Clean permissions of workflows and enable coverage reporting for PRs

.bazelrc

@@ -17,30 +17,31 @@ common --@score_logging//score/mw/log/flags:KRemote_Logging=False
 common --@score_baselibs//score/json:base_library=nlohmann
 common --@score_baselibs//score/memory/shared/flags:use_typedshmd=False
 common --//score/mw/com/flags:tracing_library=@score_baselibs//score/analysis/tracing/generic_trace_library/stub_implementation
-common --extra_toolchains=@gcc_toolchain//:host_gcc_12
+common --extra_toolchains=@gcc_toolchain_x86_64//:cc_toolchain
 common --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_unknown_linux_gnu
 build --incompatible_strict_action_env
 test --test_output=errors
 build --experimental_retain_test_configuration_across_testonly #https://github.com/bazelbuild/bazel/issues/6842
 
+common:linux_x86_64_score_gcc_12_2_0_posix --platforms=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
+common:linux_x86_64_score_gcc_12_2_0_posix --extra_toolchains=@score_gcc_x86_64_toolchain//:x86_64-linux
+
 # In order to build for QNX, you need:
 # * An account on qnx.com
 # * An assigned QNX 8 license to your account
 #   * If you are applicable for "Free for non commercial use" see here: https://www.qnx.com/products/everywhere/
 # * The credentials for this account stored in your ~/.netrc (machine qnx.com)
 # * A license stored under `/opt/score_qnx/license/licenses`
-common:qnx_x86_64 --host_platform=@score_bazel_platforms//:x86_64-linux
-common:qnx_x86_64 --platforms=@score_bazel_platforms//:x86_64-qnx8_0
+common:qnx_x86_64 --platforms=@score_bazel_platforms//:x86_64-qnx-sdp_8.0.0-posix
 common:qnx_x86_64 --extra_toolchains=@toolchains_qnx_ifs//:ifs_x86_64
-common:qnx_x86_64 --extra_toolchains=@toolchains_qnx_qcc//:qcc_x86_64
+common:qnx_x86_64 --extra_toolchains=@score_qcc_x86_64_toolchain//:x86_64-qnx-sdp_8.0.0
 common:qnx_x86_64 --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_pc_nto_qnx800
 common:qnx_x86_64 --credential_helper=*.qnx.com=%workspace%/third_party/qnx_credential_helper.py
 common:qnx_x86_64 --sandbox_writable_path=/var/tmp
 
-common:qnx_arm64 --host_platform=@score_bazel_platforms//:x86_64-linux
-common:qnx_arm64 --platforms=@score_bazel_platforms//:arm64-qnx8_0
+common:qnx_arm64 --platforms=@score_bazel_platforms//:aarch64-qnx-sdp_8.0.0-posix
 common:qnx_arm64 --extra_toolchains=@toolchains_qnx_ifs//:ifs_aarch64
-common:qnx_arm64 --extra_toolchains=@toolchains_qnx_qcc//:qcc_aarch64
+common:qnx_arm64 --extra_toolchains=@score_qcc_aarch64_toolchain//:aarch64-qnx-sdp_8.0.0
 common:qnx_arm64 --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_aarch64_unknown_nto_qnx800
 common:qnx_arm64 --credential_helper=*.qnx.com=%workspace%/third_party/qnx_credential_helper.py
 common:qnx_arm64 --sandbox_writable_path=/var/tmp
@@ -62,6 +63,7 @@ coverage --experimental_use_llvm_covmap
 coverage --combined_report=lcov
 coverage --coverage_report_generator=@bazel_tools//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:Main
 coverage --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
+coverage --extra_toolchains=@ferrocene_x86_64_unknown_linux_gnu_llvm//:rust_ferrocene_toolchain
 coverage --test_env=COVERAGE_GCOV_OPTIONS=-bcu
 # TODO set toolchain feature once possible
 # These compile time options are required to cover abnormal termination cases. In GCC one can use `__gcc_dump()`, but this does not work with LLVM
@@ -76,6 +78,7 @@ test:clang-tidy --aspects=//:tools/lint/linters.bzl%clang_tidy_aspect
 test:clang-tidy --output_groups=+rules_lint_report
 # Use LLVM toolchain for clang-tidy so it can find system headers
 test:clang-tidy --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
+test:clang-tidy --extra_toolchains=@ferrocene_x86_64_unknown_linux_gnu_llvm//:rust_ferrocene_toolchain
 
 import quality/sanitizer/sanitizer.bazelrc
 

.github/workflows/address_undefined_behavior_leak_sanitizer.yml

@@ -25,6 +25,8 @@ on:
 jobs:
     build_and_test_asan_ubsan_lsan:
       runs-on: ubuntu-24.04
+      permissions:
+        contents: read
       steps:
         - name: Checkout repository
           uses: actions/checkout@v4.2.2

.github/workflows/automated_release.yml

@@ -45,6 +45,12 @@ jobs:
           echo "Release version tag: $RELEASE_VERSION"
           echo "release-tag=$RELEASE_VERSION" >> $GITHUB_OUTPUT
 
+      - name: Delete trigger tag
+        run: |
+          gh api repos/${{ github.repository }}/git/refs/tags/${{ github.ref_name }} -X DELETE
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create draft release
         id: create-release
         uses: softprops/action-gh-release@v2
@@ -65,7 +71,6 @@ jobs:
     uses: ./.github/workflows/build_and_test_qnx.yml
     permissions:
       contents: read
-      pull-requests: read
     secrets:
       SCORE_QNX_LICENSE: ${{ secrets.SCORE_QNX_LICENSE }}
       SCORE_QNX_USER: ${{ secrets.SCORE_QNX_USER }}
@@ -81,11 +86,27 @@ jobs:
 
   run-coverage-report:
     needs: create-draft-release
-    uses: ./.github/workflows/release_coverage_report.yml
-    with:
-      release_tag: ${{ needs.create-draft-release.outputs.release-tag }}
+    uses: ./.github/workflows/coverage_report.yml
+
+  upload-coverage-report:
+    needs:
+      - create-draft-release
+      - run-coverage-report
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
+    steps:
+      - name: Download coverage report artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.run-coverage-report.outputs.artifact-name }}
+          path: ./
+
+      - name: Upload coverage report to existing draft release
+        run: |
+          gh release upload "${{ needs.create-draft-release.outputs.release-tag }}" "${{ needs.run-coverage-report.outputs.artifact-name }}.zip"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   finalize-release:
     runs-on: ubuntu-24.04
@@ -96,46 +117,30 @@ jobs:
       - run-thread-sanitizer
       - run-address-sanitizer
       - run-coverage-report
-    if: always()
+      - upload-coverage-report
+    if: ${{ success() }}
     permissions:
       contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4.2.2
 
-      - name: Check workflow results
-        id: check-results
+      - name: Report success
+        if: steps.check-results.outputs.all-success == 'true'
         run: |
-          RESULT_HOST="${{ needs.run-build-and-test-host.result }}"
-          RESULT_QNX="${{ needs.run-build-and-test-qnx.result }}"
-          RESULT_TSAN="${{ needs.run-thread-sanitizer.result }}"
-          RESULT_ASAN="${{ needs.run-address-sanitizer.result }}"
-          RESULT_COVERAGE="${{ needs.run-coverage-report.result }}"
-
-          echo "Build and test host: $RESULT_HOST"
-          echo "Build and test QNX: $RESULT_QNX"
-          echo "Thread sanitizer: $RESULT_TSAN"
-          echo "Address sanitizer: $RESULT_ASAN"
-          echo "Coverage report: $RESULT_COVERAGE"
-
-          if [[ "$RESULT_HOST" == "success" ]] && \
-             [[ "$RESULT_QNX" == "success" ]] && \
-             [[ "$RESULT_TSAN" == "success" ]] && \
-             [[ "$RESULT_ASAN" == "success" ]] && \
-             [[ "$RESULT_COVERAGE" == "success" ]]; then
-            echo "all-success=true" >> $GITHUB_OUTPUT
-          else
-            echo "all-success=false" >> $GITHUB_OUTPUT
-          fi
+          echo "All workflows succeeded. Draft release ${{ needs.create-draft-release.outputs.release-tag }} is ready for manual publishing."
 
-      - name: Delete trigger tag
-        run: |
-          gh api repos/${{ github.repository }}/git/refs/tags/${{ github.ref_name }} -X DELETE
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  delete-release-on-failure:
+    runs-on: ubuntu-24.04
+    needs: create-draft-release
+    if: ${{ failure() || cancelled() }}
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4.2.2
 
-      - name: Delete draft release (on failure)
-        if: steps.check-results.outputs.all-success == 'false'
+      - name: Delete draft release due to failure
         run: |
           gh release delete ${{ needs.create-draft-release.outputs.release-tag }} --yes
         env:
@@ -144,10 +149,5 @@ jobs:
       - name: Report failure
         if: steps.check-results.outputs.all-success == 'false'
         run: |
-          echo "❌ One or more workflows failed. Draft release has been deleted."
-          exit 1
-
-      - name: Report success
-        if: steps.check-results.outputs.all-success == 'true'
-        run: |
-          echo "✅ All workflows succeeded. Draft release ${{ needs.create-draft-release.outputs.release-tag }} is ready for manual publishing."
+          echo "One or more workflows failed. Draft release has been deleted."
+          exit 1

.github/workflows/build_and_test_host.yml

@@ -22,12 +22,17 @@ on:
     types: [checks_requested]
   workflow_call:
 jobs:
-    build_and_test_host:
+    build_and_test:
       strategy:
         fail-fast: false
         matrix:
-          toolchain: ["@llvm_toolchain//:cc-toolchain-x86_64-linux", "@gcc_toolchain//:host_gcc_12"]
+          param:
+            - "" # The default configuration
+            - "--extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux"
+            - "--config=linux_x86_64_score_gcc_12_2_0_posix"
       runs-on: ubuntu-24.04
+      permissions:
+        contents: read
       steps:
         - name: Checkout repository
           uses: actions/checkout@v4.2.2
@@ -42,7 +47,7 @@ jobs:
           uses: ./actions/unblock_user_namespace_for_linux_sandbox
         - name: Bazel build communication targets
           run: |
-            bazel build --extra_toolchains=${{ matrix.toolchain }} //...
+            bazel build ${{ matrix.param }} //...
         - name: Bazel test communication targets
           run: |
-            bazel test --extra_toolchains=${{ matrix.toolchain }} //... --build_tests_only
+            bazel test ${{ matrix.param }} //... --build_tests_only

.github/workflows/build_and_test_qnx.yml

@@ -41,14 +41,17 @@ jobs:
               incompatible_targets:
                 - "-//score/mw/com/requirements/..." # Uninvestigated problem
                 - "-//score/mw/com/performance_benchmarks/..." # Uninvestigated problem
+                - "-//score/mw/com/doc/..." # Uninvestigated problem
+                - "-//score/mw/com/design/..." # Uninvestigated problem
             - bazel-config: "qnx_arm64"
               incompatible_targets:
                 - "-//score/mw/com/requirements/..." # Uninvestigated problem
                 - "-//score/mw/com/performance_benchmarks/..." # Uninvestigated problem
+                - "-//score/mw/com/doc/..." # Uninvestigated problem
+                - "-//score/mw/com/design/..." # Uninvestigated problem
       runs-on: ubuntu-24.04
       permissions:
         contents: read
-        pull-requests: read
       steps:
         - name: Checkout repository
           uses: actions/checkout@v4.2.2

.github/workflows/release_coverage_report.yml → .github/workflows/coverage_report.yml

@@ -13,18 +13,21 @@
 name: Coverage Report
 
 on:
+  pull_request:
+    types: [ opened, reopened, synchronize ]
   workflow_call:
-    inputs:
-      release_tag:
-        description: 'Release tag to upload artifacts to'
-        required: true
-        type: string
+    outputs:
+      artifact-name:
+        description: 'Name of the coverage report artifact'
+        value: ${{ jobs.coverage-report.outputs.artifact-name }}
 
 jobs:
   coverage-report:
     runs-on: ubuntu-24.04
     permissions:
       contents: write # required to upload release assets
+    outputs:
+      artifact-name: ${{ steps.set-artifact-name.outputs.artifact-name }}
 
     steps:
       - name: Checkout Repository
@@ -66,18 +69,18 @@ jobs:
           mkdir -p artifacts
           find bazel-testlogs/score/ -name 'test.xml' -print0 | xargs -0 -I{} cp --parents {} artifacts/
           cp -r cpp_coverage artifacts/
-          zip -r ${{ github.event.repository.name }}_coverage_report.zip artifacts/
+          zip -r ${{ github.event.repository.name }}_coverage_report_${{ github.sha }}.zip artifacts/
         shell: bash
 
+      - name: Set artifact name
+        id: set-artifact-name
+        run: |
+          echo "artifact-name=${{ github.event.repository.name }}_coverage_report_${{ github.sha }}" >> $GITHUB_OUTPUT
+
       - name: Upload coverage artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: ${{ github.event.repository.name }}_coverage_report.zip
-          path: ${{ github.event.repository.name }}_coverage_report.zip
+          name: ${{ steps.set-artifact-name.outputs.artifact-name }}
+          path: ${{ github.event.repository.name }}_coverage_report_${{ github.sha }}.zip
+
 
-      - name: Upload coverage report to existing draft release
-        run: |
-          # Upload the file to the existing release
-          gh release upload "${{ inputs.release_tag }}" "${{ github.event.repository.name }}_coverage_report.zip"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/thread_sanitizer.yml

@@ -24,6 +24,8 @@ on:
 jobs:
     build_and_test_tsan:
       runs-on: ubuntu-24.04
+      permissions:
+        contents: read
       steps:
         - name: Checkout repository
           uses: actions/checkout@v4.2.2