coverity.yml

---
name: Coverity Scan
permissions: read-all

on:

  workflow_dispatch:
    inputs:
      output_prefix:
        description: 'Prefix to add to output artifacts'
        required: false
        default: ''
        type: string
      os:
        description: 'Operating system'
        required: false
        default: 'linux'
        type: string
      extra_opts:
        description: 'Extra Coverity options'
        required: false
        default: ''
        type: string
      dependent_artifact:
        description: 'Name of artifact to treat as dependency'
        required: false
        default: ''
        type: string
      configure_options:
        description: 'Extra options for CMake configure stage'
        required: false
        default: ''
        type: string

  workflow_call:
    inputs:
      output_prefix:
        description: 'Prefix to add to output artifacts'
        required: false
        default: ''
        type: string
      os:
        description: 'Operating system'
        required: false
        default: 'linux'
        type: string
      extra_opts:
        description: 'Extra Coverity options'
        required: false
        default: ''
        type: string
      dependent_artifact:
        description: 'Name of artifact to treat as dependency'
        required: false
        default: ''
        type: string
      configure_options:
        description: 'Extra options for CMake configure stage'
        required: false
        default: ''
        type: string


jobs:
  scan:
    runs-on:
      - self-hosted
      - "${{ inputs.os }}"
      - "${{ inputs.os == 'Windows' && 'Coverity' || 'docker' }}"

    steps:

      - name: Cleanup workspace (Linux)
        if: always() && runner.os == 'Linux'
        run: sudo rm -rf ..?* .[!.]* *

      - name: Cleanup workspace (Windows)
        if: always() && runner.os == 'Windows'
        run: Remove-Item -Recurse -Force .\*

      - name: Checkout PR branch
        uses: actions/checkout@v4
        with:
          path: source

      - name: Download dependent artifact
        if: inputs.dependent_artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.dependent_artifact }}
          path: deps

      - name: Extract dependent artifact (Linux)
        if: inputs.dependent_artifact && runner.os == 'Linux'
        run: unzip deps/*.zip -d _deps

      - name: Extract dependent artifact (Windows)
        if: inputs.dependent_artifact && runner.os == 'Windows'
        run: Expand-Archive -Force -Path deps\*.zip -DestinationPath _deps

      - name: Install dependencies (Windows)
        if: always() && runner.os == 'Windows'
        shell: cmd
        run: |
          echo on

          call source\script\bootstrap.bat
          if %errorlevel% neq 0 exit /b %errorlevel%

      - name: Build vpl_build:ubuntu Docker image (Linux)
        if: success() && runner.os == 'Linux'
        run: |
          docker build "source/script" \
          -f "source/script/Dockerfile.ubuntu.build" \
          -t vpl_build:ubuntu

      - name: Build Docker image (Linux)
        if: success() && runner.os == 'Linux'
        run: |
          docker build "source/.github/workflows/coverity" \
          -f "source/.github/workflows/coverity/Dockerfile.ubuntu.coverity" \
          -t vpl_coverity:ubuntu \
          --build-arg \
          "COV_ANALYSIS_LINUX_URL=${{ vars.COV_ANALYSIS_LINUX_URL }}" \
          --build-arg \
          "COV_REPORTS_LINUX_URL=${{ vars.COV_REPORTS_LINUX_URL }}" \
          --build-arg "COV_LICENSE_URL=${{ vars.COV_LICENSE_URL }}"


      - name: Run Scan (Linux)
        if: success() && runner.os == 'Linux'
        run: |
          cat > source/auth_key.txt <<EOL
          ${{ secrets.COVERITY_AUTH_KEY }}
          EOL
          cat > action.sh <<EOL
          #!/bin/bash
          set -o errexit ; set -o nounset
          set -x
          deps_path="\$(realpath _deps)"
          pushd source
          export VERBOSE=1
          cmake -B _build \
          -DBUILD_TESTS=OFF \
          -DCMAKE_BUILD_TYPE=Release \
          -DCMAKE_INSTALL_LIBDIR=lib \
          -DCMAKE_PREFIX_PATH="\$deps_path" \
          ${{ inputs.configure_options }} \
          -DENABLE_WARNING_AS_ERROR=ON
          mkdir _reports
          REPORT_DIR="\$(realpath _reports)"
          BUILD_DIR="\$(realpath _build)"
          STRIP_DIR="\$(realpath .)"
          chmod u+rw auth_key.txt
          chmod go-rwx auth_key.txt
          python3 .github/workflows/coverity/coverity.py \
            --url "${{ vars.COVERITY_HOST}}" \
            --user "${{ vars.AD_USR }}" \
            --password "${{ secrets.AD_PW }}" \
            --email "${{ vars.AD_USR_EMAIL }}" \
            --stream "${{ vars.COVERITY_STREAM }}" \
            --project "${{ vars.COVERITY_PROJECT }}" \
            --project-name "oneVPL" \
            --dir "int_dir" \
            --report-dir "\${REPORT_DIR}" \
            --strip-path "\${STRIP_DIR}" \
            --code-version "${{ github.sha }}" \
            --bu "AXG" \
            --description "${{ github.ref_name }}" \
            --auth-key-file auth_key.txt \
            ${{ inputs.extra_opts }} \
            cmake --build "\${BUILD_DIR}" --parallel $(nproc) --verbose
          rm auth_key.txt
          EOL
          chmod +x action.sh

          docker run --rm -v $PWD:/working -w /working \
            vpl_coverity:ubuntu ./action.sh

      - name: Run Scan (Windows)
        if: success() && runner.os == 'Windows'
        run: |
          $env:CMAKE_PREFIX_PATH `
          = $(if (Test-Path _deps) {(Get-Item _deps).FullName})
          pushd source
          @"
          ${{ secrets.COVERITY_AUTH_KEY }}
          "@ | Out-File -encoding ascii auth_key.txt -NoNewline
          cmake -B _build
          if($LASTEXITCODE -ne 0)
          {
              Exit $LASTEXITCODE
          }
          $Env:VERBOSE = 1
          mkdir _reports
          & py -3 .github\workflows\coverity\coverity.py `
            --url "${{ vars.COVERITY_HOST }}" `
            --user "${{ vars.AD_USR }}" `
            --password "${{ secrets.AD_PW }}" `
            --email "${{ vars.AD_USR_EMAIL }}" `
            --stream "${{ vars.COVERITY_STREAM }}" `
            --project "${{ vars.COVERITY_PROJECT }}" `
            --project-name "oneVPL" `
            --dir "int_dir" `
            --report-dir "_reports" `
            --strip-path "." `
            --code-version "${{ github.sha }}" `
            --bu "AXG" `
            --description "${{ github.ref_name }}" `
            --auth-key-file auth_key.txt `
            ${{ inputs.extra_opts }} `
            cmake --build _build --parallel %NUMBER_OF_PROCESSORS% `
                  --verbose --config Release
          if($LASTEXITCODE -ne 0)
          {
            Exit $LASTEXITCODE
          }
          popd

      - name: Summarize (Linux)
        if: failure() && runner.os == 'Linux'
        run: |
          cat source/_reports/text_report.txt
          echo '```' >> $GITHUB_STEP_SUMMARY
          cat source/_reports/text_report.txt >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

      - name: Summarize (Windows)
        if: failure() && runner.os == 'Windows'
        run: |
          get-content source/_reports/text_report.txt
          echo '```' >> $env:GITHUB_STEP_SUMMARY
          get-content source/_reports/text_report.txt `
          | Out-File -encoding ascii $env:GITHUB_STEP_SUMMARY
          echo '```' >> $env:GITHUB_STEP_SUMMARY

      - name: Record Artifacts
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: ${{ inputs.os }}-${{ inputs.output_prefix }}coverity-scan
          path: source/_reports/*

      - name: Cleanup workspace (Linux)
        if: always() && runner.os == 'Linux'
        run: sudo rm -rf ..?* .[!.]* *

      - name: Cleanup workspace (Windows)
        if: always() && runner.os == 'Windows'
        run: Remove-Item -Recurse -Force .\*