Test ci_cuda_example against a CUDA version matrix at C++20 (#3907)

The ci_cuda_example job compiled against the json-ci image's CUDA
11.0 toolkit at cuda_std_11, which cannot exercise #3907 (a c++20
parse error in iteration_proxy.hpp's enable_borrowed_range reported
under nvcc). Switch the job to pull official nvidia/cuda devel images
directly and matrix across CUDA 11.8-12.6 at cuda_std_20 so CI can
empirically confirm which versions are actually affected before any
source-level fix is attempted.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
     groups:
       codeql-action:
         patterns:
@@ -13,23 +15,33 @@ updates:
     directory: /docs/mkdocs
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/astyle
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/generate_natvis
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/serve_header
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /cmake/requirements
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7

.github/workflows/semgrep.yml

@@ -49,7 +49,7 @@ jobs:
       # SEMGREP_APP_TOKEN is still passed through so registry auth works if a
       # token is ever added.
       - name: Install Semgrep
-        run: python3 -m pip install --user semgrep
+        run: python3 -m pip install --user semgrep==1.168.0
 
       # `semgrep scan --sarif` always exits 0 even with findings; continue-on-error
       # is a safety net so the SARIF upload still runs if the scan itself errors.

.github/workflows/ubuntu.yml

@@ -234,11 +234,20 @@ jobs:
 
   ci_cuda_example:
     runs-on: ubuntu-latest
-    container: ghcr.io/nlohmann/json-ci:v2.4.0
+    strategy:
+      fail-fast: false
+      matrix:
+        # matrix to empirically pin down which nvcc/CUDA versions reproduce #3907
+        # (a c++20 parse error in iteration_proxy.hpp's enable_borrowed_range) before
+        # attempting a source-level fix; 11.8 predates CUDA's C++20 support entirely.
+        cuda: ['11.8.0', '12.0.1', '12.1.1', '12.2.2', '12.3.2', '12.4.1', '12.5.1', '12.6.3']
+    container: nvidia/cuda:${{ matrix.cuda }}-devel-ubuntu22.04
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build

cmake/ci.cmake

@@ -669,7 +669,6 @@ add_custom_target(ci_test_compiler_default
 add_custom_target(ci_cuda_example
     COMMAND ${CMAKE_COMMAND}
         -DCMAKE_BUILD_TYPE=Debug -GNinja
-        -DCMAKE_CUDA_HOST_COMPILER=g++-8
         -S${PROJECT_SOURCE_DIR}/tests/cuda_example -B${PROJECT_BINARY_DIR}/build_cuda_example
     COMMAND ${CMAKE_COMMAND} --build ${PROJECT_BINARY_DIR}/build_cuda_example
 )

tests/cuda_example/CMakeLists.txt

@@ -3,7 +3,7 @@ project(json_cuda LANGUAGES CUDA)
 
 add_executable(json_cuda json_cuda.cu)
 target_include_directories(json_cuda PRIVATE ../../include)
-target_compile_features(json_cuda PUBLIC cuda_std_11)
+target_compile_features(json_cuda PUBLIC cuda_std_20)
 set_target_properties(json_cuda PROPERTIES
     CUDA_EXTENSIONS OFF
     CUDA_STANDARD_REQUIRED ON

tests/src/unit-algorithms.cpp

@@ -232,6 +232,9 @@ TEST_CASE("algorithms")
             // only the first four elements are expected to be sorted, the rest are
             // unspecified by the standard
             const json expected({nullptr, false, true, 3});
+            // std::equal below only bounds-checks the first range; assert the
+            // second range is at least as long to rule out an over-read (CWE-126)
+            CHECK(std::distance(begin(expected), end(expected)) >= 4);
             CHECK(std::equal(j.begin(), j.begin() + 4, begin(expected)));
         }
     }