Skip to content

Commit 004415a

Browse files
dmytroyedmytroye
authored
[ITEP-71370] Automate Coverity for C/C++ (#229)
Automate Coverity for C/C++
1 parent ff95e1b commit 004415a

File tree

3 files changed

+173
-0
lines changed

3 files changed

+173
-0
lines changed

‎.github/resources/coverity-requirements.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
# This file is licensed under Apache 2.0 License.
4+
5+
pip == 25.1.1
6+
setuptools == 75.0.0
7+
wheel == 0.42.0
8+
pybind11 == 2.12.0

‎.github/workflows/coverity.yml

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
---
2+
# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: "[Code Analysis] Coverity (C/C++)"
6+
run-name: "[Code Analysis] Coverity (C/C++)"
7+
8+
on:
9+
workflow_call: {}
10+
workflow_dispatch: {}
11+
pull_request:
12+
branches:
13+
- main
14+
- release-*
15+
types:
16+
- opened
17+
- synchronize
18+
- reopened
19+
push:
20+
branches:
21+
- main
22+
23+
# Trigger workflow when enqueued to a merge group
24+
# (must be under 'on')
25+
merge_group: {}
26+
27+
permissions: {}
28+
29+
# Only run at most 1 workflow concurrently per PR or per branch to keep costs down
30+
concurrency:
31+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
32+
cancel-in-progress: true
33+
34+
jobs:
35+
detect-languages:
36+
name: "Detect Changed Languages (C/C++)"
37+
runs-on: ubuntu-latest
38+
permissions:
39+
contents: read
40+
outputs:
41+
run-analysis: ${{ steps.detect-langs.outputs.run-analysis }}
42+
steps:
43+
- name: "Checkout code"
44+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
45+
with:
46+
persist-credentials: false
47+
fetch-depth: 0 # Fetch all history for accurate diff
48+
49+
- name: "Detect changed languages"
50+
id: detect-langs
51+
run: |
52+
if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
53+
echo "Manual dispatch: always run analysis."
54+
echo "run-analysis=true" >> $GITHUB_OUTPUT
55+
exit 0
56+
else
57+
if [ "$(git rev-parse --abbrev-ref HEAD)" != "main" ]; then
58+
git fetch origin main:main
59+
echo "Fetched main branch"
60+
fi
61+
if [ -z "$GITHUB_SHA" ]; then
62+
echo "Error: GITHUB_SHA is not set or empty."
63+
exit 1
64+
fi
65+
changed_files=$(git diff --name-only main...$GITHUB_SHA -- '*.h' '*.hpp' '*.c' '*.cpp')
66+
if [ $? -ne 0 ]; then
67+
echo "Error: git diff command failed."
68+
exit 1
69+
fi
70+
echo "Performed git diff"
71+
if [ -z "$changed_files" ]; then
72+
echo "No relevant changed files detected."
73+
echo "run-analysis=false" >> $GITHUB_OUTPUT
74+
exit 0
75+
else
76+
run_analysis=true
77+
fi
78+
echo "Changed files:"
79+
echo "$changed_files"
80+
echo "Run analysis:"
81+
echo "$run_analysis"
82+
echo "run-analysis=$run_analysis" >> $GITHUB_OUTPUT
83+
fi
84+
85+
coverity-scan:
86+
name: "Coverity Scan"
87+
needs: detect-languages
88+
if: ${{ needs.detect-languages.outputs.run-analysis == 'true' }}
89+
runs-on: ubuntu-latest
90+
permissions:
91+
contents: read
92+
steps:
93+
- name: "Checkout code"
94+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
95+
with:
96+
persist-credentials: false
97+
fetch-depth: 0
98+
99+
- name: "Setup dependencies"
100+
run: |
101+
sudo apt-get update
102+
sudo apt-get install -y --no-install-recommends cmake curl g++ git libeigen3-dev libgtest-dev make \
103+
pkg-config python3-dev pybind11-dev python3-pip python3-scipy python-is-python3 libopencv-dev python3-venv
104+
pip3 install --use-pep517 -r .github/resources/coverity-requirements.txt
105+
106+
- name: "Download Coverity Scan Tool"
107+
run: |
108+
wget --quiet https://scan.coverity.com/download/linux64 \
109+
--post-data "token=${{ secrets.COVERITY_TOKEN }}&project=${{ secrets.COVERITY_PROJECT }}" \
110+
-O coverity_tool.tgz
111+
mkdir coverity
112+
tar xzf coverity_tool.tgz --strip-components=1 -C coverity
113+
114+
- name: "Add Coverity to PATH"
115+
run: |
116+
echo "$PWD/coverity/bin" >> $GITHUB_PATH
117+
118+
- name: "Show Coverity version"
119+
run: |
120+
coverity --version
121+
122+
- name: "Run Coverity build"
123+
run: |
124+
cov-build --dir cov-int make build-coverity
125+
126+
- name: "Create Coverity results tarball"
127+
run: |
128+
tar czf coverity-output.tgz -C cov-int .
129+
130+
- name: "Print Coverity build log"
131+
if: always()
132+
run: |
133+
echo "Coverity results:"
134+
cat cov-int/build-log.txt
135+
136+
- name: Upload to Coverity Scan
137+
run: |
138+
curl --form token=${{ secrets.COVERITY_TOKEN }} \
139+
--form email=${{ secrets.COVERITY_EMAIL }} \
140+
--form [email protected] \
141+
--form version="`date +%Y%m%d%H%M%S`" \
142+
--form description="GitHub Action upload" \
143+
https://scan.coverity.com/builds?project=${{ secrets.COVERITY_PROJECT }}
144+
145+
- name: Upload coverity results
146+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
147+
with:
148+
name: coverity-results-${{ github.run_id }}
149+
path: ./coverity-output.tgz
150+
151+
- name: "Clean runner"
152+
if: always()
153+
run: |
154+
if [ -n "$GITHUB_WORKSPACE" ] && [ -d "$GITHUB_WORKSPACE" ]; then
155+
find "$GITHUB_WORKSPACE" -type f -exec chmod u+rw {} \;
156+
find "$GITHUB_WORKSPACE" -mindepth 1 -delete
157+
else
158+
echo "Error: GITHUB_WORKSPACE is not set or is not a directory" >&2
159+
exit 1
160+
fi

‎Makefile

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,11 @@ prettier-write:
397397
add-licensing:
398398
@reuse annotate --template template $(ADDITIONAL_LICENSING_ARGS) --merge-copyrights --copyright-prefix="spdx-c" --copyright="Intel Corporation" --license="Apache-2.0" $(FILE) || (echo "Adding license failed" && exit 1)
399399

400+
# =========================== Coverity ==============================
401+
.PHONY: build-coverity
402+
build-coverity:
403+
@make -C scene_common/src/fast_geometry/ || (echo "scene_common/fast_geometry build failed" && exit 1)
404+
@export OpenCV_DIR=$${OpenCV_DIR:-$$(pkg-config --variable=pc_path opencv4 | cut -d':' -f1)} && cd controller/src/robot_vision && python3 setup.py bdist_wheel || (echo "robot vision build failed" && exit 1)
400405
# ===================== Docker Compose Demo ==========================
401406

402407
.PHONY: init-sample-data

0 commit comments

Comments
 (0)