From 5c1f2578efb7c25d971e53f2b8c42407602977f4 Mon Sep 17 00:00:00 2001
From: Adeeb Shihadeh <adeebshihadeh@gmail.com>
Date: Mon, 23 Feb 2026 12:47:39 -0800
Subject: [PATCH] use vendored cppcheck from dependencies repo (#2347)

---
 .github/workflows/test.yaml           | 14 ---------
 .github/workflows/update-cppcheck.yml | 41 ---------------------------
 pyproject.toml                        |  1 +
 tests/misra/install.sh                | 18 ------------
 tests/misra/test_misra.sh             |  7 +----
 5 files changed, 2 insertions(+), 79 deletions(-)
 delete mode 100644 .github/workflows/update-cppcheck.yml
 delete mode 100755 tests/misra/install.sh

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 175788fa..06a69c35 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -66,12 +66,6 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Cache cppcheck
-        id: cppcheck-cache
-        uses: actions/cache@v4
-        with:
-          path: tests/misra/cppcheck
-          key: cppcheck-${{ hashFiles('tests/misra/*') }}
       - run: ./setup.sh
       - name: Build FW
         run: ${{ env.RUN }} "scons -j$(nproc)"
@@ -84,16 +78,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Cache cppcheck
-        id: cppcheck-cache
-        uses: actions/cache@v4
-        with:
-          path: tests/misra/cppcheck
-          key: cppcheck-${{ hashFiles('tests/misra/*') }}
       - run: ./setup.sh
       - name: Build FW
         run: ${{ env.RUN }} "scons -j$(nproc)"
-      - name: tests/misra/install.sh
-        run: ${{ env.RUN }} "cd tests/misra && ./install.sh"
       - name: MISRA mutation tests
         run: ${{ env.RUN }} "cd tests/misra && pytest test_mutation.py"
diff --git a/.github/workflows/update-cppcheck.yml b/.github/workflows/update-cppcheck.yml
deleted file mode 100644
index 5fd4a51e..00000000
--- a/.github/workflows/update-cppcheck.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Update cppcheck
-
-on:
-  #push:
-  schedule:
-    - cron: "0 14 * * 1" # every Monday at 2am UTC (6am PST)
-  workflow_dispatch:
-
-jobs:
-  update-cppcheck:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
-      - name: Get latest cppcheck version
-        id: version
-        run: |
-          # Tags are sorted by time (newest first), so get the first version-like tag
-          LATEST=$(curl -fsSL "https://api.github.com/repos/danmar/cppcheck/tags?per_page=20" | \
-            jq -r '.[].name' | \
-            grep -E '^[0-9]+\.[0-9]+(\.[0-9]+)?$' | \
-            head -n 1)
-          echo "vers=$LATEST" >> "$GITHUB_OUTPUT"
-      - name: Update VERS in install.sh
-        run: |
-          sed -i "s/^VERS=\".*\"/VERS=\"${{ steps.version.outputs.vers }}\"/" tests/misra/install.sh
-          grep VERS tests/misra/install.sh
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83
-        with:
-          author: Vehicle Researcher <user@comma.ai>
-          token: ${{ secrets.ACTIONS_CREATE_PR_PAT }}
-          commit-message: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
-          title: "[bot] Update cppcheck to ${{ steps.version.outputs.vers }}"
-          body: "See all cppcheck releases: https://github.com/danmar/cppcheck/releases"
-          branch: "update-cppcheck"
-          base: "master"
-          delete-branch: true
-          labels: bot
diff --git a/pyproject.toml b/pyproject.toml
index ed9d8203..1af5798a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -31,6 +31,7 @@ dev = [
   "setuptools",
   "spidev; platform_system == 'Linux'",
   "gcc-arm-none-eabi @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=gcc-arm-none-eabi",
+  "cppcheck @ git+https://github.com/commaai/dependencies.git@releases#subdirectory=cppcheck",
 ]
 
 [build-system]
diff --git a/tests/misra/install.sh b/tests/misra/install.sh
deleted file mode 100755
index 9c8fd385..00000000
--- a/tests/misra/install.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-: "${CPPCHECK_DIR:=$DIR/cppcheck/}"
-
-if [ ! -d "$CPPCHECK_DIR" ]; then
-  git clone https://github.com/danmar/cppcheck.git $CPPCHECK_DIR
-fi
-
-cd $CPPCHECK_DIR
-
-VERS="2.16.0"
-git fetch --all --tags --force
-git checkout $VERS
-
-#make clean
-make MATCHCOMPILTER=yes CXXFLAGS="-O2" -j8
diff --git a/tests/misra/test_misra.sh b/tests/misra/test_misra.sh
index d7b9c6ef..5d59c1a3 100755
--- a/tests/misra/test_misra.sh
+++ b/tests/misra/test_misra.sh
@@ -10,12 +10,7 @@ YELLOW="\e[1;33m"
 RED="\e[1;31m"
 NC='\033[0m'
 
-: "${CPPCHECK_DIR:=$DIR/cppcheck/}"
-
-# install cppcheck if missing
-if [ -z "${SKIP_CPPCHECK_INSTALL}" ]; then
-  $DIR/install.sh
-fi
+: "${CPPCHECK_DIR:=$(python3 -c "import cppcheck; print(cppcheck.DIR)")}"
 
 # ensure checked in coverage table is up to date
 cd $DIR