ci: unconditionally turn on -Werror

Closes: #971
Approved by: cgwalters

.papr.yml

@@ -14,7 +14,7 @@ packages:
 env:
     # Enable all the sanitizers for this primary build.
     # We only use -Werror=maybe-uninitialized here with a "fixed" toolchain
-    CFLAGS: '-fsanitize=undefined -fsanitize-undefined-trap-on-error -fsanitize=address -O2 -Wp,-D_FORTIFY_SOURCE=2 -Werror=maybe-uninitialized'
+    CFLAGS: '-fsanitize=undefined -fsanitize-undefined-trap-on-error -fsanitize=address -O2 -Wp,-D_FORTIFY_SOURCE=2'
     # Only for CI with a known g-ir-scanner
     GI_SCANNERFLAGS: '--warn-error'
     ASAN_OPTIONS: 'detect_leaks=0'  # Right now we're not fully clean, but this gets us use-after-free etc

ci/build-check.sh

@@ -16,9 +16,9 @@ fi
 
 if test -x /usr/bin/clang; then
     git clean -dfx && git submodule foreach git clean -dfx
-    # And now a clang build to find unused variables; perhaps
-    # in the future these could parallelize
+    # And now a clang build to find unused variables because it does a better
+    # job than gcc for vars with cleanups; perhaps in the future these could
+    # parallelize
     export CC=clang
-    export CFLAGS='-Werror=unused-variable'
     build
 fi

ci/build.sh

@@ -12,6 +12,9 @@ pkg_install sudo which attr fuse \
     elfutils
 pkg_install_if_os fedora gjs gnome-desktop-testing parallel coccinelle clang
 
+# always fail on warnings; https://github.com/ostreedev/ostree/pull/971
+export CFLAGS="-Werror ${CFLAGS:-}"
+
 DETECTED_CONFIGOPTS=
 if test -x /usr/bin/gnome-desktop-testing-runner; then
     DETECTED_CONFIGOPTS="${DETECTED_CONFIGOPTS} --enable-installed-tests=exclusive"