Add Cppcheck job to the CI

This MR changes the default Debian sid build to wrap make with bear
that creates compilation database and use the compilation database
to run Cppcheck on the source files systematically.

The job is currently set to be allowed to fail as it will take some
time to fix all the Cppcheck detected issues.

.gitignore

@@ -56,3 +56,6 @@ kyua.log
 named.memstats
 named.run
 timestamp
+/compile_commands.json
+/cppcheck_html/
+/cppcheck.results

.gitlab-ci.yml

@@ -15,6 +15,8 @@ variables:
   BUILD_PARALLEL_JOBS: 6
   TEST_PARALLEL_JOBS: 6
 
+  MAKE: make
+
 stages:
   - precheck
   - build
@@ -22,6 +24,7 @@ stages:
   - system
   - docs
   - push
+  - postcheck
 
 ### Runner Tag Templates
 
@@ -156,7 +159,7 @@ stages:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
   script:
     - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
     - test -z "${RUN_MAKE_INSTALL}" || make install
   dependencies:
     - autoreconf:sid:amd64
@@ -215,6 +218,40 @@ stages:
     expire_in: "1 week"
     when: on_failure
 
+.cppcheck_args: &run_cppcheck |
+  cppcheck --enable=warning,performance,portability,information,missingInclude \
+           --include=config.h \
+           --quiet \
+           --std=c11 \
+           --language=c \
+           --project=compile_commands.json \
+           --error-exitcode=2 \
+           -j ${TEST_PARALLEL_JOBS:-1} \
+           --xml \
+           --output-file=cppcheck.results \
+           --inline-suppr
+
+.cppcheck_report: &cppcheck_report_html |
+  cppcheck-htmlreport --title="BIND 9 ($CI_COMMIT_SHORT_SHA) Cppcheck Report" \
+                      --file=cppcheck.results \
+                      --report-dir=cppcheck_html/
+
+.cppcheck: &cppcheck_job
+  <<: *default_triggering_rules
+  stage: postcheck
+  script:
+    - *run_cppcheck
+  after_script:
+    - *cppcheck_report_html
+  artifacts:
+    paths:
+      - compile_commands.json
+      - cppcheck.results
+      - cppcheck_html/
+    expire_in: "1 week"
+    when: on_failure
+  allow_failure: true
+
 ### Job Definitions
 
 # Jobs in the precheck stage
@@ -436,6 +473,7 @@ gcc:sid:amd64:
     CFLAGS: "-Wall -Wextra -O3 -g"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
     RUN_MAKE_INSTALL: 1
+    MAKE: bear make
   <<: *debian_sid_amd64_image
   <<: *build_job
 
@@ -453,6 +491,13 @@ unit:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
+cppcheck:gcc:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *cppcheck_job
+  dependencies:
+    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
+
 # Jobs for regular GCC builds on Debian Sid (i386)
 
 gcc:sid:i386: