FreeRTOS-Kernel/.github/workflows/coverity_scan.yml

name: Coverity Scan
on:
  # Run on every commit to mainline
  push:
    branches: main
  # Allow manual running of the scan
  workflow_dispatch:

env:
  bashPass: \033[32;1mPASSED -
  bashInfo: \033[33;1mINFO -
  bashFail: \033[31;1mFAILED -
  bashEnd:  \033[0m

jobs:
  Coverity-Scan:
    if: ( github.repository == 'FreeRTOS/FreeRTOS-Kernel' )
    name: Coverity Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the Repository
        uses: actions/checkout@v4.1.1

      - env:
          stepName: Install Build Essentials
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          sudo apt-get -y update
          sudo apt-get -y install build-essential

          echo "::endgroup::"
          echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }}"

      - env:
          stepName: Install Coverity Build
          COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          wget -nv -q -O "$HOME/cov-analysis.tar.gz" https://scan.coverity.com/download/linux64 --post-data="token=${COVERITY_TOKEN}&project=FreeRTOS-Kernel"
          
          EXPECTED_MD5="e4418004b073140d67390cffba79c3b2"
          GENERATED_MD5=$(md5sum "$HOME/cov-analysis.tar.gz" | awk '{print $1}')

          if [ "$GENERATED_MD5" = "$EXPECTED_MD5" ]; then
            tar -zxf "$HOME/cov-analysis.tar.gz" --one-top-level=cov_scan -C "$HOME"            
            echo "cov_scan_path=$HOME/cov_scan/bin" >> $GITHUB_ENV
            sudo rm -f "$HOME/cov-analysis.tar.gz"
            echo "::endgroup::"
            echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "
          else
            echo -e "${{ env.bashFail }} MD5 checksum verification failed for cov-analysis.tar.gz ${{ env.bashEnd }}"
            echo -e "${{ env.bashFail }} ${{ env.stepName }} ${{ env.bashEnd }}"
            exit -1            
          fi

      - env:
          stepName: Coverity Build
          COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
          COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          export PATH="$PATH:${{env.cov_scan_path}}"
          cmake -S ./examples/cmake_example/ -B build
          cd build
          cov-build --dir cov-int make -j
          # Move the report out of the build directory
          tar czvf ../gcc_freertos_kernel_sample_build.tgz cov-int

          echo "::endgroup::"
          echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "

      - env:
          stepName: Upload Coverity Report for Scan
          COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
          COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
          # ${{ env.stepName }}
          echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"

          COV_SCAN_UPLOAD_STATUS=$(curl --form token=${COVERITY_TOKEN} \
            --form email=${COVERITY_EMAIL} \
            --form file=@gcc_freertos_kernel_sample_build.tgz \
            --form version="Mainline" \
            --form description="FreeRTOS Kernel Commit Scan" \
            https://scan.coverity.com/builds?project=FreeRTOS-Kernel)

          echo "::endgroup::"
          echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "
          echo "${COV_SCAN_UPLOAD_STATUS}" | grep -q -e 'Build successfully submitted' || echo >&2 "Error submitting build for analysis: ${COV_SCAN_UPLOAD_STATUS}"

      - env:
            stepName: Coverity Build for SMP FreeRTOS
            COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
            COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
            # ${{ env.stepName }}
            echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
  
            export PATH="$PATH:${{env.cov_scan_path}}"
            cmake -S ./examples/cmake_example/ -B build -DFREERTOS_SMP_EXAMPLE=1
            cd build
            cov-build --dir cov-int make -j
            # Move the report out of the build directory
            tar czvf ../gcc_freertos_kernel_smp_sample_build.tgz cov-int
  
            echo "::endgroup::"
            echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "

      - env:
            stepName: Upload FreeRTOS SMP Coverity Report for Scan
            COVERITY_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
            COVERITY_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }}
        shell: bash
        run: |
            # ${{ env.stepName }}
            echo -e "::group::${{ env.bashInfo }} ${{ env.stepName }} ${{ env.bashEnd }}"
  
            COV_SCAN_UPLOAD_STATUS=$(curl --form token=${COVERITY_TOKEN} \
              --form email=${COVERITY_EMAIL} \
              --form file=@gcc_freertos_kernel_smp_sample_build.tgz \
              --form version="Mainline" \
              --form description="FreeRTOS Kernel SMP Commit Scan" \
              https://scan.coverity.com/builds?project=FreeRTOS-Kernel)
  
            echo "::endgroup::"
            echo -e "${{ env.bashPass }} ${{ env.stepName }} ${{ env.bashEnd }} "
            echo "${COV_SCAN_UPLOAD_STATUS}" | grep -q -e 'Build successfully submitted' || echo >&2 "Error submitting build for analysis: ${COV_SCAN_UPLOAD_STATUS}"