ci-linux-coverity.yml

name: CI Linux Coverity

on:
  push:
    branches:
      - master
    paths:
      - 'include/sys/*'
      - 'src/common/*'
      - 'src/linux/*'
      - 'test/*'
      - '.github/workflows/ci-linux-coverity.yml'
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  linux-build-and-test:
    if: github.repository == 'mheily/libkqueue'
    timeout-minutes: 10
    strategy:
      fail-fast: false
    runs-on: ubuntu-24.04
    name: "ci-linux-coverity"
    steps:
    - uses: actions/checkout@v5

    - name: Install build deps
      run: |
        sudo apt-get install -y \
          build-essential \
          devscripts \
          fakeroot \
          gridsite-clients

    - name: Set environment
      run: |
        sudo apt-get install -y --no-install-recommends curl gpg lsb-release
        MYREL="`lsb_release -c | grep ^Codename | awk '{print $2}'`"
        echo "CLANG_VER=20" >> ${GITHUB_ENV}
        echo "MYREL=${MYREL}" >> ${GITHUB_ENV}

    - name: Add llvm source
      uses: myci-actions/add-deb-repo@10
      with:
        repo: deb http://apt.llvm.org/${{ env.MYREL }}/ llvm-toolchain-${{ env.MYREL }}-${{ env.CLANG_VER }} main
        repo-name: llvm-toolchain
        keys-asc: https://apt.llvm.org/llvm-snapshot.gpg.key

    # Coverity's download endpoint 404s when the project is unpublished or
    # the token is missing/rotated.  Treat that as "scan unavailable" and
    # skip the rest of the job (it stays green) instead of failing the run.
    - name: Download coverity tool MD5
      id: coverity-md5
      run: |
        if wget https://scan.coverity.com/download/linux64 \
          --post-data "token=${TOKEN}&project=`urlencode ${GITHUB_REPOSITORY}`&md5=1" \
          -O coverity_tool.tar.gz.md5 && [ -s coverity_tool.tar.gz.md5 ]; then
          echo "available=true" >> "$GITHUB_OUTPUT"
        else
          echo "available=false" >> "$GITHUB_OUTPUT"
          echo "::warning::Coverity tool download failed; skipping scan"
        fi
      env:
        TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}

    - name: Cache coverity tool
      if: ${{ steps.coverity-md5.outputs.available == 'true' }}
      uses: actions/cache@v4
      id: cache-coverity
      with:
        path: coverity_tool.tar.gz
        key: coverity-tool-cache-${{ hashFiles('coverity_tool.tar.gz.md5') }}

    - name: Download coverity tool
      if: ${{ steps.coverity-md5.outputs.available == 'true' && steps.cache-coverity.outputs.cache-hit != 'true' }}
      run: |
        wget https://scan.coverity.com/download/linux64 \
          --post-data "token=${TOKEN}&project=`urlencode ${GITHUB_REPOSITORY}`" \
          -O coverity_tool.tar.gz
      env:
        TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}

    - name: Extract coverity tool
      if: ${{ steps.coverity-md5.outputs.available == 'true' }}
      run: |
        mkdir coverity_tool
        tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool

    - name: Install LLVM ${{ env.CLANG_VER }}
      if: ${{ steps.coverity-md5.outputs.available == 'true' }}
      run: |
        sudo apt-get install -y --no-install-recommends clang-${{ env.CLANG_VER }} llvm-${{ env.CLANG_VER }} libclang-rt-${{ env.CLANG_VER }}-dev
        sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${{ env.CLANG_VER }} 60 && sudo update-alternatives --set clang /usr/bin/clang-${{ env.CLANG_VER }}
        sudo update-alternatives --install /usr/bin/llvm-symbolizer llvm-symbolizer /usr/bin/llvm-symbolizer-${{ env.CLANG_VER }} 60 && sudo update-alternatives --set llvm-symbolizer /usr/bin/llvm-symbolizer-${{ env.CLANG_VER }}

    - name: Configure build system
      if: ${{ steps.coverity-md5.outputs.available == 'true' }}
      run: |
        cmake . -G "Unix Makefiles" \
          -DCMAKE_INSTALL_PREFIX="/usr" \
          -DCMAKE_INSTALL_LIBDIR="lib"  \
          -DCMAKE_VERBOSE_MAKEFILE:BOOL="ON" \
          -DENABLE_TESTING="YES" \
          -DCMAKE_BUILD_TYPE="Debug"

    - name: Build libkqueue
      if: ${{ steps.coverity-md5.outputs.available == 'true' }}
      run: |
        export PATH=`pwd`/coverity_tool/bin:$PATH
        export CC=clang
        cov-configure --template --compiler clang --comptype clangcc
        cov-build --dir cov-int make

    - name: Display build result
      if: ${{ steps.coverity-md5.outputs.available == 'true' }}
      run: |
        cat /home/runner/work/libkqueue/libkqueue/cov-int/build-log.txt

    - name: Submit result
      if: ${{ steps.coverity-md5.outputs.available == 'true' }}
      run: |
        tar czf cov-int.tar.gz cov-int
        curl \
          --form token="$TOKEN" \
          --form email="a.cudbardb@freeradius.org" \
          --form file=@cov-int.tar.gz \
          --form version="`grep LIBKQUEUE_VERSION_STRING version.h | cut -w -f 3 | sed -e 's/"//g'`" \
          --form description="${GITHUB_REPOSITORY}" \
          https://scan.coverity.com/builds?project=`urlencode ${GITHUB_REPOSITORY}`
      env:
        TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}