coverity.yml

name: Coverity Scan
on:
  workflow_dispatch: # run whenever a contributor calls it
  schedule:
    - cron: '48 5 * * *' # Run at 05:48
    # Coverity will let GRASS do a scan a maximum of twice per day, so this schedule will help GRASS fit within that limit with some additional space for manual runs
permissions:
  contents: read
  # action based off of https://github.com/OSGeo/PROJ/blob/905c9a6c2da3dc6b7aa2c89d3ab78d9d1a9cd070/.github/workflows/coverity-scan.yml
jobs:
  coverity:
    runs-on: ubuntu-22.04
    if: github.repository == 'OSGeo/grass'
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Get dependencies
        run: |
          sudo apt-get update -y
          sudo apt-get install -y wget git gawk findutils
          xargs -a <(awk '! /^ *(#|$)/' ".github/workflows/apt.txt") -r -- \
              sudo apt-get install -y --no-install-recommends --no-install-suggests
      - name: Create installation directory
        run: |
          mkdir $HOME/install
          
      - name: Download Coverity Build Tool
        run: |
          wget -q https://scan.coverity.com/download/cxx/linux64 --post-data "token=$TOKEN&project=grass" -O cov-analysis-linux64.tar.gz
          mkdir cov-analysis-linux64
          tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
        env:
          TOKEN: ${{ secrets.COVERITY_PASSPHRASE }}
      - name: Set number of cores for compilation
        run: |
          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV

      - name: Set LD_LIBRARY_PATH for compilation
        run: |
          echo "LD_LIBRARY_PATH=$HOME/install/lib" >> $GITHUB_ENV

      - name: Print build environment variables
        run: |
          printenv | sort
          gcc --version
          ldd --version
      - name: Build with cov-build
        env:
          CFLAGS: -fPIC -Wvla
          CXXFLAGS: -fPIC
        run: |
          pwd
          export PATH=`pwd`/cov-analysis-linux64/bin:$PATH
          cov-build --dir cov-int .github/workflows/build_ubuntu-22.04_without_x.sh $HOME/install
      - name: Submit to Coverity Scan
        run: |
          tar czvf grass.tgz cov-int
          curl \
            --form project=grass \
            --form token=$TOKEN \
            --form email=$EMAIL \
            --form file=@grass.tgz \
            --form version=main \
            --form description="`git rev-parse --abbrev-ref HEAD` `git rev-parse --short HEAD`" \
            https://scan.coverity.com/builds?project=grass
        env:
          TOKEN: ${{ secrets.COVERITY_PASSPHRASE }}
          EMAIL: ${{ secrets.COVERITY_USER }}