[ci] warnings from cppcheck

Summary

Warnings caught by cppcheck should be resolved, if they are determined to be genuine issues and not false positives.

Motivation

cppcheck is a static analyzer for C++ code.

This tool can catch some classes of issues that are not caught by other linters or tests with sanitizers, and it does that using a lightweight approach that doesn't require compiling an instrumented version of the library.

See https://sourceforge.net/p/cppcheck/wiki/ListOfChecks/ for a full list of checks.

Description

Similar to the approach taken in LightGBM with cpplint (#1990) and mypy (#3867), for a time these checks might be run in continuous integration without blocking merges, just as extra information about the state of the code.

See http://cppcheck.sourceforge.net/ for instructions on how to install cppcheck on different operating systems.

LightGBM is a large, complex project and its codebase contains many possible combinations of #ifdef conditions. Each additional #ifdef adds another combination of things to try, which can slow down checking substantially and have a big impact on the amount of logs produced.

To ensure that cppcheck does not take too long and that you can see all of the logs after it's done, I recommend doing the following:

1. direct output to a file
2. remove the third-party libraries included as submodules in LightGBM before running this check
   • NOTE: you can restore these at any time with git submodulue init && git submodule update --recursive
3. undefine some preprocessor defines with -U to limit the number of combinations searched (you can always selectively remove these -U checks to do more thorough checks!)

rm -r ./external_libs

cppcheck \
    --force \
    --enable=all \
    --std=c++17 \
    -I include/ \
    -UDEBUG \
    -ULABEL_T_USE_DOUBLE \
    -ULGB_R_BUILD \
    -USCORE_T_USE_DOUBLE \
    -Usun \
    -U__sun \
    -U__SVR4 \
    -U__svr4__ \
    -UTIMETAG \
    -UUSE_CUDA \
    -UUSE_GPU \
    -UUSE_MPI \
    src/ \
> cppcheck.txt 2>&1

To generate a list of just lines with warnings, run the following:

# NOTE: the LGBM_ condition below handles the fact that functions in c_api.cpp are the public interface of the
#             shared library, so it's ok that they look "unused"
cat cppcheck.txt \
| grep -E '\[[a-zA-Z]+\]$' \
| grep -v -E 'LGBM_[A-Za-z]+.*is never used'

Piping that to wc -l will give you the number of warnings left.

How to Contribute

Look at the current list of warnings by running cppcheck yourself locally (following the steps in the "Description" section above).

Small pull requests focused on a single part of the codebase or type of cppcheck warning are greatly appreciated. Please do not submit a pull request that attempts to fix many of the cppcheck warnings all at once.

When submitting a pull request, include at least the following in the description:

• a link to this issue
• the logs of the specific warnings your pull request is intended to address

References

• http://cppcheck.sourceforge.net/
• https://sourceforge.net/p/cppcheck/wiki/ListOfChecks/
• https://github.com/danmar/cppcheck
• created this issue based on this conversation: https://github.com/microsoft/LightGBM/pull/4530#issuecomment-902399660