50 self analysis remove remaining false positive and make warnings only output actionable

CONTRIBUTING.md

@@ -0,0 +1,122 @@
+# Contributing to coretrace-stack-analyzer
+
+Thanks for contributing.
+
+This document defines the expected workflow for code, tests, and pull requests.
+
+## Development Setup
+
+Prerequisites:
+- CMake `>= 3.16`
+- LLVM/Clang `>= 19` (20 recommended)
+- A C++20 compiler
+
+Build:
+
+```bash
+./build.sh --type Release
+```
+
+If LLVM/Clang are not auto-detected:
+
+```bash
+LLVM_DIR=/path/to/llvm/lib/cmake/llvm \
+Clang_DIR=/path/to/llvm/lib/cmake/clang \
+./build.sh --type Release
+```
+
+## Local Validation Before Opening a PR
+
+Run formatting check:
+
+```bash
+./scripts/format-check.sh
+```
+
+Run regression tests:
+
+```bash
+python3 run_test.py --analyzer ./build/stack_usage_analyzer
+```
+
+Optional module unit tests (recommended for architectural/internal changes):
+
+```bash
+cmake -S . -B build -DBUILD_ANALYZER_UNIT_TESTS=ON
+cmake --build build
+cd build && ctest -R analyzer_module_unit_tests
+```
+
+## Commit Convention (CI Enforced)
+
+Commit subjects must follow Conventional Commits:
+
+```text
+type(scope): subject
+```
+
+Allowed `type` values:
+- `feat`
+- `fix`
+- `chore`
+- `docs`
+- `refactor`
+- `perf`
+- `ci`
+- `build`
+- `style`
+- `revert`
+- `test`
+
+Rules:
+- Subject line max length: **84** characters.
+- Use English for commit messages.
+- Keep commits focused and atomic when possible.
+
+## Pull Request Expectations
+
+A PR should include:
+- A clear problem statement and solution summary.
+- Behavioral impact (what changed for users/CI/API).
+- Validation evidence (commands run, test results).
+- Documentation updates when behavior/options/contracts change.
+
+If relevant, include:
+- Example CLI invocation
+- JSON/SARIF output impact
+- Notes on profile/cross-TU performance impact
+
+## Architecture Guardrails
+
+When adding or refactoring features, preserve module boundaries:
+
+- `src/app/AnalyzerApp.cpp`: application orchestration, strategy selection, input planning.
+- `src/analyzer/*`: analysis pipeline coordination, preparation, location resolution, diagnostic emission.
+- `src/analysis/*`: analysis logic and findings generation.
+- `src/report/ReportSerialization.cpp`: output serialization (JSON/SARIF).
+- `src/cli/ArgParser.cpp`: CLI argument parsing and validation.
+
+Why:
+- Keeps analysis logic decoupled from CLI/CI concerns.
+- Improves testability with narrow module responsibilities.
+- Reduces regression risk by centralizing reporting and orchestration behavior.
+
+For architecture details, see:
+- `docs/architecture/analyzer-modules.md`
+
+## Adding a New Check (Short Version)
+
+1. Implement analysis logic under `src/analysis/` (+ header under `include/analysis/`).
+2. Integrate the pass into pipeline/module orchestration.
+3. Emit diagnostics through `DiagnosticEmitter` (severity, rule ID, message, CWE/confidence if applicable).
+4. Add regression tests under `test/`.
+5. Update docs (`README`, wiki/docs pages) when new behavior or options are introduced.
+
+## CI Notes
+
+Current CI validates at least:
+- Conventional commit format
+- clang-format compliance
+- build/tests/integration workflows
+
+Before opening a PR, run local checks to reduce CI round-trips.

PATCH.md

@@ -0,0 +1,54 @@
+# Statut des faux positifs (mise a jour)
+
+## Corriges
+
+### 1) `src/analysis/MemIntrinsicOverflow.cpp:71`
+
+Warning corrige:
+- `local variable 'classifyByName' is never initialized`
+
+Patch applique:
+- `UninitializedVarAnalysis` ignore maintenant les objets C++ vides (ex: lambda sans state)
+  en se basant sur la forme IR + metadata debug (pas une heuristique sur un nom de variable).
+
+### 2) `src/analysis/ResourceLifetimeAnalysis.cpp:823, 825, 995, 1007`
+
+Warning corrige:
+- `potential read of uninitialized local variable 'out'`
+
+Patch applique:
+- verification d'initialisation "padding-aware" dans `UninitializedVarAnalysis`:
+  - on valide l'initialisation des octets semantiques (membres) ;
+  - les trous de padding de layout ne declenchent plus de faux positifs.
+
+### 3) `src/cli/ArgParser.cpp` (19 warnings)
+
+Warnings corriges:
+- `potential UB: invalid base reconstruction via offsetof/container_of`
+- `unable to verify that derived pointer points to a valid object`
+
+Patch applique:
+- `InvalidBaseReconstruction` utilise maintenant une resolution recursive de sous-objet
+  (type + offset + bornes de projection) au lieu d'un test limite au membre top-level.
+- Les projections C++ valides sur objets imbriques (`result.parsed.config.*`) ne sont plus
+  confondues avec des patterns `container_of`.
+
+## Non-regressions ajoutees
+
+- `test/uninitialized-variable/uninitialized-local-cpp-empty-lambda-capture.cpp`
+- `test/uninitialized-variable/uninitialized-local-cpp-default-member-return.cpp`
+- `test/offset_of-container_of/gep_nested_subobject_reference_no_diag.cpp`
+
+## Validation
+
+- Verification ciblee sur:
+  - `src/analysis/MemIntrinsicOverflow.cpp` -> `warning=0`
+  - `src/analysis/ResourceLifetimeAnalysis.cpp` -> `warning=0`
+  - `src/cli/ArgParser.cpp` -> `warning=0`
+- Suite de regression complete:
+  - `./run_test.py --jobs 4`
+  - resultat: **413/413 passed**
+
+## Reste connu
+
+- Hors faux positifs: vrai positif conserve `src/analysis/InvalidBaseReconstruction.cpp:188`.

README.md

@@ -213,7 +213,7 @@ Ready-to-adapt workflow examples:
 --format=json|sarif|human
 --analysis-profile=fast|full selects analysis precision/performance profile (default: full)
 --quiet disables diagnostics entirely
---warnings-only keeps only important diagnostics
+--warnings-only hides info-level diagnostics; in human output it also lists only functions with warnings/errors
 --stack-limit=<value> overrides stack limit (bytes, or KiB/MiB/GiB)
 --compile-arg=<arg> passes an extra argument to the compiler
 --compile-commands=<path> uses compile_commands.json (file or directory)