcheck raises false-positive errors. However, we can address this risk by either adding it in .cppcheck_suppressions or introduce inline suppression as in here, so don't recognize this as a blocking factor)

[kminoda]

@mitsudome-r Hi, I would like to make this cppcheck-differential required after this PR is merged if you don't see any concerns. Let me know if you have any comments. Thanks!

[veqcc]

@kminoda

.cppcheck_suppressions is the list of items to "ignore" rather than to "include". So no, those features are not expected to pass immediately.

I was misunderstanding in an opposite way, thanks!

(BTW the only risk I can see is the case when cppcheck raises false-positive errors.

Static analysis tools are always incomplete.
Most documents say that several tools are recommended to be used at the same time.

I will approve it later.
My final concern is, is there any future plan which features listed in the suppression file are to be mandatory some time or suppressed forever?

[kminoda]

@veqcc Yes, this PR is merely an initial step. The next action would be to reduce the suppression items one by one. FYI you can check the current error statistics in cppcheck-all CI result e.g. here. This wpuld be helpful to discuss which items we should address as a next step.

[TakaHoribe]

The idea behind this is to suppress all (and only) the errors in the latest Autoware Universe so that we can make the CI mandatory as soon as this PR is merged.

This sounds reasonable to me. I approve this, but please check one question below.