add CodeQL, Trivy and Clippy checks

.github/workflows/basic.yml

@@ -66,6 +66,9 @@ jobs:
         git ls-files -z -- ':(glob)**/*.cpp' ':(glob)**/*.hpp' ':(glob)**/*.h' \
           | xargs -0 --no-run-if-empty clang-format --dry-run --Werror
 
+    - name: Run Clippy
+      run: cargo clippy --workspace --all-targets -- -D warnings
+
     - name: Build
       run: cargo build --verbose
 
@@ -102,6 +105,21 @@ jobs:
         name: documentation
         path: target/doc
 
+  trivy:
+    name: Trivy scan
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Scan repository with Trivy
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      with:
+        scan-type: fs
+        scan-ref: .
+        scanners: vuln,secret,misconfig
+        exit-code: 1
+
   deploy-documentation:
     if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && inputs.deploy_documentation == 'true')
     needs: build-and-test

.github/workflows/codeql.yml

@@ -0,0 +1,74 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: "0 15 * * 0" # Every Sunday at 15:00 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: "Analyze (${{ matrix.language }})"
+    runs-on: ["oneapi-rs", "Linux"]
+
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: c-cpp
+            build-mode: manual
+          - language: rust
+            build-mode: none
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Check if oneAPI is already installed
+      id: check-oneapi
+      run: |
+        if [ -f /home/test-user/intel/oneapi/setvars.sh ]; then
+          echo "installed=true" >> $GITHUB_OUTPUT
+          source /home/test-user/intel/oneapi/setvars.sh
+          printenv | grep -E '^(PATH|LD_LIBRARY_PATH|LIBRARY_PATH|CPATH|C_INCLUDE_PATH|CPLUS_INCLUDE_PATH)=' >> $GITHUB_ENV
+        else
+          echo "installed=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Setup oneAPI
+      if: steps.check-oneapi.outputs.installed != 'true'
+      run: |
+        installer="intel-oneapi-toolkit-2026.1.0.192_offline.sh"
+        checksum="9d969de9cafbb698bf50f088c4b5174b50fc816f504049e685d6f6d198e10dbc17ef2cd4cfb0bc2b3d2179644a8d77d1"
+        curl --fail --location --retry 3 --silent --show-error --output "$installer" \
+          "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/33cb2a22-ddf1-4aa9-8d68-1f5a118acaf2/intel-oneapi-toolkit-2026.1.0.192_offline.sh"
+        echo "$checksum  $installer" | sha384sum --check
+        sh "./$installer" -a --silent --cli --eula accept
+
+        source /home/test-user/intel/oneapi/setvars.sh
+        printenv | grep -E '^(PATH|LD_LIBRARY_PATH|LIBRARY_PATH|CPATH|C_INCLUDE_PATH|CPLUS_INCLUDE_PATH)=' >> $GITHUB_ENV
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+
+    - name: Build
+      run: cargo build --verbose
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      with:
+        category: "/language:${{ matrix.language }}"

sycl/sycl-rs-sys/build.rs

@@ -54,7 +54,7 @@ fn main() {
         "include/kernel-bundle.hpp",
     ];
 
-    cxx_build::bridges(&rust_sources)
+    cxx_build::bridges(rust_sources)
         .compiler(&compiler_path)
         .flag("-fsycl")
         .files(&cpp_sources)

sycl/sycl-rs-sys/src/device.cpp

@@ -45,6 +45,8 @@ bool has(Device const &device, Aspect aspect) {
   switch (aspect) {
   case Aspect::ExtIntelPciAddress:
     return device.has(sycl::aspect::ext_intel_pci_address);
+  case Aspect::ExtOneapiIsIntegratedGpu:
+    return device.has(sycl::aspect::ext_oneapi_is_integrated_gpu);
   }
 
   return false;

sycl/sycl-rs-sys/src/event-sys.rs

@@ -10,6 +10,8 @@ use std::sync::{Arc, atomic::Ordering::Relaxed};
 
 use crate::types::SharedWaker;
 
+// WA for Clippy issue https://github.com/rust-lang/rust-clippy/issues/16317
+#[allow(clippy::missing_safety_doc)]
 #[cxx::bridge(namespace = "sycl_shims::event")]
 pub mod ffi {
     #[namespace = "sycl_shims"]
@@ -29,6 +31,10 @@ pub mod ffi {
 
         fn wait(event: &mut UniquePtr<Event>) -> Result<()>;
 
+        /// # Safety
+        ///
+        /// `waker` must come from `Arc::into_raw` and transfer one strong reference to the
+        /// callback, which will consume it after the event completes.
         unsafe fn register_callback(
             queue: &mut UniquePtr<Queue>,
             event: &Event,
@@ -41,12 +47,18 @@ pub mod ffi {
 
     extern "Rust" {
         type SharedWaker;
+        /// # Safety
+        ///
+        /// `ptr` must come from `Arc::into_raw` and represent a strong reference owned by this
+        /// callback.
         unsafe fn wake(ptr: *const SharedWaker);
     }
 }
 
-// Safety: SharedWaker must by a pointer created by Arc::into_raw. The caller must increment the
-// SharedWaker's strong reference count before calling.
+/// # Safety
+///
+/// SharedWaker must by a pointer created by Arc::into_raw. The caller must increment the
+/// SharedWaker's strong reference count before calling.
 unsafe fn wake(ptr: *const SharedWaker) {
     unsafe {
         (*ptr).done.store(true, Relaxed);

sycl/sycl-rs-sys/src/queue-sys.rs

@@ -6,6 +6,8 @@
 // SPDX-License-Identifier: MIT OR Apache-2.0
 //
 
+// WA for Clippy issue https://github.com/rust-lang/rust-clippy/issues/16317
+#[allow(clippy::missing_safety_doc)]
 #[cxx::bridge(namespace = "sycl_shims::queue")]
 pub mod ffi {
     #[namespace = "sycl_shims"]
@@ -44,6 +46,10 @@ pub mod ffi {
 
         fn clone(queue: &Queue) -> UniquePtr<Queue>;
 
+        /// # Safety
+        ///
+        /// `ptr` must be valid for writes of `num_bytes` bytes and remain valid until the
+        /// returned event completes. The memory must not be accessed concurrently.
         unsafe fn memset(
             queue: &mut UniquePtr<Queue>,
             ptr: *mut u8,
@@ -52,6 +58,11 @@ pub mod ffi {
             dep_events: Vec<EventPtr>,
         ) -> Result<UniquePtr<Event>>;
 
+        /// # Safety
+        ///
+        /// `src` and `dest` must be valid for reads and writes, respectively, of `num_bytes`
+        /// bytes and remain valid until the returned event completes. The regions must not
+        /// overlap or be accessed concurrently.
         unsafe fn memcpy(
             queue: &mut UniquePtr<Queue>,
             dest: *mut u8,
@@ -67,6 +78,10 @@ pub mod ffi {
 
         fn wait(queue: &mut UniquePtr<Queue>) -> Result<()>;
 
+        /// # Safety
+        ///
+        /// Each entry in `args` must match the corresponding kernel parameter's size, layout,
+        /// and alignment.
         unsafe fn launch_1d(
             queue: &mut UniquePtr<Queue>,
             global_size: Range1,
@@ -75,6 +90,10 @@ pub mod ffi {
             args: &[&[u8]],
         ) -> Result<UniquePtr<Event>>;
 
+        /// # Safety
+        ///
+        /// Each entry in `args` must match the corresponding kernel parameter's size, layout,
+        /// and alignment.
         unsafe fn launch_2d(
             queue: &mut UniquePtr<Queue>,
             global_size: Range2,
@@ -83,6 +102,10 @@ pub mod ffi {
             args: &[&[u8]],
         ) -> Result<UniquePtr<Event>>;
 
+        /// # Safety
+        ///
+        /// Each entry in `args` must match the corresponding kernel parameter's size, layout,
+        /// and alignment.
         unsafe fn launch_3d(
             queue: &mut UniquePtr<Queue>,
             global_size: Range3,

sycl/sycl-rs-sys/src/types-sys.rs

@@ -24,6 +24,12 @@ impl SharedWaker {
     }
 }
 
+impl Default for SharedWaker {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 #[cxx::bridge(namespace = "sycl_shims")]
 pub mod ffi {
     unsafe extern "C++" {
@@ -56,7 +62,10 @@ pub mod ffi {
 
     #[derive(Debug, Hash)]
     enum Aspect {
+        /// Indicates that the device supports the `PciBdfAddress` information descriptor.
         ExtIntelPciAddress,
+        /// Indicates that the implementation identifies this device as integrated GPU.
+        ExtOneapiIsIntegratedGpu,
     }
 
     #[derive(Debug, Hash)]

sycl/sycl-rs-sys/src/usm-sys.rs

@@ -6,6 +6,8 @@
 // SPDX-License-Identifier: MIT OR Apache-2.0
 //
 
+// WA for Clippy issue https://github.com/rust-lang/rust-clippy/issues/16317
+#[allow(clippy::missing_safety_doc)]
 #[cxx::bridge(namespace = "sycl_shims::usm")]
 pub mod ffi {
     unsafe extern "C++" {
@@ -15,21 +17,37 @@ pub mod ffi {
 
     extern "C++" {
         include!("sycl-rs-sys/include/usm.hpp");
+        /// # Safety
+        ///
+        /// `queue` must refer to a valid SYCL queue and `alignment` must be a supported power of
+        /// two. The returned allocation must be released with `free` using a compatible queue.
         unsafe fn aligned_alloc_device(
             alignment: usize,
             num_bytes: usize,
             queue: &Queue,
         ) -> Result<*mut u8>;
+        /// # Safety
+        ///
+        /// `queue` must refer to a valid SYCL queue and `alignment` must be a supported power of
+        /// two. The returned allocation must be released with `free` using a compatible queue.
         unsafe fn aligned_alloc_host(
             alignment: usize,
             num_bytes: usize,
             queue: &Queue,
         ) -> Result<*mut u8>;
+        /// # Safety
+        ///
+        /// `queue` must refer to a valid SYCL queue and `alignment` must be a supported power of
+        /// two. The returned allocation must be released with `free` using a compatible queue.
         unsafe fn aligned_alloc_shared(
             alignment: usize,
             num_bytes: usize,
             queue: &Queue,
         ) -> Result<*mut u8>;
+        /// # Safety
+        ///
+        /// `ptr` must be a live USM allocation associated with `queue` and must not be used after
+        /// this call.
         unsafe fn free(ptr: *mut u8, queue: &Queue);
     }
 }

sycl/sycl-rs/examples/kernel_launch.rs

@@ -37,7 +37,7 @@ async fn main() -> sycl_rs::Result<()> {
         queue.launch(
             NdRange::new([1024], [16]),
             &kernel,
-            (f16::from_f32(3.14), &mut device_array),
+            (f16::PI, &mut device_array),
         )
     }?
     .await?;

sycl/sycl-rs/examples/kernel_launch_derive.rs

@@ -42,7 +42,7 @@ fn main() -> sycl_rs::Result<()> {
             NdRange::new([1024], [16]),
             &kernel,
             IotaArgs {
-                start: 3.14_f32,
+                start: std::f32::consts::PI,
                 ptr: &mut array,
             },
         )

sycl/sycl-rs/examples/sycl-ls.rs

@@ -16,15 +16,22 @@ fn main() {
             let device_name = device.get_info::<info::device::Name>();
             let device_version = device.get_info::<info::device::Version>();
             let platform_version = platform.get_info::<info::platform::Version>();
+
             let pci_bdf_address = if device.has(Aspect::ExtIntelPciAddress) {
                 device.get_info::<info::device::PciBdfAddress>()
             } else {
                 String::from("N/A")
             };
 
+            let integrated_status = if device.has(Aspect::ExtOneapiIsIntegratedGpu) {
+                "Integrated "
+            } else {
+                ""
+            };
+
             println!(
-                "[{device_type:?}] {platform_name}, {device_name} {device_version} \
-                PCI:{pci_bdf_address} [{platform_version}]"
+                "[{integrated_status}{device_type:?}] {platform_name}, {device_name} \
+                {device_version} PCI:{pci_bdf_address} [{platform_version}]"
             );
         }
     }

sycl/sycl-rs/src/event.rs

@@ -60,7 +60,7 @@ impl Future for EventFuture {
         let this = self.project();
 
         // Set the callback on first Future poll (Futures can't be active until polled)
-        if *this.set_callback == false {
+        if !*this.set_callback {
             *this.set_callback = true;
             let mut queue = Queue::new_immediate();
             this.shared.waker.register(cx.waker());

sycl/sycl-rs/src/kernel.rs

@@ -51,12 +51,16 @@ impl From<cxx::UniquePtr<types::ffi::Kernel>> for Kernel {
 
 /// Types which can be passed as SYCL kernel arguments.
 ///
-/// Safety: a type implement this trait must mirror the representation and alignment of the
+/// # Safety
+///
+/// A type implementing this trait must mirror the representation and alignment of the
 /// corresponding SYCL kernel argument structure.
 pub unsafe trait KernelArgument {
     /// Converts self to a raw byte representation.
     ///
-    /// Safety: This function returns a reference to raw bytes. These bytes will be passed to FFI
+    /// # Safety
+    ///
+    /// This function returns a reference to raw bytes. These bytes will be passed to FFI
     /// functions. The caller must make sure these functions respect Rust's aliasing rules.
     unsafe fn as_raw_arg(&self) -> &[u8];
 }
@@ -69,12 +73,16 @@ unsafe impl<T: Pod> KernelArgument for T {
 
 /// Types which describe an argument list for a SYCL kernel.
 ///
-/// Safety: a type implement this trait must mirror the representation and alignment of each
+/// # Safety
+///
+/// A type implementing this trait must mirror the representation and alignment of each
 /// corresponding SYCL kernel argument inside the returned array.
 pub unsafe trait KernelArgumentList<const ARGC: usize> {
     /// Converts each struct member to a raw byte representation.
     ///
-    /// Safety: This function returns references to raw bytes. These bytes will be passed to FFI
+    /// # Safety
+    ///
+    /// This function returns references to raw bytes. These bytes will be passed to FFI
     /// functions. The caller must make sure these functions respect Rust's aliasing rules.
     unsafe fn as_raw_arg_list(&self) -> [&[u8]; ARGC];
 }