CodeQL: Outdated version of cppcheck?

[mcandre]

Select Topic Area

Bug

Body

I recently added the --check-level=exhaustive flag to cppcheck in my project's linting configuration, in order to catch more code flaws. This works fine locally.

However, CodeQL tries to do the same thing then fails, with cppcheck: error: unrecognized command line option: "--check-level=exhaustive".

https://github.com/mcandre/rez/actions/runs/10262901239/job/28393546685

Perhaps the solution is as simple as updating the version of cppcheck that CodeQL targets, to support more modern linter/SAST options.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[jketema]

Hi @mcandre,

The cppcheck version that gets used will be the latest version available on Ubuntu 22.04. Did you check whether that version supports --check-level=exhaustive?

[mcandre]

Possible to update the version of Ubuntu that CodeQL uses, from 22.04 to a more recent edition, such as the current LTS release 24.04(.1)?

[jketema]

The CodeQL jobs should be running on ubuntu-latest runners, which is now 24.04. For existing repositories the ububtu-latest label should be migrated to 24.04, but it seems that hasn't happened yet for your repository. See here for some more context. The migration apparently wasn't completed on October 30th.

[mcandre]

I appreciate the level of detail.

Indeed, cppcheck 2.11 adds the --check-level flag:

https://sourceforge.net/p/cppcheck/news/2023/06/cppcheck-211/

Ubuntu 22.04's cppcheck is older, at cppcheck 2.7:

https://packages.ubuntu.com/jammy/cppcheck

Ubuntu 24.04 may suffice, at cppcheck 2.13:

https://packages.ubuntu.com/noble/cppcheck