FreeRTOS-Kernel/.github/workflows/coverity_scan.yml at a882b105263c1fe53b1386fe17cb8b3ec90a388c · aggarg/FreeRTOS-Kernel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: Coverity Scan
on:
  # Run on every commit to mainline
  push:
    branches: main
  # Allow manual running of the scan
  workflow_dispatch:

env:
  bashPass: \033[32;1mPASSED -
  bashInfo: \033[33;1mINFO -
  bashFail: \033[31;1mFAILED -
  bashEnd:  \033[0m

jobs:
  Coverity-Scan:
    if: ( github.repository == 'FreeRTOS/FreeRTOS-Kernel' )
    name: Coverity Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the Repository
        uses: actions/checkout@v4.1.1

      - env:
          stepName: Install Build Essentials
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          sudo apt-get -y update
          sudo apt-get -y install build-essential

          echo "::endgroup::"
          echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"

      - env:
          stepName: Install Coverity Build
          COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          wget -nv -q -O "$HOME/cov-analysis.tar.gz" https://scan.coverity.com/download/linux64 --post-data="token=${COVERITY_TOKEN}&project=FreeRTOS-Kernel"

          EXPECTED_MD5="e4418004b073140d67390cffba79c3b2"
          GENERATED_MD5=$(md5sum "$HOME/cov-analysis.tar.gz" | awk '{print $1}')

          if [ "$GENERATED_MD5" = "$EXPECTED_MD5" ]; then
            tar -zxf "$HOME/cov-analysis.tar.gz" --one-top-level=cov_scan -C "$HOME"
            echo "cov_scan_path=$HOME/cov_scan/bin" >> $GITHUB_ENV
            sudo rm -f "$HOME/cov-analysis.tar.gz"
            echo "::endgroup::"
            echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "
          else
            echo -e "${{ env.bashFail }} MD5 checksum verification failed for cov-analysis.tar.gz ${{ env.bashEnd }}"
            echo -e "${{ env.bashFail }} ${{ env.stepName }} ${{ env.bashEnd }}"
            exit -1
          fi

      - env:
          stepName: Coverity Build
          COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
          COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          export PATH="$PATH:${{env.cov_scan_path}}"
          cmake -S ./examples/cmake_example/ -B build
          cd build
          cov-build --dir cov-int make -j
          # Move the report out of the build directory
          tar czvf ../gcc_freertos_kernel_sample_build.tgz cov-int

          echo "::endgroup::"
          echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "

      - env:
          stepName: Upload Coverity Report for Scan
          COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
          COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          COV_SCAN_UPLOAD_STATUS=$(curl --form token=${COVERITY_TOKEN} \
            --form email=${COVERITY_EMAIL} \
            --form file=@gcc_freertos_kernel_sample_build.tgz \
            --form version="Mainline" \
            --form description="FreeRTOS Kernel Commit Scan" \
            https://scan.coverity.com/builds?project=FreeRTOS-Kernel)

          echo "::endgroup::"
          echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "
          echo "${COV_SCAN_UPLOAD_STATUS}" | grep -q -e 'Build successfully submitted' || echo >&2 "Error submitting build for analysis: ${COV_SCAN_UPLOAD_STATUS}"

      - env:
            stepName: Coverity Build for SMP FreeRTOS
            COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
            COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
            # ${{ env.stepName }}
            echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

            export PATH="$PATH:${{env.cov_scan_path}}"
            cmake -S ./examples/cmake_example/ -B build -DFREERTOS_SMP_EXAMPLE=1
            cd build
            cov-build --dir cov-int make -j
            # Move the report out of the build directory
            tar czvf ../gcc_freertos_kernel_smp_sample_build.tgz cov-int

            echo "::endgroup::"
            echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "

      - env:
            stepName: Upload FreeRTOS SMP Coverity Report for Scan
            COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
            COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
            # ${{ env.stepName }}
            echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

            COV_SCAN_UPLOAD_STATUS=$(curl --form token=${COVERITY_TOKEN} \
              --form email=${COVERITY_EMAIL} \
              --form file=@gcc_freertos_kernel_smp_sample_build.tgz \
              --form version="Mainline" \
              --form description="FreeRTOS Kernel SMP Commit Scan" \
              https://scan.coverity.com/builds?project=FreeRTOS-Kernel)

            echo "::endgroup::"
            echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "
            echo "${COV_SCAN_UPLOAD_STATUS}" | grep -q -e 'Build successfully submitted' || echo >&2 "Error submitting build for analysis: ${COV_SCAN_UPLOAD_STATUS}"