ci: upgrade cppcheck from 2.3 to 2.13 via apt

[fabit0v]

Goal

Update the cppcheck CI to use Ubuntu's pre-built package with incremental caching and targeted configuration checking.

Why

The build-from-source setup (pinned to cppcheck 2.3 from 2020) requires source patches and keeps breaking. Every upgrade attempt (#3630, #3646, #5186) failed due to compilation issues on newer Ubuntu.

How

• Replace install_cppcheck.sh with apt-get install cppcheck=2.13*
• Remove --force and replace with explicit -D/-U flags targeting Linux+AWS-LC (the largest code path)
• Default --max-configs=12 handles remaining unknown macros (with -D/-U pinning major macros, this adds zero additional runtime)
• Add --cppcheck-build-dir with GitHub Actions cache for incremental analysis
• Rebuild suppressions.txt and verify against cppcheck 2.13
• Use -j "$(nproc)" to adapt to available cores

Callouts

Why target a single config as opposed to checking everything?
Cppcheck 2.13 with --force explores every #ifdef combination. With dozens of platform/crypto macros across hundreds of files, this causes 6+ hour timeouts on CI's 2-core runners. The old version (2.3) handled --force in 28 min because its analysis was less thorough. The alternative is to explicitly define one configuration with -D/-U flags and let --max-configs=12 handle the rest. This produces identical findings to using the --force flag in 32 min as opposed to 6+ hours on the CI.

• Cold run takes ~32 min on CI (2-core runner) on the first run. After cache is seeded it will be seconds.
• --force removed. It caused 6+ hour timeouts with cppcheck 2.13 on 2-core runners. The -D/-U approach explicitly resolves the major platform/crypto macros that cause combinatorial explosion.
  • Running with and without --force locally produces identical findings
• -j "$(nproc)" disables unusedFunction check (unchanged behavior from before)
• All suppressions verified against cppcheck 2.13.0 (Ubuntu 24.04)

Testing

• Ran locally in Docker with --cpus=2 simulating GitHub Actions runner constraints: 32 min cold run, passes clean
• Verified --force vs single-config produces identical findings
• Verified three-config(first commit) vs single-config(Linux + AWSLC). Single-config run results in identical findings with shorter run time.
• CI runners verified 32 min on a cold run and 10 seconds after rerunning with cache.

Resolves #5239

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[boquan-fang]

Seems like cppcheck will take 1 hour 43 minutes to finish running: https://github.com/aws/s2n-tls/actions/runs/28401044354/job/84152043651?pr=5943. Will this becomes faster in the future? If so, how much time or how many PRs do we need to do to get it down to a reasonable runtime.

[boquan-fang]

The original check has --enable=all and the code that you change to only has warning, performance, and portability check. Does that drop test coverage?

[fabit0v]

It primarily drops the style suggestions which aren't actionable and informational messages like "ConfigurationNotChecked" and "unusedFunction", which don't work with -j.

[boquan-fang]

All these three configs seem very similar to each other. Can we just use --force flag and make it one command?

[fabit0v]

--force causes the job to time out at 6 hours because it tells cppcheck to explore every possible #ifdef combination.

[boquan-fang]

At line 17 of this file: https://github.com/aws/s2n-tls/pull/5943/changes#diff-bc7696cee1ea27205e3e145964ee35b2c7e79d5184b450e2dd1d5218aaee01f1R17, knownConditionTrueFalse has already been scoped to crypto/s2n_libcrypto.c. Why do we enable it globally here? Do we want this suppression to be globally available or just scoped to crypto/s2n_libcrypto.c?

[boquan-fang]

How many errors are these suppressing? All previous suppressions have a scope. Global suppressions might hide problems from us and general not a good idea.

[fabit0v]

Most of these suppressions are from using cpp-check 2.19 locally which introduced new findings. I can scope it down to what the current CI runners use (version 2.13)

[boquan-fang]

This unmatchedSuppression seems to suppress warnings if a suppression in this file doesn't match anything. I don't think we should suppress this error. We should fix the warnings that was generated by this suppression.

[fabit0v]

Most of these findings are results from running it locally (Ubuntu 26 uses cpp-check 2.19). I will refactor to focus on the version that the CI runners use (2.13).