As suggested by @errordeveloper in #11936 (comment), we should package checkpatch inside an image, and avoid keeping it in Cilium's repo as a huge script that is not written in any of the language that are common to the project, or otherwise directly related to Cilium's sources. Instead, it would be a concern of the image-tools repo to either download on image build, or have it checked in (if really needed).

In this repo (and possibly other repos), it could be consumed like this:

      - uses: actions/checkout@v1
      - uses: docker://docker.io/cilium/checkpatch:3e2ea4f151593908c362307a1de22e68610d955c
        name: Run checkpatch.pl

And in a Makefile:

checkpatch:
	@$(ECHO_CHECK) "(checkpatch)"
	$(QUIET) docker run <args> docker.io/cilium/checkpatch:3e2ea4f151593908c362307a1de22e68610d955c

Once the image is added to the cilium/image-tools repo, we can remove the script from the current repository.

Packing it in Docker would also allow us to keep the upstream checkpatch.pl (from Linux) but to apply custom patches when building the image. Here's a list of items we might want to fix (feel free to add to the list):

• Ignore C99-style comments for SPDX tags (see constchecker: check constants between Go/BPF #12436 (comment)).
• Allow single style for starting comment blocks (net/ style or rest-of-kernel style).
• Warn on possibly missing updates for CODEOWNERS instead of MAINTAINERS file.
• Ignore false positives on Signed-off-by: tags (checkpatch expects name/email to be exactly the same as the patch sender, but we don't care if there's a mismatch because of diminutives, case variation, etc.)
• Ignore upstream commit line in backports (see #13688's checkpatch run).

It would also be nice to add some documentation to Cilium about the checkpatch checks and how to deal with them (what can be ignored - if any after we remove the false positives, what should be fixed, etc.)