From 49995aabf46c3f60a7cd73c3d05f42e4b374d372 Mon Sep 17 00:00:00 2001
From: Matt <47545907+SoundMatt@users.noreply.github.com>
Date: Thu, 30 Jul 2026 15:58:36 -0700
Subject: [PATCH] fix: pin cpp-FuSa checkout to v0.18.0 in CI workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both the fusa-asil-b and sarif jobs in .github/workflows/ci.yml were
pinned to cpp-FuSa v0.15.0 (#16), three releases behind the current
v0.18.0. Bump both checkouts.

Built cpp-FuSa v0.18.0 locally the same way CI does and ran the full
fusa-asil-b gating sequence (init, check, lint, trace, cyber, qualify,
hara init, iso26262, iec61508, boundary, tara, fmea, safety-case, sas,
sci, badge, vuln, metrics, report) plus the sarif job's check --format
sarif against cpp-LIN's own tree, for real, before pushing. No new
ERROR-level findings: check/lint/cyber/qualify all pass clean (0
errors), identical to v0.15.0's clean-pass status; qualify's 8/8 case
suite still passes.

cyber's scanned-file count dropped from 28 to 16 (findings 43 -> 33)
between the two binaries — traced to upstream commit 8564bf0 (part of
the v0.16-v0.18 range), which fixed source-walking commands to honour
.fusa.json's sourceDirs (["src", "include"]) per x-FuSa spec S1.2.1.
v0.15.0 was over-scanning cli/ and tests/, outside this project's
declared source scope; v0.18.0 correctly excludes them. This is a
upstream bug fix, not a suppression of real findings.

iso26262/iec61508 gap-report commands still exit 1 (gaps > 0, expected
for a project without full formal ISO 26262 documentation) but both
calls in ci.yml are already wrapped in `|| true`, unchanged from
v0.15.0's behavior.

Full local suite re-run clean: cmake/ninja Release build (171/171
ctest), ASan+UBSan Debug build (171/171 ctest). ThreadSanitizer could
not be exercised locally (this sandbox's arm64 toolchain lacks a
linkable libtsan runtime); CI runs it natively on ubuntu-22.04/gcc-12
where TSan is supported, unaffected by this change.

No version bump: pure CI-tool-pin fix with no behavior change and no
new findings, same category as #16 and #50 (neither bumped the
version or touched CHANGELOG.md).

Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e307b4c..e6170d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -234,7 +234,7 @@ jobs:
         with:
           repository: SoundMatt/cpp-FuSa
           path: cpp-FuSa
-          ref: v0.15.0
+          ref: v0.18.0
 
       - name: Install tools
         run: sudo apt-get update -qq && sudo apt-get install -y cmake ninja-build zip
@@ -435,7 +435,7 @@ jobs:
         with:
           repository: SoundMatt/cpp-FuSa
           path: cpp-FuSa
-          ref: v0.15.0
+          ref: v0.18.0
 
       - name: Install tools
         run: sudo apt-get update -qq && sudo apt-get install -y cmake ninja-build