coretrace/CoreTrace Stack Analyzer

Static stack usage analysis for C/C++ code — detects stack overflows, VLAs, recursion, and more.

Trust Signals

workflow.ymlSHA-pinned

uses: coretrace/coretrace-stack-analyzer@2264770e3944f87aeea67f2e0b9fd9c2c0cd4747 # v0.18.2

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
sources	Source files to analyze (space-separated). If omitted, discovered from compile-commands.	no	""
compile-commands	Path to compile_commands.json (file or directory).	no	""
fail-on	CI gate policy: none (never fail), error (fail on errors), warning (fail on errors+warnings).	no	error
base-dir	Base directory stripped from SARIF URIs to produce relative paths.	no	""
stack-limit	Override stack size limit (e.g. 8KiB, 1MiB).	no	""
sarif-file	Output path for the SARIF report.	no	coretrace-stack-analysis.sarif
json-file	Output path for the JSON report.	no	coretrace-stack-analysis.json
upload-sarif	Upload SARIF to GitHub Code Scanning (true/false).	no	true
extra-args	Extra arguments forwarded to the analyzer (space-separated).	no	""
analysis-profile	Analysis profile passed to analyzer (fast\|full).	no	fast
resource-model	Resource model path. Use 'default' to use analyzer bundled model.	no	default
resource-cache-memory-only	Enable memory-only cross-TU resource summary cache (true/false).	no	true
warnings-only	Emit warnings/errors only (true/false).	no	false
inputs-from-git-fallback	When compile_commands.json is not found, analyze tracked source files from git (true/false).	no	true
llvm-version	LLVM version to install.	no	20

name	description
sarif-file	Path to the generated SARIF report.
json-file	Path to the generated JSON report.
errors	Number of errors found.
warnings	Number of warnings found.