diff --git a/.fusa.json b/.fusa.json index 77b005e..c553dc4 100644 --- a/.fusa.json +++ b/.fusa.json @@ -1,6 +1,6 @@ { "configVersion": "1.0", - "project": {"name": "c-FuSa", "version": "0.6.1"}, + "project": {"name": "c-FuSa", "version": "0.6.2"}, "standard": "iso26262", "strict": false, "max_function_lines": 75, diff --git a/CHANGELOG.md b/CHANGELOG.md index 86f0815..bb78283 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,65 @@ All notable changes to c-FuSa are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## v0.6.2 — 2026-08-18 + +Architecture-plan loop: eleven tracked improvement issues (#203–#213), +eight shipped across eight PRs (#215–#218, #220–#223); #206/#207 +deliberately deferred per their own issue scoping; #211 (Windows/MSVC) +resolved as a scoping decision rather than an implementation — see +below. Minor-version-worthy in spirit (new user-facing flags/commands), +kept as a patch bump per policy. 47/47 test suites pass, self-check +clean (0 errors). + +### Added +- **A shared, comment/string-literal-aware line-stripping primitive** + (`cfusa_lex_strip_line()`, `include/cfusa/lex.h`/`src/lex.c`) replacing + ad hoc per-rule comment/string state machines — space-blanks (never + deletes) comment/string content so column positions are preserved and + tokens never glue together across a stripped comment. (#203) +- **A single tree-walk / single file-read engine for line-scan rules** + (`cfusa_engine_register_line_rule()` / `cfusa_engine_run_line_rules()`) + — collapsed 54 independent `cfusa_walk_sources()` call sites (one per + rule) into one walk-and-dispatch pass per `cfusa check`/`lint`/ + `analyze`/`cyber` run. (#204) +- **`#if 0` preprocessor-lite awareness** — code inside an + unconditionally-disabled `#if 0` block is no longer scanned by + line-based rules, removing a class of false positives on intentionally + dead/documentation code. (#205) +- **`cfusa baseline`** and `.fusa-baseline.json` — snapshot a project's + current findings to exclude them from the exit-code gate, so an + existing codebase can adopt c-FuSa without gating on its full + pre-existing backlog. Composes with `.fusa-dispositions.json`. (#208) +- **`cfusa check --changed-since `** — scopes a report to only + findings on lines actually changed since `` (via `git diff + --unified=0`), for gating a pull request on newly-introduced findings + rather than a project's full existing backlog. Independent of, and + composable with, baseline/dispositions. (#209) +- **`cfusa fix` remediation-guidance coverage expanded from 19 to the + full 39 lint/analyze/cyber rules**, plus a real `--dry-run`/`--apply` + auto-rewrite for `CFUSA-CY006` (free-without-NULL) — conservatively + scoped to a bare `free();` call, and safe to re-run + since it skips a pointer already NULL'd on the next line. (#210) +- **`cfusa explain `** (and `cfusa explain --list`) — prints a + rule's category, standard/clause citation, description, and remediation + guidance in one place; rule-id lookup is case-insensitive and tolerates + a missing `CFUSA-` prefix. (#212) +- **A first-party GitHub Action** (`action.yml`, usable as `uses: + SoundMatt/c-FuSa@`) — installs a pinned `cfusa` release binary, + runs `cfusa check`, and uploads SARIF to the code-scanning tab, with + `dir`/`version`/`strict`/`changed-since`/`fail-on-error` inputs. + Dogfooded against this repo itself in CI + (`.github/workflows/action-smoke-test.yml`). (#213) + +### Documented +- **Windows/MSVC support was audited and deliberately deferred, not + implemented.** `fork()`/`pipe()`/`execvp()` subprocess spawning (4 + files), the `opendir()`/`readdir()`-based tree walk underlying every + rule, and `getopt_long` (all 44 `cmd_*.c` files) have no direct Windows + equivalent — this is a systemic, cross-cutting port, not a bounded + feature. WSL2 already runs today's `cfusa` unmodified and is the + recommended path; see issue #211 for the full audit and rationale. + ## v0.6.1 — 2026-08-18 Forty-three fixes from a 40-agent deep-audit sweep of the codebase diff --git a/README.md b/README.md index 2a941f7..67aeae6 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ [![CI](https://github.com/SoundMatt/c-FuSa/actions/workflows/ci.yml/badge.svg)](https://github.com/SoundMatt/c-FuSa/actions/workflows/ci.yml) [![CodeQL](https://github.com/SoundMatt/c-FuSa/actions/workflows/codeql.yml/badge.svg)](https://github.com/SoundMatt/c-FuSa/actions/workflows/codeql.yml) [![License: MPL-2.0](https://img.shields.io/badge/License-MPL_2.0-brightgreen.svg)](LICENSE) -[![Version](https://img.shields.io/badge/version-0.6.1-blue.svg)](CHANGELOG.md) +[![Version](https://img.shields.io/badge/version-0.6.2-blue.svg)](CHANGELOG.md) > **c-FuSa is not a certification product.** It is an engineering accelerator — helping you produce and maintain safety evidence faster. diff --git a/include/cfusa/version.h b/include/cfusa/version.h index 347db92..be3a6fc 100644 --- a/include/cfusa/version.h +++ b/include/cfusa/version.h @@ -3,9 +3,36 @@ #define CFUSA_VERSION_MAJOR 0 #define CFUSA_VERSION_MINOR 6 -#define CFUSA_VERSION_PATCH 1 -#define CFUSA_VERSION_STRING "0.6.1" -/* v0.6.1 — 2026-08-18 forty-three fixes from a 40-agent deep-audit +#define CFUSA_VERSION_PATCH 2 +#define CFUSA_VERSION_STRING "0.6.2" +/* v0.6.2 — 2026-08-18 architecture-plan loop: eleven tracked improvement + * issues (#203-#213), eight shipped across eight PRs (#215-#218, + * #220-#223); #206/#207 (per-file result cache; compile_commands.json/ + * libclang integration) deliberately deferred per their own issue + * scoping; #211 (Windows/MSVC) resolved as a scoping decision rather + * than an implementation. Includes new user-facing flags/behaviors, not + * just fixes. Highlights: a shared + * comment/string-aware lexer (cfusa_lex_strip_line()) replacing ad hoc + * per-rule state machines (#203); a single tree-walk/single file-read + * engine for line-scan rules, collapsing 54 independent + * cfusa_walk_sources() call sites into one dispatch pass (#204); #if 0 + * preprocessor-lite awareness so unconditionally-disabled code is no + * longer scanned (#205); `cfusa baseline` / .fusa-baseline.json for + * suppress-existing-debt adoption on a legacy codebase (#208); `cfusa + * check --changed-since ` to scope a report to only lines changed + * since a git ref (#209); `cfusa fix` remediation-guidance coverage + * expanded from 19 to the full 39 lint/analyze/cyber rules, plus a real + * `--dry-run`/`--apply` autofix for CFUSA-CY006 (free-without-NULL) + * (#210); Windows/MSVC support audited and deliberately deferred — + * WSL2 is the supported path today, see issue #211 for the full + * rationale; `cfusa explain ` for a rule's full + * description/standard citation/fix guidance in one place (#212); a + * first-party GitHub Action (action.yml, `uses: SoundMatt/c-FuSa@ + * `) installing a pinned release binary, running `cfusa check`, + * and uploading SARIF (#213). 47/47 test suites pass, self-check clean. + * See CHANGELOG.md for the itemised, issue-linked list. + * + * v0.6.1 — 2026-08-18 forty-three fixes from a 40-agent deep-audit * sweep of the codebase (#141-#182) plus one more found and fixed the * same session (#187). Patch bump — precision/correctness fixes only, * no new user-facing flags or behaviors. Highlights: disposition JSON