Use hermit to provide a (mostly) consistent build environment #2155

	# Static analysis of subzero CORE via clang static analyzer
	name: "Clang Static Analysis"

	on:
	push:
	branches: [master]
	pull_request:
	# The branches below must be a subset of the branches above
	branches: [master]
	schedule:
	# Daily at 2am
	- cron: '0 2 * * *'

	jobs:
	sacheck:
	name: "Clang Static Analysis"
	runs-on: ubuntu-latest
	defaults:
	run:
	shell: bash -euxo pipefail {0}

	strategy:
	fail-fast: false

	steps:
	- name: Checkout repository
	uses: actions/checkout@v2
	with:
	# We must fetch at least the immediate parents so that if this is
	# a pull request then we can checkout the head.
	fetch-depth: 2
	submodules: 'recursive'

	- name: Init Hermit
	uses: cashapp/activate-hermit@v1

	- name: Install clang and clang-tools
	run: \|
	sudo apt-get update
	sudo apt install clang clang-tools -y

	- name: Install python packages
	run: \|
	cd ${{ github.workspace }}
	pip install --upgrade pip
	pip install -r ./core/requirements.txt

	# Build CORE
	- name: Build Subzero Core
	run: \|
	cd ${{ github.workspace }}
	export CC=`which clang`
	export CXX=`which clang++`
	./scripts/build_core.sh

	# Run static analysis
	- name: Run clang static analysis
	run: scripts/sa_check_core.sh

Provide feedback