Skip to content

Commit c8546a3

Browse files
gooishingooishin
committed
add coverity scan
1 parent b353de3 commit c8546a3

File tree

1 file changed

+151
-0
lines changed

1 file changed

+151
-0
lines changed

‎.github/workflows/scan.yml

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,3 +269,154 @@ jobs:
269269
user: ${{ secrets.CI_USR }}
270270
password: ${{ secrets.CI_PWD }}
271271
path: '${{ env.STEP_PACKAGE_NAME }}'
272+
273+
coverity:
274+
name: Coverity
275+
needs: precheck
276+
if: needs.precheck.outputs.should_run == 'true'
277+
runs-on: [self-hosted, scan]
278+
env:
279+
# Notes:
280+
# - [required] please REPLACE with your own Coverity server URL
281+
COV_SERVER_URL: https://coverityent.devtools.intel.com/prod1
282+
# Notes:
283+
# - [required] please REPLACE with your own Coverity Project name
284+
COV_PROJECT_NAME: Edge Developer Kit Reference Script
285+
# Notes:
286+
# - [required] please REPLACE with your own Coverity Stream name
287+
COV_STREAM_NAME: devkit-main-stream
288+
COV_ANALYSIS_VERSION: 2024.6.1
289+
COV_REPORT_VERSION: 2024.6.1
290+
COV_AUTH_KEY_NAME: "coverity_auth_key"
291+
COV_REPORT_NAME: "coverity_report"
292+
COV_SECURITY_REPORT_NAME: "coverity_security_report"
293+
COV_CVSS_REPORT_NAME: "coverity_cvss_report"
294+
steps:
295+
- name: Checkout code
296+
uses: actions/checkout@v4
297+
298+
- name: Extract branch or commit ID
299+
id: extract_version
300+
run: |
301+
# Extract the branch name
302+
BRANCH_NAME=${GITHUB_REF#refs/heads/}
303+
# Check if the branch name is empty or not
304+
echo "BRANCH_NAME: ${BRANCH_NAME}"
305+
echo "GITHUB_SHA: ${GITHUB_SHA}"
306+
if [ -z "$BRANCH_NAME" ]; then
307+
# Use the commit ID if the branch name is not defined
308+
BRANCH_VERSION=${GITHUB_SHA}
309+
else
310+
# Use the branch name as the version
311+
BRANCH_VERSION=$BRANCH_NAME
312+
fi
313+
echo "Extracted version: $BRANCH_VERSION"
314+
echo "BRANCH_VERSION=$BRANCH_VERSION" >> $GITHUB_ENV
315+
# Notes:
316+
# - [info] release package must be in the directory
317+
# - [optional] customize this step for your own release package
318+
- name: Prepare release package
319+
run: |
320+
RLDIR="release_$(echo ${GITHUB_SHA:0:7})"
321+
echo "STEP_PACKAGE_NAME=${RLDIR}" >> $GITHUB_ENV
322+
mkdir -p ${RLDIR} && rsync -av --progress $(ls -I ${RLDIR}) ${RLDIR}/ \
323+
--exclude .git \
324+
--exclude .github \
325+
--exclude automation
326+
327+
- name: Setup Coverity
328+
uses: intel-innersource/frameworks.actions.setup-coverity@v4
329+
with:
330+
analysis-version: ${{ env.COV_ANALYSIS_VERSION }}
331+
reports-version: ${{ env.COV_REPORT_VERSION }}
332+
333+
- name: Execute Coverity Analysis
334+
uses: intel-innersource/frameworks.actions.coverity-analysis@v4
335+
id: cov-analysis
336+
with:
337+
compiler-type: |
338+
python
339+
source: '${{ env.STEP_PACKAGE_NAME }}'
340+
url: ${{ env.COV_SERVER_URL }}
341+
project: ${{ env.COV_PROJECT_NAME }}
342+
stream: ${{ env.COV_STREAM_NAME }}
343+
user: ${{ secrets.CI_USR }}
344+
password: ${{ secrets.CI_PWD }}
345+
346+
- name: Generate Coverity Report
347+
if: always()
348+
uses: intel-innersource/frameworks.actions.coverity-analysis/sdl-reports@v4
349+
with:
350+
snapshot: ${{steps.cov-analysis.outputs.snapshot}}
351+
url: ${{ env.COV_SERVER_URL }}
352+
project: ${{ env.COV_PROJECT_NAME }}
353+
project-version: ${{ env.BRANCH_VERSION }}
354+
cvss-report-name: CT39_${{ env.COV_CVSS_REPORT_NAME }}.pdf
355+
security-report-name: CT39_${{ env.COV_SECURITY_REPORT_NAME }}.pdf
356+
user: ${{ secrets.CI_USR }}
357+
password: ${{ secrets.CI_PWD }}
358+
359+
- name: Generate Coverity Report Summary
360+
id: cov-report-summary
361+
if: always()
362+
run: |
363+
export TEMP_COV_PASSWORD=${{ secrets.CI_PWD }}
364+
echo -e "\033[35mGenerating authentication key file - coverity_auth_key.txt\033[0m"
365+
EXPIRATION_TIME=$(date -u -d "30 minutes" +"%Y-%m-%dT%H:%M:%SZ")
366+
cov-manage-im \
367+
--mode auth-key \
368+
--create \
369+
--output-file ${{ env.COV_AUTH_KEY_NAME }}.txt \
370+
--set description:"ci_auth_key - ${{ env.BRANCH_VERSION }}" \
371+
--url ${{ env.COV_SERVER_URL }} \
372+
--user ${{ secrets.CI_USR }} \
373+
--password ${{ secrets.CI_PWD }} \
374+
--set expiration:"${EXPIRATION_TIME}"
375+
cat ${{ env.COV_AUTH_KEY_NAME }}.txt
376+
echo -e "\n\033[35mGenerating Coverity Security JSON Report - ${{ env.COV_SECURITY_REPORT_NAME }}.json\033[0m"
377+
export WRITE_ISSUES_JSON=${{ env.COV_SECURITY_REPORT_NAME }}.json
378+
cov-generate-security-report \
379+
../../_actions/intel-innersource/frameworks.actions.coverity-analysis/v4/templates/report_template.yml \
380+
--output ${{ env.COV_SECURITY_REPORT_NAME }}.pdf \
381+
--user ${{ secrets.CI_USR }} \
382+
--password env:TEMP_COV_PASSWORD
383+
echo -e "\033[35mGenerating Coverity CVSS JSON Report ${{ env.COV_CVSS_REPORT_NAME }}_summary.json\033[0m"
384+
export WRITE_ISSUES_JSON=${{ env.COV_CVSS_REPORT_NAME }}.json
385+
cov-generate-cvss-report \
386+
--report ../../_actions/intel-innersource/frameworks.actions.coverity-analysis/v4/templates/report_template.yml \
387+
--output ${{ env.COV_CVSS_REPORT_NAME }}.pdf \
388+
--user ${{ secrets.CI_USR }} \
389+
--password env:TEMP_COV_PASSWORD
390+
echo -e "\033[35mGenerating IPAS Security Report Summary - IPAS_${{ env.COV_SECURITY_REPORT_NAME }}_summary.html\033[0m"
391+
python3 ~/.ci/IPAS_Report.py \
392+
-i ${{ env.COV_SECURITY_REPORT_NAME }}.json \
393+
-t SECURITY \
394+
--details True \
395+
--version ${{ env.COV_ANALYSIS_VERSION }} \
396+
--output IPAS_${{ env.COV_SECURITY_REPORT_NAME }}_summary.html \
397+
--csv-file IPAS_${{ env.COV_SECURITY_REPORT_NAME }}_summary.csv \
398+
--auth-key-file ${{ env.COV_AUTH_KEY_NAME }}.txt
399+
echo -e "\033[35mGenerating IPAS CVSS Report Summary - IPAS_${{ env.COV_CVSS_REPORT_NAME }}_summary.html\033[0m"
400+
python3 ~/.ci/IPAS_Report.py \
401+
-i ${{ env.COV_CVSS_REPORT_NAME }}.json \
402+
-t CVSS \
403+
--details True \
404+
--version ${{ env.COV_ANALYSIS_VERSION }} \
405+
--output IPAS_${{ env.COV_CVSS_REPORT_NAME }}_summary.html \
406+
--csv-file IPAS_${{ env.COV_CVSS_REPORT_NAME }}_summary.csv \
407+
--auth-key-file ${{ env.COV_AUTH_KEY_NAME }}.txt
408+
ls -l
409+
- name: Upload artifacts
410+
if: ${{ always() && steps.cov-report-summary.outcome == 'success' }}
411+
uses: actions/upload-artifact@v4
412+
with:
413+
name: Coverity Report Summary
414+
path: |
415+
${{ env.COV_SECURITY_REPORT_NAME }}.json
416+
${{ env.COV_CVSS_REPORT_NAME }}.json
417+
${{ env.COV_SECURITY_REPORT_NAME }}.pdf
418+
${{ env.COV_CVSS_REPORT_NAME }}.pdf
419+
IPAS_${{ env.COV_SECURITY_REPORT_NAME }}_summary.html
420+
IPAS_${{ env.COV_SECURITY_REPORT_NAME }}_summary.csv
421+
IPAS_${{ env.COV_CVSS_REPORT_NAME }}_summary.html
422+
IPAS_${{ env.COV_CVSS_REPORT_NAME }}_summary.csv

0 commit comments

Comments
 (0)