fix(centos-7): restore ctest, update clang/llvm/clang-tidy 17 → 19

ctest is required by the appsec C components ASAN job (make test calls
ctest internally). cpack remains removed as it is genuinely unused.

Also updates clang-tidy, llvm-cov, llvm-profdata, clang-format, and
libc++ references from version 17 to 19 in appsec CI and cmake config.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: morrisonlevi

.gitlab/generate-appsec.php

@@ -50,7 +50,7 @@
   before_script:
 <?php unset_dd_runner_env_vars() ?>
     - git config --global --add safe.directory "$(pwd)/appsec/third_party/libddwaf"
-    - sudo apt install -y clang-tidy-17 libc++-17-dev libc++abi-17-dev
+    - sudo apt install -y clang-tidy-19 libc++-19-dev libc++abi-19-dev
     - mkdir -p appsec/build boost-cache boost-cache
   cache:
     - key: "appsec boost cache"
@@ -420,17 +420,17 @@
         ./appsec/build/tests/helper/ddappsec_helper_test
     - |
       cd /tmp/cov-ext
-      llvm-profdata-17 merge -sparse *.profraw -o default.profdata
-      llvm-cov-17 export "$CI_PROJECT_DIR"/appsec/build/ddappsec.so \
+      llvm-profdata-19 merge -sparse *.profraw -o default.profdata
+      llvm-cov-19 export "$CI_PROJECT_DIR"/appsec/build/ddappsec.so \
         -format=lcov -instr-profile=default.profdata \
         > "$CI_PROJECT_DIR"/appsec/build/coverage-ext.lcov
       echo "Uploading extension coverage to codecov"
       cd "$CI_PROJECT_DIR"
       codecov -t "$CODECOV_TOKEN" -n appsec-extension -v -f appsec/build/coverage-ext.lcov
     - |
       cd /tmp/cov-helper
-      llvm-profdata-17 merge -sparse *.profraw -o default.profdata
-      llvm-cov-17 export "$CI_PROJECT_DIR"/appsec/build/tests/helper/ddappsec_helper_test \
+      llvm-profdata-19 merge -sparse *.profraw -o default.profdata
+      llvm-cov-19 export "$CI_PROJECT_DIR"/appsec/build/tests/helper/ddappsec_helper_test \
         -format=lcov -instr-profile=default.profdata \
         > "$CI_PROJECT_DIR/appsec/build/coverage-helper.lcov"
       echo "Uploading helper coverage to codecov"
@@ -500,15 +500,15 @@
     KUBERNETES_MEMORY_LIMIT: 10Gi
     ARCH: amd64
   script:
-    - sudo apt install -y clang-format-17
+    - sudo apt install -y clang-format-19
     - cd appsec/build
     - |
       cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_ENABLE_COVERAGE=OFF \
         -DDD_APPSEC_TESTING=OFF -DCMAKE_CXX_FLAGS="-stdlib=libc++" \
         -DCMAKE_CXX_LINK_FLAGS="-stdlib=libc++" \
         -DBOOST_CACHE_PREFIX="$CI_PROJECT_DIR/boost-cache" \
-        -DCLANG_TIDY=/usr/bin/run-clang-tidy-17 \
-        -DCLANG_FORMAT=/usr/bin/clang-format-17
+        -DCLANG_TIDY=/usr/bin/run-clang-tidy-19 \
+        -DCLANG_FORMAT=/usr/bin/clang-format-19
     - make -j 4 extension ddappsec-helper
     - make format tidy
 
@@ -533,7 +533,7 @@
         -DASAN_BUILD" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address -fsanitize=leak" \
         -DCMAKE_MODULE_LINKER_FLAGS="-fsanitize=address -fsanitize=leak" \
         -DBOOST_CACHE_PREFIX="$CI_PROJECT_DIR/boost-cache" \
-        -DCLANG_TIDY=/usr/bin/run-clang-tidy-17
+        -DCLANG_TIDY=/usr/bin/run-clang-tidy-19
     - make -j 4 ddappsec_helper_test
     - cd ../..; ./appsec/build/tests/helper/ddappsec_helper_test
 
@@ -559,7 +559,7 @@
 #    - cd -
 #
 #    - cd appsec/build
-#    - cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_BUILD_EXTENSION=OFF -DCMAKE_CXX_FLAGS="-stdlib=libc++" -DCMAKE_CXX_LINK_FLAGS="-stdlib=libc++" -DFUZZER_ARCHIVE_PATH=$fuzzer -DBOOST_CACHE_PREFIX=/boost-cache -DCLANG_TIDY=/usr/bin/run-clang-tidy-17
+#    - cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_BUILD_EXTENSION=OFF -DCMAKE_CXX_FLAGS="-stdlib=libc++" -DCMAKE_CXX_LINK_FLAGS="-stdlib=libc++" -DFUZZER_ARCHIVE_PATH=$fuzzer -DBOOST_CACHE_PREFIX=/boost-cache -DCLANG_TIDY=/usr/bin/run-clang-tidy-19
 #    - make -j 4 ddappsec_helper_fuzzer corpus_generator
 #    - cd ..
 #    - mkdir -p tests/fuzzer/{corpus,results,logs}
@@ -580,9 +580,9 @@
 #    - LLVM_PROFILE_FILE=body.profraw ./build/tests/fuzzer/ddappsec_helper_fuzzer --log_level=off --fuzz-mode=body -max_total_time=60 -rss_limit_mb=4096 -artifact_prefix=tests/fuzzer/results/ tests/fuzzer/corpus/
 #
 #    - '# Generate coverage'
-#    - llvm-profdata-17 merge -sparse *.profraw -o default.profdata
-#    - llvm-cov-17 show build/tests/fuzzer/ddappsec_helper_fuzzer -instr-profile=default.profdata -ignore-filename-regex="(tests|third_party|build)" -format=html > fuzzer-coverage.html
-#    - llvm-cov-17 report -instr-profile default.profdata build/tests/fuzzer/ddappsec_helper_fuzzer -ignore-filename-regex="(tests|third_party|build)" -show-region-summary=false
+#    - llvm-profdata-19 merge -sparse *.profraw -o default.profdata
+#    - llvm-cov-19 show build/tests/fuzzer/ddappsec_helper_fuzzer -instr-profile=default.profdata -ignore-filename-regex="(tests|third_party|build)" -format=html > fuzzer-coverage.html
+#    - llvm-cov-19 report -instr-profile default.profdata build/tests/fuzzer/ddappsec_helper_fuzzer -ignore-filename-regex="(tests|third_party|build)" -show-region-summary=false
 #  artifacts:
 #    paths:
 #     - appsec/fuzzer-coverage.html

appsec/cmake/clang-tidy.cmake

@@ -1,17 +1,17 @@
-# Prefer a locally installed LLVM 17 run-clang-tidy (e.g. via brew install llvm@17)
+# Prefer a locally installed LLVM 19 run-clang-tidy (e.g. via brew install llvm@19)
 # over the Docker-based wrapper, since native execution avoids SDK incompatibilities.
-set(_LLVM17_BIN /opt/homebrew/opt/llvm@17/bin)
-set(_LLVM17_TIDY ${_LLVM17_BIN}/run-clang-tidy)
+set(_LLVM19_BIN /opt/homebrew/opt/llvm@19/bin)
+set(_LLVM19_TIDY ${_LLVM19_BIN}/run-clang-tidy)
 set(CLANG_TIDY_BINARY_OPT "")
-if(EXISTS ${_LLVM17_TIDY})
-    set(CLANG_TIDY ${_LLVM17_TIDY})
-    set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_LLVM17_BIN}/clang-tidy)
-    message(STATUS "Using Homebrew LLVM 17 run-clang-tidy: ${CLANG_TIDY}")
+if(EXISTS ${_LLVM19_TIDY})
+    set(CLANG_TIDY ${_LLVM19_TIDY})
+    set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_LLVM19_BIN}/clang-tidy)
+    message(STATUS "Using Homebrew LLVM 19 run-clang-tidy: ${CLANG_TIDY}")
 else()
-    find_program(_RCT_VERSIONED run-clang-tidy-17)
+    find_program(_RCT_VERSIONED run-clang-tidy-19)
     if(NOT _RCT_VERSIONED STREQUAL _RCT_VERSIONED-NOTFOUND)
         set(CLANG_TIDY ${_RCT_VERSIONED})
-        find_program(_CT_VERSIONED clang-tidy-17)
+        find_program(_CT_VERSIONED clang-tidy-19)
         if(NOT _CT_VERSIONED STREQUAL _CT_VERSIONED-NOTFOUND)
             set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_CT_VERSIONED})
         endif()
@@ -37,7 +37,7 @@ else()
     if(NOT CLANG_TIDY)
         set(CLANG_TIDY ${CMAKE_CURRENT_LIST_DIR}/clang-tools/run-clang-tidy)
         if(NOT EXISTS ${CLANG_TIDY})
-            message(STATUS "Cannot find clang-tidy version 17, either set CLANG_TIDY or make it discoverable")
+            message(STATUS "Cannot find clang-tidy version 19, either set CLANG_TIDY or make it discoverable")
             return()
         endif()
         message(STATUS "Using Docker-based run-clang-tidy wrapper: ${CLANG_TIDY}")

dockerfiles/ci/centos/7/base.Dockerfile

@@ -121,7 +121,7 @@ RUN source scl_source enable devtoolset-7; set -eux; \
     mkdir -v 'build' && cd 'build'; \
     ../bootstrap -- -DBUILD_CursesDialog=OFF && make -j $(nproc) && make install; \
     cd - && rm -fr build "${SRC_DIR}/cmake" \
-    && rm -f /usr/local/bin/cpack /usr/local/bin/ctest \
+    && rm -f /usr/local/bin/cpack \
     && rm -rf /usr/local/share/cmake-*/Help /usr/local/share/doc/cmake* /usr/local/share/man/man1/cmake*
 
 # Install Catch2