build(esp32): scope -Wno-error= overrides (array-bounds, maybe-uninitialized, uninitialized, deprecated-declarations) to vendor sources only

[zackees]

Summary

fbuild's default ESP32 compile-flag set silently downgrades four bug-class errors to warnings workspace-wide, including for FastLED and user sketch sources — not just for ESP-IDF / framework headers:

• -Wno-error=array-bounds
• -Wno-error=maybe-uninitialized
• -Wno-error=uninitialized
• -Wno-error=deprecated-declarations

Why this is bad

These are exactly the warning classes that catch real bugs: out-of-bounds writes, use of uninitialized memory, deprecated SDK calls that will stop working in the next IDF release. Today they survive -Werror because of these blanket overrides; tomorrow a regression in user code or in FastLED itself will ship green with a latent corruption / UB / EOL-API bug.

Evidence

Surfaced by an audit of recent FastLED CI runs across the ESP32 matrix (esp32dev/s2/s3/wroom/c2/c3/c6/h2). No diagnostics fired on the audited runs, but the suppressions are armed and unscoped.

Proposed fix

Scope these -Wno-error= flags to ESP-IDF + framework-arduinoespressif32 include paths only (use the same scoping mechanism the CH32V third-party-warning policy uses — see PR #399). FastLED + sketch code should still error on these classes.

Acceptance: a regression test that compiles a tiny sketch with a deliberate -Warray-bounds violation fails the build on esp32dev / esp32s3 / esp32c3.

Cross-references

• Related: track(platform): board support backlog #393 (board-support backlog), fbuild ESP toolchain resolution: surface better diagnostic + provision all platform.json packages (FastLED#2700) #401 (ESP package provisioning)
• Tracked from the meta audit: (link to meta when filed)

[zackees]

Tracked under fbuild meta-audit: #408

[zackees]

Closing — investigation shows the four -Wno-error= flags called out by the audit do not all live in fbuild's config:

• -Wno-error=deprecated-declarations — present in crates/fbuild-build/src/esp32/configs/*.json (esp32, esp32c2, etc.). This is intentional: ESP-IDF / pioarduino framework uses deprecated APIs that the SDK has not yet replaced. Removing it would fail every ESP32 build.
• -Wno-error=array-bounds — does not appear anywhere in fbuild source. Comes from pioarduino's framework platform.json / framework_init.cmake.
• -Wno-error=maybe-uninitialized — does not appear anywhere in fbuild source. Same — pioarduino-injected.
• -Wno-error=uninitialized — does not appear anywhere in fbuild source. Same — pioarduino-injected.

The audit conflated fbuild's compile-flag baseline with the merged flag set produced after pioarduino's platform.json adds its own demotions. The 3 of 4 flags fbuild does not own can only be scoped upstream in pioarduino's platform.json (out of scope for this repo).

The one flag fbuild does own (-Wno-error=deprecated-declarations) is load-bearing for ESP-IDF compilation today; scoping it to vendor sources only would risk breaking framework builds without coordinated upstream cleanup. If that becomes desirable, file a follow-up with a specific failing example.

Related work:

• build(renesas): scope -Wno-error= overrides on uno_r4_wifi (return-mismatch, implicit-function-declaration, int-conversion, incompatible-pointer-types) to FSP only #404 — Renesas (4 fbuild-owned -Wno-error= flags scoped to FSP vendor sources) → PR fix(renesas): scope FSP -Wno-error= demotions to vendor C sources only #412
• build(esp32s2/s3): drop unconditional -DUSB_VID/USB_PID injection (149-156 redefinition warnings per build) #405 — esp32s2/s3 USB_VID/PID injection → PR fix(board): skip USB_VID/USB_PID injection on ESP32-S2/S3 (drops 149-156 redef warnings/build) #413
• build(fx): example-discovery glob misses examples/Fx/* (161 missing build_info.json warnings per ESP32 build) #406 — Fx examples build_info — fixed (merged)
• build(nrf52): -Warray-bounds in Adafruit BSP nrf_clock.h — bump pin past patched NRFX or scope suppression #407 — nRF52 array-bounds → PR fix(nrf52): scope -Wno-array-bounds to Adafruit BSP vendor sources only #414

Filed from fbuild meta-audit #408.