static_analysis.yml

# Workflow to run static-analysis and linting checks on source
name: Static analysis

# Controls when the workflow will run
on:
  # Triggers the workflow on pushes to the "main" branch, i.e., PR merges
  push:
    branches: [ "main" ]

  # Triggers the workflow on pushes to open pull requests with code changes
  pull_request:
    paths:
      - '.github/workflows/*.yml'
      - '**.c'
      - '**.cpp'
      - '**.fypp'
      - '**.f90'
      - '**.F90'
      - '**.pf'
      - '**.py'
      - '**.sh'
      - '**CMakeLists.txt'
      - 'pyproject.toml'

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# Cancel jobs running if new commits are pushed
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

# Write permissions are not required
permissions: {}

# Workflow run - one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "linting"
  linting:
    name: linting

    # The type of runner that the job will run on
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false

    # Terminate the job if it runs for more than 5 minutes
    timeout-minutes: 5

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - name: Checkout FTorch repository
        with:
          persist-credentials: true
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup Python
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
        with:
          python-version: '3.13'  # Use 3.13 as no PyTorch wheels for 3.14 yet.

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          python -m venv ../ftorch_venv
          . ../ftorch_venv/bin/activate
          pip install torch torchvision --index-url https://download.pytorch.org/whl/cpu
          pip install -e .[dev]

      # Run CMake build to get compile commands for clang
      - name: FTorch CMake
        run: |
          . ../ftorch_venv/bin/activate
          export FT_DIR=$(pwd)
          VN=$(python -c "import sys; print('.'.join(sys.version.split('.')[:2]))")
          export Torch_DIR=${VIRTUAL_ENV}/lib/python${VN}/site-packages
          export BUILD_DIR=$(pwd)/build
          mkdir ${BUILD_DIR}
          cd ${BUILD_DIR}
          cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${BUILD_DIR} -DCMAKE_Fortran_FLAGS="-std=f2008" -DCMAKE_EXPORT_COMPILE_COMMANDS=ON

      # Apply CMake linter, cmake-lint
      - name: cmake-lint
        if: always()
        run: |
          cd ${{ github.workspace }}
          . ../ftorch_venv/bin/activate
          cmake-lint $(find . -name CMakeLists.txt)

      # Apply Shell linter, shellcheck
      - name: shellcheck
        if: always()
        run: |
          cd ${{ github.workspace }}
          sudo apt install shellcheck
          for FILE in $(find . -name "*.sh"); do
            shellcheck --external-sources ${FILE}
          done

      # Apply Fortran linter, fortitude
      # Configurable using the fortitude.toml file if present
      - name: fortitude source
        if: always()
        run: |
          cd ${{ github.workspace }}
          . ../ftorch_venv/bin/activate
          fortitude check src/ftorch.f90
          fortitude check src/ftorch_devices.F90
          fortitude check src/ftorch_types.f90
          fortitude check src/ftorch_tensor.f90
          fortitude check src/ftorch_model.f90
          fortitude check src/ftorch_test_utils.f90

      # Apply C++ and C linter and formatter, clang
      # Configurable using the .clang-format and .clang-tidy config files if present
      - name: clang source
        if: always()
        uses: cpp-linter/cpp-linter-action@b7fbdde0f6776f478f4d8867c2b746077fa7ea89 # v2
        id: linter
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          style: 'file'
          tidy-checks: ''
          # Use the compile_commands.json from CMake to locate headers
          database: ${{ github.workspace }}/build
          # only 'update' a single comment in a pull request thread.
          thread-comments: ${{ github.event_name == 'pull_request' && 'update' }}
      - name: Fail fast?!
        if: steps.linter.outputs.checks-failed > 0
        run: exit 1

      # Apply Fortran linter, fortitude to examples
      - name: fortitude examples
        if: always()
        run: |
          cd ${{ github.workspace }}
          . ../ftorch_venv/bin/activate
          fortitude check examples

      # Apply Python linter, ruff
      - name: ruff
        if: always()
        run: |
          cd ${{ github.workspace }}
          . ../ftorch_venv/bin/activate
          ruff format --diff ./
          ruff check --diff ./

  # Apply GitHub Actions linter, zizmor
  zizmor:
    name: zizmor
    runs-on: ubuntu-latest

    # Terminate the job if it runs for more than 5 minutes
    timeout-minutes: 5

    permissions:
      security-events: write  # We trust the zizmor action with write permissions
    steps:
      - name: Checkout FTorch repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0