[mateuszCieslak-GL]

Reason for change.

• gcc diff-gate lists. The gate classes (they fail the job once ENFORCE is on) gain the four
  diagnostics gcc-14 turns into errors by default (-Wint-conversion,
  -Wimplicit-function-declaration, -Wimplicit-int, -Wincompatible-pointer-types): wrong call
  ABI and int/pointer confusion. build/linux/makefile.common silences three of them, which hides a
  backlog (431 implicit declarations, 14 incompatible pointer types on the bpi build); the gate
  keeps new code from adding to it. Plus -Wsizeof-pointer-memaccess and -Wformat-security. The
  warning list gains classes measured quiet over the tree (-Wunused-*, -Waddress,
  -Wstringop-*, -Warray-bounds, -Wdangling-pointer, -Wuse-after-free). (gcc-14's other two
  default errors have no gcc-13 flag; -Wreturn-type covers return mismatches, which are what
  actually breaks this build on gcc-14: 5 sites.)
• Only findings the PR introduces. The gate also compiles each changed file's base version and
  drops a changed-line finding the file already had (matched by class and message, not line), so a
  PR that edits a line calling an old undeclared function gets no ❌. The summary states how many
  were dropped (the job log lists them); they are never posted inline. A file the PR adds, or
  whose base version gcc cannot finish compiling (the summary names it), is judged on changed
  lines as before.
• Recompile at -Os, like the production build. The compile DB is -O0, which leaves the
  optimizer-dependent warnings silent. The recompile also removes the DB's own -Werror=<class>
  flags (a bare -Wno-error does not undo them) so no class can abort it, and drops C-only flags on
  C++ files.
• clang-tidy unreachable-code lane. clang-diagnostic-unreachable-code* is armed as a dead-code
  check. Its findings get their own ❗ block in the summary and annotations, never an inline comment
  (whether code is reachable can depend on the build configuration), and are dropped for a file that
  did not parse with its own flags.
• ci-lint follow-up (from RDKB-66207 : [CI] add ci-lint.yml, a conditional lint gate for the CI files #1506's review): the change detector only matches the paths each lane
  inspects; .yamllint states empty-values: disable explicitly; the ci-lint header no longer
  overstates what the pins guarantee.
• ci-README.md sections 3c and 3d and the gcc-14 / gcc-15 note updated; .clang-tidy header updated.

Unchanged on purpose: gate findings are still posted inline (❌) and listed in the CI summary, and
ENFORCE stays false.

Verification

• Ran the real clang-tidy and gcc diff-gate steps over a throwaway commit that adds a function with
  a VLA, an unused variable and unreachable code, to a built file and to a file outside the compile
  DB. New clang-tidy: one unreachable-code finding on the built file only, no inline candidate, the
  annotation present. New gcc gate: ❌ -Wvla and ❗ -Wunused-variable, both as inline candidates,
  and no recompile failure. The previous clang-tidy step reports none of the unreachable code.
• The recompile command built from the real compile DB entry of that file: its four -Werror=
  flags are gone, -Os is added (the entry has no -O), and each candidate is demoted.
• Replayed the gate over the 85 develop commits since 2026-07-20 that touched .c (each commit
  against its first parent, bpi compile DB, the lists above). Changed lines only: 7 commits would
  get a ❌. Counting only what the PR introduced: 4 commits, 9 findings, each a function newly
  called in that file without a prototype (incl. a misspelled wifi_hal_parse_rm_beaon_report).
  The rest were edits of lines the file already had findings for (old undeclared calls, a
  callback type mismatch already present). A PR that renames a struct member in a header while
  editing an old undeclared call (the base then compiles with errors) still gets only its new
  finding: checked with real gcc in a throwaway repo.
• Level-tagged warnings ([-Warray-bounds=]): the real gcc step over a throwaway commit drops
  the finding before this change and reports it (❗, summary and inline) after.
• ci-lint detector run over stubbed file lists: .github/release.yml or a .py outside .github
  no longer start a lane; workflows, actions, .yamllint, scripts, ruff.toml (incl. renamed away)
  still do; a truncated list lints everything.
• Locally with ci-lint's pinned tools: actionlint (project mode, shellcheck 0.9.0), yamllint, ruff,
  compileall clean; python3 -m unittest discover -s .github/scripts/tests: 21 OK. CI Lint and
  Build Check green on the PR head.

[Copilot]

🟡 Changes recommended

The GCC parser silently discards equals-suffixed diagnostic tags used by newly enabled warning classes.

1 open issue

• Handle GCC warning tags with equals suffix in diff gating · New

What changed in this PR

Prepares CI diagnostics for GCC 14 and production-level optimization, and adds advisory unreachable-code reporting.

Changes:

• Expands GCC warning coverage and recompiles at -Os without existing -Werror promotions.
• Reports unreachable code in summaries and annotations, excluding inline comments.
• Narrows CI lint triggers and updates tests and documentation.

File	Description
ci-README.md	Documents updated diagnostic behavior.
.github/​workflows/​makefile.yml	Expands GCC diagnostics and adds unreachable-code reporting.
.github/​workflows/​ci-lint.yml	Narrows triggers and clarifies pinning guarantees.
.github/​scripts/​tidy_to_inline.py	Excludes unreachable-code findings from inline comments.
.github/​scripts/​tests/​test_tidy_to_inline.py	Tests unreachable-code exclusion.
.github/​scripts/​tests/​test_gcc_diff_gate.py	Tests recompile command flags.
.github/​scripts/​gcc_diff_gate.py	Adds optimization and warning-flag handling.
.github/​.yamllint	Explicitly disables empty-value checks.
.clang-tidy	Updates comments describing diagnostic coverage.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain, and the changes preserve production builds and the existing advisory rollout.

1 open issue

• Handle GCC warning tags with equals suffix in diff gating

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain, the new filtering has focused tests, and GCC enforcement stays disabled during rollout.

1 open issue

• Handle GCC warning tags with equals suffix in diff gating

_{Review effort: Balanced}

[github-actions]

🔨 Build summary

Commit f18d971 · Build Check #5734

Banana Pi R4 - MLO — build success

⚠️ OneWifi warnings: 0

Raspberry Pi — build success

⚠️ OneWifi warnings: 0

---

🔬 Diff-scoped checks (changed lines only)

🔎 clang-tidy: no changed .c/.cpp to scan

🚦 gcc diff-gate: clean on changed lines