.github/workflows: Introduce static-analysis workflow

[michpappas]

Description of Changes

Add a workflow that runs static analysis with CodeChecker. The workflow can be executed standalone, although it's main purpose to act as a CI gate for new findings on PRs. This very first implementation is limited to app-elfloader on qemu/x86_64 built with Clang.

Identifier checks (clang-diagnostic-reserved-identifier / clang-diagnostic-reserved-macro-identifier) are disabled by the newly introduced .codechecker.yml, as unikraft uses the underscore prefix to indicate private scope.

Internally, once static analysis is complete the results are checked against those stored in the CodeChecker remote database for the same configuration. If new findings are introduced the job is failed and the results are shown in its logs as shown below:

Upon merge, the results are stored in the remote database resulting into an updated state.

Related Work

#1751, #1809

PR Checklist

• Read the contribution guidelines regarding submitting new changes to the project;
• Tested your changes against relevant architectures and platforms;
• Ran the checkpatch.uk on your commit series before opening this PR;
• Updated relevant documentation.

[michpappas]

Current static analysis failure due to database server domain not registered. Please do not merge until resolved.

[andreittr]

Looks good, I've only some clarifying questions.
(AB & merging blocked pending database server)

Reviewed-by: Andrei Tatar ttr@unikraft.io

[michpappas]

Updated static-analysis.yaml to trigger on workflow_run after integration is complete, as on the pull_request trigger GH for PRs originating from remote forks (the norm in Unikraft) blocks access to secrets for security reasons.

Also added a status line in the PR using the GH API, as normally workflow_run triggers don't show on the PR's checks.

Finally, the workflow now runs static analysis on staging and stores the results into the database periodically overnight, and also if triggered manually.

Notice that:

1. The custom check only appears once static analysis starts.
2. The static analysis check does not appear in this PR because it does not exist on staging.

@andreittr if this goes well we can later generalize and rename the static analysis workflow to build and analyze an arbitrary application, arch, plat matrix and add helloworld and possibly others.

[michpappas]

Changes in last update: Display different message on fail and cancel.

[andreittr]

Reviewed-by: Andrei Tatar ttr@unikraft.io

[andreittr]

Approved-by: Andrei Tatar ttr@unikraft.io