3 # This GitHub workflow automates submitting builds to Coverity Scan. To enable it,
4 # set the repository variable `ENABLE_COVERITY_SCAN_FOR_BRANCHES` (for details, see
5 # https://docs.github.com/en/actions/learn-github-actions/variables) to a JSON
6 # string array containing the names of the branches for which the workflow should be
7 # run, e.g. `["main", "next"]`.
9 # In addition, two repository secrets must be set (for details how to add secrets, see
10 # https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions):
11 # `COVERITY_SCAN_EMAIL` and `COVERITY_SCAN_TOKEN`. The former specifies the
12 # email to which the Coverity reports should be sent and the latter can be
13 # obtained from the Project Settings tab of the Coverity project).
15 # The workflow runs on `ubuntu-latest` by default. This can be overridden by setting
16 # the repository variable `ENABLE_COVERITY_SCAN_ON_OS` to a JSON string array specifying
17 # the operating systems, e.g. `["ubuntu-latest", "windows-latest"]`.
19 # By default, the builds are submitted to the Coverity project `git`. To override this,
20 # set the repository variable `COVERITY_PROJECT`.
31 if: contains(fromJSON(vars.ENABLE_COVERITY_SCAN_FOR_BRANCHES || '[""]'), github.ref_name)
34 os: ${{ fromJSON(vars.ENABLE_COVERITY_SCAN_ON_OS || '["ubuntu-latest"]') }}
35 runs-on: ${{ matrix.os }}
37 COVERITY_PROJECT: ${{ vars.COVERITY_PROJECT || 'git' }}
38 COVERITY_LANGUAGE: cxx
39 COVERITY_PLATFORM: overridden-below
41 - uses: actions/checkout@v3
42 - name: install minimal Git for Windows SDK
43 if: contains(matrix.os, 'windows')
44 uses: git-for-windows/setup-git-for-windows-sdk@v1
45 - run: ci/install-dependencies.sh
46 if: contains(matrix.os, 'ubuntu')
48 runs_on_pool: ${{ matrix.os }}
50 # The Coverity site says the tool is usually updated twice yearly, so the
51 # MD5 of download can be used to determine whether there's been an update.
52 - name: get the Coverity Build Tool hash
55 case "${{ matrix.os }}" in
57 COVERITY_PLATFORM=win64
58 COVERITY_TOOL_FILENAME=cov-analysis.zip
61 COVERITY_PLATFORM=linux64
62 COVERITY_TOOL_FILENAME=cov-analysis.tgz
65 echo '::error::unhandled OS ${{ matrix.os }}' >&2
69 echo "COVERITY_PLATFORM=$COVERITY_PLATFORM" >>$GITHUB_ENV
70 echo "COVERITY_TOOL_FILENAME=$COVERITY_TOOL_FILENAME" >>$GITHUB_ENV
71 MD5=$(curl https://scan.coverity.com/download/$COVERITY_LANGUAGE/$COVERITY_PLATFORM \
73 --form token='${{ secrets.COVERITY_SCAN_TOKEN }}' \
74 --form project="$COVERITY_PROJECT" \
76 echo "hash=$MD5" >>$GITHUB_OUTPUT
78 # Try to cache the tool to avoid downloading 1GB+ on every run.
79 # A cache miss will add ~30s to create, but a cache hit will save minutes.
80 - name: restore the Coverity Build Tool
82 uses: actions/cache/restore@v3
84 path: ${{ runner.temp }}/cov-analysis
85 key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }}
86 - name: download the Coverity Build Tool (${{ env.COVERITY_LANGUAGE }} / ${{ env.COVERITY_PLATFORM}})
87 if: steps.cache.outputs.cache-hit != 'true'
89 curl https://scan.coverity.com/download/$COVERITY_LANGUAGE/$COVERITY_PLATFORM \
90 --fail --no-progress-meter \
91 --output $RUNNER_TEMP/$COVERITY_TOOL_FILENAME \
92 --form token='${{ secrets.COVERITY_SCAN_TOKEN }}' \
93 --form project="$COVERITY_PROJECT"
94 - name: extract the Coverity Build Tool
95 if: steps.cache.outputs.cache-hit != 'true'
97 case "$COVERITY_TOOL_FILENAME" in
99 mkdir $RUNNER_TEMP/cov-analysis &&
100 tar -xzf $RUNNER_TEMP/$COVERITY_TOOL_FILENAME --strip 1 -C $RUNNER_TEMP/cov-analysis
104 mkdir cov-analysis-tmp &&
105 unzip -d cov-analysis-tmp $COVERITY_TOOL_FILENAME &&
106 mv cov-analysis-tmp/* cov-analysis
109 echo "::error::unhandled archive type: $COVERITY_TOOL_FILENAME" >&2
113 - name: cache the Coverity Build Tool
114 if: steps.cache.outputs.cache-hit != 'true'
115 uses: actions/cache/save@v3
117 path: ${{ runner.temp }}/cov-analysis
118 key: cov-build-${{ env.COVERITY_LANGUAGE }}-${{ env.COVERITY_PLATFORM }}-${{ steps.lookup.outputs.hash }}
119 - name: build with cov-build
121 export PATH="$RUNNER_TEMP/cov-analysis/bin:$PATH" &&
122 cov-configure --gcc &&
123 cov-build --dir cov-int make -j$(nproc)
124 - name: package the build
125 run: tar -czvf cov-int.tgz cov-int
126 - name: submit the build to Coverity Scan
130 --form token='${{ secrets.COVERITY_SCAN_TOKEN }}' \
131 --form email='${{ secrets.COVERITY_SCAN_EMAIL }}' \
132 --form file=@cov-int.tgz \
133 --form version='${{ github.sha }}' \
134 "https://scan.coverity.com/builds?project=$COVERITY_PROJECT"