RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
haproxy/.github/workflows/coverity.yml

50 lines
1.9 KiB
YAML
Raw Normal View History

CI: GitHub Actions: enable daily Coverity scan That scan was previously implemented on Travis. Let us migrate it to GitHub Actions. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2020-12-25 18:36:52 +00:00
#
# scan results: https://scan.coverity.com/projects/haproxy
#
name: Coverity
on:
schedule:
- cron: "0 0 * * *"
CI: Add `permissions` to GitHub Actions This change locks down the permissions of the access token in GitHub Actions to only allow reading the repository contents and nothing else. see https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
2021-10-16 16:10:26 +00:00
permissions:
contents: read
CI: GitHub Actions: enable daily Coverity scan That scan was previously implemented on Travis. Let us migrate it to GitHub Actions. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2020-12-25 18:36:52 +00:00
jobs:
scan:
runs-on: ubuntu-latest
if: ${{ github.repository_owner == 'haproxy' }}
steps:
CI: Update to actions/checkout@v4 No functional change, but we should keep this current. see 5f4ddb54b05ae0355b1f64c22263a6bc381410df
2023-09-06 14:57:29 +00:00
- uses: actions/checkout@v4
CI: GitHub Actions: enable daily Coverity scan That scan was previously implemented on Travis. Let us migrate it to GitHub Actions. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2020-12-25 18:36:52 +00:00
- name: Install apt dependencies
run: |
CI: speedup apt package install we are fine to skip some repos like languages and translations. this drops number of repos twice
2024-05-31 15:04:14 +00:00
sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
CI: use "--no-install-recommends" for apt-get this reduces number of packages installed by 1
2024-05-29 19:59:14 +00:00
sudo apt-get --no-install-recommends -y install \
CI: switch to lua 5.4 current release is 5.4, let's switch to it
2024-05-29 19:59:15 +00:00
liblua5.4-dev \
CI: GitHub Actions: enable daily Coverity scan That scan was previously implemented on Travis. Let us migrate it to GitHub Actions. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2020-12-25 18:36:52 +00:00
libsystemd-dev
CI: enable QUIC for Coverity scan
2022-02-02 05:24:58 +00:00
- name: Install QUICTLS
run: |
QUICTLS=yes scripts/build-ssl.sh
CI: get rid of travis-ci wrapper for Coverity scan historically coverity scan was performed by travis-ci script, let us rewrite it in bash
2023-08-05 22:07:39 +00:00
- name: Download Coverity build tool
run: |
wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_SCAN_TOKEN }}&project=Haproxy" -O coverity_tool.tar.gz
mkdir coverity_tool
tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
CI: Fix the coverity builds In an attempt to fix the use of DEBUG_STRICT commit 7f0f4786d1927f1450392e871480e3122796024e unfortunately broke the Coverity builds completely. It turns out that Coverity does not properly handle quoting within `COVERITY_SCAN_BUILD_COMMAND`, instead breaking up single arguments at whitespace, thus passing `-DDEBUG_USE_ABORT=1` to `make` as-is. Fix this issue by hijacking the Makefile within the Coverity workflow. We simply replace the default value of the `DEBUG` option with whatever values we need. The build command now only includes the TARGET and USE_* flags, each of which works without any spaces.
2021-01-28 17:58:53 +00:00
- name: Build WURFL
CONTRIB: move src/wurfl.c and contrib/wurfl to addons/wurfl Both the source file and the dummy library are now at the same place. Maybe the build howto could be moved there as well to make things even cleaner. The Makefile, MAINTAINERS, doc, and vtest matrix were updated.
2021-04-02 14:39:44 +00:00
run: make -C addons/wurfl/dummy
CI: get rid of travis-ci wrapper for Coverity scan historically coverity scan was performed by travis-ci script, let us rewrite it in bash
2023-08-05 22:07:39 +00:00
- name: Build with Coverity build tool
run: |
export PATH=`pwd`/coverity_tool/bin:$PATH
cov-build --dir cov-int make CC=clang TARGET=linux-glibc USE_ZLIB=1 USE_PCRE=1 USE_PCRE_JIT=1 USE_LUA=1 USE_OPENSSL=1 USE_QUIC=1 USE_SYSTEMD=1 USE_WURFL=1 WURFL_INC=addons/wurfl/dummy WURFL_LIB=addons/wurfl/dummy USE_DEVICEATLAS=1 DEVICEATLAS_SRC=addons/deviceatlas/dummy USE_51DEGREES=1 51DEGREES_SRC=addons/51degrees/dummy/pattern ADDLIB=\"-Wl,-rpath,$HOME/opt/lib/\" SSL_LIB=${HOME}/opt/lib SSL_INC=${HOME}/opt/include DEBUG+=-DDEBUG_STRICT=1 DEBUG+=-DDEBUG_USE_ABORT=1
- name: Submit build result to Coverity Scan
CI: GitHub Actions: enable daily Coverity scan That scan was previously implemented on Travis. Let us migrate it to GitHub Actions. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2020-12-25 18:36:52 +00:00
run: |
CI: get rid of travis-ci wrapper for Coverity scan historically coverity scan was performed by travis-ci script, let us rewrite it in bash
2023-08-05 22:07:39 +00:00
tar czvf cov.tar.gz cov-int
curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \
--form email=chipitsine@gmail.com \
--form file=@cov.tar.gz \
--form version="Commit $GITHUB_SHA" \
--form description="Build submitted via CI" \
https://scan.coverity.com/builds?project=Haproxy