Memory-safety analysis for C and C++

.github/actions/chen-from-main/action.yml

@@ -0,0 +1,53 @@
+name: Build chen from main
+description: >-
+  Temporary: builds AppThreat/chen from main and publishes it to the local Ivy repository, so atom
+  resolves a chen version that is not released yet. Remove this action and its callers once that
+  chen version is on the package registry.
+inputs:
+  ivy-home:
+    description: Ivy home to publish into, for builds that mount their own (Linux and macOS). Defaults to sbt's.
+    required: false
+    default: ''
+  setup-jdk:
+    description: Set up a JDK and sbt first, for jobs that do not install them.
+    required: false
+    default: 'false'
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961  # v5.7.0
+      if: inputs.setup-jdk == 'true'
+      with:
+        distribution: 'temurin'
+        java-version: '25'
+    - uses: sbt/setup-sbt@bfea3c5f48abd221b04a6df4798aa5eb8b6a2baf  # v1.5.6
+      if: inputs.setup-jdk == 'true'
+    - name: Publish chen main locally
+      if: runner.os != 'Windows'
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        CHEN_DIR: ${{ runner.temp }}/chen-main
+        IVY_HOME: ${{ inputs.ivy-home }}
+      run: |
+        set -euo pipefail
+        git clone --quiet --depth 1 --branch main https://github.com/AppThreat/chen.git "$CHEN_DIR"
+        cd "$CHEN_DIR"
+        sbt ${IVY_HOME:+"-Dsbt.ivy.home=$IVY_HOME"} -batch \
+          "set ThisBuild / Compile / packageDoc / publishArtifact := false" publishLocal
+        cd "$RUNNER_TEMP"
+        rm -rf "$CHEN_DIR"
+    - name: Publish chen main locally
+      if: runner.os == 'Windows'
+      shell: pwsh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        CHEN_DIR: ${{ runner.temp }}\chen-main
+      run: |
+        git clone --quiet --depth 1 --branch main https://github.com/AppThreat/chen.git "$env:CHEN_DIR"
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        Push-Location "$env:CHEN_DIR"
+        sbt -batch "set ThisBuild / Compile / packageDoc / publishArtifact := false" publishLocal
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        Pop-Location
+        Remove-Item -Recurse -Force "$env:CHEN_DIR"

.github/workflows/containers.yml

@@ -101,6 +101,7 @@ jobs:
             ~/.coursier
           key: ${{ runner.os }}-sbt-${{ hashfiles('**/build.sbt') }}
           lookup-only: true
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - run: |
           sbt stage createDistribution
         env:

.github/workflows/nodejstests.yml

@@ -101,6 +101,7 @@ jobs:
           sudo apt update -y
           sudo apt install -y zlib1g php-zip
         if: runner.os == 'Linux'
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - name: atom node tests
         run: |
           sbt stage createDistribution
@@ -190,6 +191,7 @@ jobs:
       - uses: coursier/setup-action@9b7939bf01fd1185ce2babe16135168361bf2c62  # v3.0.2
         with:
           apps: scala3 scalac
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - name: build
         shell: pwsh
         run: |

.github/workflows/pr.yml

@@ -75,6 +75,7 @@ jobs:
       - uses: coursier/setup-action@9b7939bf01fd1185ce2babe16135168361bf2c62  # v3.0.2
         with:
           apps: scala3 scalac
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - run: |
           # Install the AST generators (astgen, phpastgen, rbastgen) BEFORE `sbt test`: the
           # workflow tests probe for them and cancel without them, so a post-test install would

.github/workflows/release.yml

@@ -36,6 +36,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
           cache: ''
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756  # v1.13.0
         with:
           arch: amd64
@@ -87,6 +88,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
           cache: ''
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756  # v1.13.0
         with:
           arch: arm64
@@ -134,6 +136,7 @@ jobs:
         with:
           apps: scala3 scalac
       - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d  # v2.0.1
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - run: |
           wget https://github.com/upx/upx/releases/download/v5.0.1/upx-5.0.1-amd64_linux.tar.xz
           tar -xvf upx-5.0.1-amd64_linux.tar.xz
@@ -216,6 +219,7 @@ jobs:
         with:
           apps: scala3 scalac
       - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d  # v2.0.1
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - run: |
           wget https://github.com/upx/upx/releases/download/v5.0.1/upx-5.0.1-arm64_linux.tar.xz
           tar -xvf upx-5.0.1-arm64_linux.tar.xz
@@ -280,6 +284,7 @@ jobs:
         with:
           apps: scala3 scalac
       - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d  # v2.0.1
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - run: |
           brew install coreutils
           sbt stage createDistribution
@@ -327,6 +332,10 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d  # v2.0.1
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
+        with:
+          setup-jdk: 'true'
+          ivy-home: ${{ github.workspace }}/.cache/native-image-musl/ivy2
       - run: |
           wget https://github.com/upx/upx/releases/download/v5.0.1/upx-5.0.1-amd64_linux.tar.xz
           tar -xvf upx-5.0.1-amd64_linux.tar.xz
@@ -376,6 +385,10 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d  # v2.0.1
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
+        with:
+          setup-jdk: 'true'
+          ivy-home: ${{ github.workspace }}/.cache/native-image-musl/ivy2
       - run: |
           wget https://github.com/upx/upx/releases/download/v5.0.1/upx-5.0.1-arm64_linux.tar.xz
           tar -xvf upx-5.0.1-arm64_linux.tar.xz

.github/workflows/repotests.yml

@@ -141,6 +141,7 @@ jobs:
       - name: Install sbt
         run: brew install sbt
         if: runner.os == 'macOS'
+      - uses: ./.github/actions/chen-from-main  # temporary: remove once chen 4.0.0 is published
       - run: |
           sbt stage createDistribution
           python -m pip install atom-tools

README.md

@@ -604,14 +604,6 @@ chennai> importAtom("/home/almalinux/work/sandbox/apollo/app.atom")
 
 Checkout [atom-tools](https://github.com/AppThreat/atom-tools) for some project ideas involving atom slices.
 
-## devenv setup
-
-Install devenv by following the official [instructions](https://devenv.sh/getting-started/).
-
-```shell
-devenv shell
-```
-
 Language-specific profile:
 
 ```shell

build.sbt

@@ -1,9 +1,9 @@
 name                     := "atom"
 ThisBuild / organization := "io.appthreat"
-ThisBuild / version      := "3.2.0"
-ThisBuild / scalaVersion := "3.8.4"
+ThisBuild / version      := "4.0.0"
+ThisBuild / scalaVersion := "3.9.0"
 
-val chenVersion = "3.4.0"
+val chenVersion = "4.0.0"
 
 lazy val atom = Projects.atom
 resolvers += "Google Maven".at("https://maven.google.com/")
@@ -27,6 +27,8 @@ libraryDependencies ++= Seq(
   ("io.appthreat" %% "semanticcpg"       % Versions.chen % Test).classifier("tests"),
   ("io.appthreat" %% "x2cpg"             % Versions.chen % Test).classifier("tests"),
   ("io.appthreat" %% "pysrc2cpg"         % Versions.chen % Test).classifier("tests"),
+  // the memory-safety overlay is C/C++ only, so its command needs a C fixture to test against
+  ("io.appthreat" %% "c2cpg"             % Versions.chen % Test).classifier("tests"),
   "org.scalatest" %% "scalatest"         % "3.2.20"      % Test
 )
 

ci/Dockerfile

@@ -13,7 +13,7 @@ LABEL maintainer="appthreat" \
 
 ARG JAVA_VERSION=26.0.1-tem
 ARG MAVEN_VERSION=3.9.16
-ARG SCALA_VERSION=3.8.4
+ARG SCALA_VERSION=3.9.0
 ARG SBT_VERSION=1.12.12
 ARG RUBY_VERSION=4.0.5
 

codemeta.json

@@ -7,7 +7,7 @@
   "downloadUrl": "https://github.com/AppThreat/atom",
   "issueTracker": "https://github.com/AppThreat/atom/issues",
   "name": "atom",
-  "version": "3.2.0",
+  "version": "4.0.0",
   "description": "Atom is a novel intermediate representation for next-generation code analysis.",
   "applicationCategory": "code-analysis",
   "keywords": [