StigCodeAnalyzerInstaller
Locates the stig-code-analyzer binary on the user's machine, materialising the embedded C++ source tree + building it on first use.
Published consumers extract META-INF/cpp/ and build locally against the PhASAR commit packaged in scripts/pins.env. A cache hit requires a success marker and the exact STIG/PhASAR binary identity. Sibling directories are irrelevant. Local consumers use the input-tracked composite producer and a separate installation; they never enter this lazy installer. Neither path uses timestamps as cache keys.
The contract is Kotlin-only (zero Gradle deps) — anyone with the JAR on classpath can call installAndResolve. The build assumes the OS toolchain (LLVM/Z3/clang/cmake) is installed (run scripts/setup.sh / stigInstallDeps); build-analyzer.sh fails with a clear pointer otherwise.
Functions
Public so callers (gradle, tests) can resolve the canonical binary path without going through installAndResolve (e.g. when they only need the path and the binary is expected to already exist).
No-arg overload for callers without a version in hand. Uses the same strict packaged version resolver as every Gradle plugin caller.
Resolves a built binary for version (used as the cache key + baked into the binary so stig-code-analyzer --version reports it). First-call latency is the PhASAR+analyzer build; later calls with the same version return the cached binary.
Installs the OS toolchain (LLVM/Z3/clang/cmake) by materialising the embedded source and running scripts/setup.sh (sudo dnf/apt). The package-install step, deliberately separate from the build so the build needs no sudo. Idempotent. Invoked by the stigInstallDeps task.
Canonical install dir. Exposed for diagnostic logging.
Local source builds cannot overwrite the published/pinned installation.
Extracts the embedded C++ source tree to a destination directory without building. Used by installAndResolve (before the build) and by tests that need the tree without paying the build cost.
The native payload, not the whole plugin JAR or report-resource classpath.
Resolves the analyzer produced by the composite build without allowing the JAR installer to replace it with a pinned build. The included :stig-code-analyzer:stigBuildLocalAnalyzer task is the producer; this method is its consuming postcondition.
Returns the concrete version baked into the analyzer JAR manifest.