tests: check: ast-grep: add static analysis rules

.github/fedora-42.Dockerfile

@@ -25,6 +25,7 @@ RUN dnf --disablerepo=* --enablerepo=fedora,updates --nodocs --setopt=install_we
     libcmocka-devel \
     libgit2-devel \
     libtool \
+    pipx \
     procps-ng \
     python3-breathe \
     python3-dateutil \
@@ -36,3 +37,6 @@ RUN dnf --disablerepo=* --enablerepo=fedora,updates --nodocs --setopt=install_we
     sed \
     xxd && \
     dnf clean all -y
+
+RUN pipx install --global ast-grep-cli && \
+    ast-grep --version

.github/fedora-43.Dockerfile

@@ -25,6 +25,7 @@ RUN dnf --disablerepo=* --enablerepo=fedora,updates --nodocs --setopt=install_we
     libcmocka-devel \
     libgit2-devel \
     libtool \
+    pipx \
     procps-ng \
     python3-breathe \
     python3-dateutil \
@@ -36,3 +37,6 @@ RUN dnf --disablerepo=* --enablerepo=fedora,updates --nodocs --setopt=install_we
     sed \
     xxd && \
     dnf clean all -y
+
+RUN pipx install --global ast-grep-cli && \
+    ast-grep --version

.github/fedora-44.Dockerfile

@@ -26,6 +26,7 @@ RUN dnf --disablerepo=* --enablerepo=fedora,updates --nodocs --setopt=install_we
     libgit2-devel \
     libpfm-devel \
     libtool \
+    pipx \
     procps-ng \
     python3-breathe \
     python3-dateutil \
@@ -37,3 +38,6 @@ RUN dnf --disablerepo=* --enablerepo=fedora,updates --nodocs --setopt=install_we
     sed \
     xxd && \
     dnf clean all -y
+
+RUN pipx install --global ast-grep-cli && \
+    ast-grep --version

.github/fedora-rawhide.Dockerfile

@@ -28,6 +28,7 @@ RUN dnf --disablerepo=* --enablerepo=fedora --nodocs --setopt=install_weak_deps=
     libgit2-devel \
     libpfm-devel \
     libtool \
+    pipx \
     procps-ng \
     python3-breathe \
     python3-dateutil \
@@ -39,3 +40,6 @@ RUN dnf --disablerepo=* --enablerepo=fedora --nodocs --setopt=install_weak_deps=
     sed \
     xxd && \
     dnf clean all -y
+
+RUN pipx install --global ast-grep-cli && \
+    ast-grep --version

.github/ubuntu-24.04.Dockerfile

@@ -39,4 +39,5 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
     xxd && \
     rm -rf /var/lib/apt/lists/*
 
-RUN pip install --break-system-packages linuxdoc
+RUN pip install --break-system-packages linuxdoc ast-grep-cli && \
+    ast-grep --version

.github/ubuntu-25.04.Dockerfile

@@ -39,4 +39,5 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
     xxd && \
     rm -rf /var/lib/apt/lists/*
 
-RUN pip install --break-system-packages linuxdoc
+RUN pip install --break-system-packages linuxdoc ast-grep-cli && \
+    ast-grep --version

.github/ubuntu-25.10.Dockerfile

@@ -39,4 +39,5 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
     xxd && \
     rm -rf /var/lib/apt/lists/*
 
-RUN pip install --break-system-packages linuxdoc
+RUN pip install --break-system-packages linuxdoc ast-grep-cli && \
+    ast-grep --version

tests/check/CMakeLists.txt

@@ -57,6 +57,31 @@ set_tests_properties("check.checkstyle" PROPERTIES
     LABELS "check"
 )
 
+find_program(SG_BIN NAMES ast-grep)
+
+if(SG_BIN)
+    set(SG_CONFIG ${CMAKE_SOURCE_DIR}/tests/check/ast-grep/sgconfig.yml)
+
+    add_test(NAME "check.astgrep.test"
+        COMMAND ${SG_BIN} test --config ${SG_CONFIG}
+    )
+
+    add_test(NAME "check.astgrep"
+        COMMAND ${SG_BIN} scan --config ${SG_CONFIG}
+            ${CMAKE_SOURCE_DIR}/src/libbpfilter
+            ${CMAKE_SOURCE_DIR}/src/bfcli
+            --off=assert-pointer-params
+            --off=doxygen-prefer-backticks
+            --off=doxygen-public-functions
+            --off=no-direct-free
+            --off=single-line-comment-style
+    )
+
+    set_tests_properties("check.astgrep.test" "check.astgrep" PROPERTIES
+        LABELS "check"
+    )
+endif()
+
 add_custom_target(fixstyle
     COMMAND
         ${CLANG_FORMAT_BIN}

tests/check/ast-grep/rule-tests/__snapshots__/assert-pointer-params-snapshot.yml

@@ -0,0 +1,62 @@
+id: assert-pointer-params
+snapshots:
+  ? |
+    int bf_chain_add_rule(struct bf_chain *chain, struct bf_rule *rule)
+    {
+        return 0;
+    }
+  : labels:
+    - source: |-
+        int bf_chain_add_rule(struct bf_chain *chain, struct bf_rule *rule)
+        {
+            return 0;
+        }
+      style: primary
+      start: 0
+      end: 85
+    - source: '*chain'
+      style: secondary
+      start: 38
+      end: 44
+    - source: struct bf_chain *chain
+      style: secondary
+      start: 22
+      end: 44
+    - source: (struct bf_chain *chain, struct bf_rule *rule)
+      style: secondary
+      start: 21
+      end: 67
+    - source: bf_chain_add_rule(struct bf_chain *chain, struct bf_rule *rule)
+      style: secondary
+      start: 4
+      end: 67
+  ? |
+    void bf_rule_free(struct bf_rule **rule)
+    {
+        return;
+    }
+  : labels:
+    - source: |-
+        void bf_rule_free(struct bf_rule **rule)
+        {
+            return;
+        }
+      style: primary
+      start: 0
+      end: 56
+    - source: '**rule'
+      style: secondary
+      start: 33
+      end: 39
+    - source: struct bf_rule **rule
+      style: secondary
+      start: 18
+      end: 39
+    - source: (struct bf_rule **rule)
+      style: secondary
+      start: 17
+      end: 40
+    - source: bf_rule_free(struct bf_rule **rule)
+      style: secondary
+      start: 5
+      end: 40

tests/check/ast-grep/rule-tests/__snapshots__/bf-prefix-public-functions-snapshot.yml

@@ -0,0 +1,30 @@
+id: bf-prefix-public-functions
+snapshots:
+  ? |
+    int my_func(void)
+    {
+        return 0;
+    }
+  : labels:
+    - source: |-
+        int my_func(void)
+        {
+            return 0;
+        }
+      style: primary
+      start: 0
+      end: 35
+  ? |
+    void process_packet(struct pkt *p)
+    {
+        return;
+    }
+  : labels:
+    - source: |-
+        void process_packet(struct pkt *p)
+        {
+            return;
+        }
+      style: primary
+      start: 0
+      end: 50

tests/check/ast-grep/rule-tests/__snapshots__/double-pointer-output-snapshot.yml

@@ -0,0 +1,24 @@
+id: double-pointer-output
+snapshots:
+  ? |
+    int bf_chain_new(struct bf_chain *chain)
+    {
+        return 0;
+    }
+  : labels:
+    - source: |-
+        int bf_chain_new(struct bf_chain *chain)
+        {
+            return 0;
+        }
+      style: primary
+      start: 0
+      end: 58
+    - source: bf_chain_new
+      style: secondary
+      start: 4
+      end: 16
+    - source: bf_chain_new(struct bf_chain *chain)
+      style: secondary
+      start: 4
+      end: 40

tests/check/ast-grep/rule-tests/__snapshots__/doxygen-prefer-backticks-snapshot.yml

@@ -0,0 +1,36 @@
+id: doxygen-prefer-backticks
+snapshots:
+  ? |
+    /**
+     * @brief Free a map object.
+     *
+     * @param map @ref bf_map object to free.
+     */
+    void bf_map_free(struct bf_map **map);
+  : labels:
+    - source: |-
+        /**
+         * @brief Free a map object.
+         *
+         * @param map @ref bf_map object to free.
+         */
+      style: primary
+      start: 0
+      end: 81
+  ? |
+    /**
+     * @brief Manage BPF object references.
+     *
+     * @ref bf_handle is used to manage references.
+     */
+    int bf_handle_new(void);
+  : labels:
+    - source: |-
+        /**
+         * @brief Manage BPF object references.
+         *
+         * @ref bf_handle is used to manage references.
+         */
+      style: primary
+      start: 0
+      end: 98

tests/check/ast-grep/rule-tests/__snapshots__/doxygen-public-functions-snapshot.yml

@@ -0,0 +1,17 @@
+id: doxygen-public-functions
+snapshots:
+  ? |
+    // This is not a Doxygen comment
+    int bf_set_add(struct bf_set *set, int value);
+  : labels:
+    - source: int bf_set_add(struct bf_set *set, int value);
+      style: primary
+      start: 33
+      end: 79
+  ? |
+    int bf_rule_free(void);
+  : labels:
+    - source: int bf_rule_free(void);
+      style: primary
+      start: 0
+      end: 23

tests/check/ast-grep/rule-tests/__snapshots__/enum-bf-prefix-snapshot.yml

@@ -0,0 +1,42 @@
+id: enum-bf-prefix
+snapshots:
+  ? |
+    enum filter_type
+    {
+        FILTER_ACCEPT,
+        _FILTER_MAX,
+    };
+  : labels:
+    - source: |-
+        enum filter_type
+        {
+            FILTER_ACCEPT,
+            _FILTER_MAX,
+        }
+      style: primary
+      start: 0
+      end: 56
+    - source: filter_type
+      style: secondary
+      start: 5
+      end: 16
+  ? |
+    enum hook
+    {
+        HOOK_XDP,
+        _HOOK_MAX,
+    };
+  : labels:
+    - source: |-
+        enum hook
+        {
+            HOOK_XDP,
+            _HOOK_MAX,
+        }
+      style: primary
+      start: 0
+      end: 42
+    - source: hook
+      style: secondary
+      start: 5
+      end: 9

tests/check/ast-grep/rule-tests/__snapshots__/enum-sentinel-format-snapshot.yml

@@ -0,0 +1,58 @@
+id: enum-sentinel-format
+snapshots:
+  ? |
+    enum bf_chain_type
+    {
+        BF_CHAIN_TYPE_FILTER,
+        BF_CHAIN_TYPE_NAT,
+    };
+  : labels:
+    - source: |-
+        enum bf_chain_type
+        {
+            BF_CHAIN_TYPE_FILTER,
+            BF_CHAIN_TYPE_NAT,
+        }
+      style: primary
+      start: 0
+      end: 71
+    - source: bf_chain_type
+      style: secondary
+      start: 5
+      end: 18
+    - source: |-
+        {
+            BF_CHAIN_TYPE_FILTER,
+            BF_CHAIN_TYPE_NAT,
+        }
+      style: secondary
+      start: 19
+      end: 71
+  ? |
+    enum bf_hook
+    {
+        BF_HOOK_XDP,
+        BF_HOOK_TC_INGRESS,
+    };
+  : labels:
+    - source: |-
+        enum bf_hook
+        {
+            BF_HOOK_XDP,
+            BF_HOOK_TC_INGRESS,
+        }
+      style: primary
+      start: 0
+      end: 57
+    - source: bf_hook
+      style: secondary
+      start: 5
+      end: 12
+    - source: |-
+        {
+            BF_HOOK_XDP,
+            BF_HOOK_TC_INGRESS,
+        }
+      style: secondary
+      start: 13
+      end: 57