CI: enable daily coverity scan #849

chipitsine · 2025-01-08T04:31:42Z

What does this PR do?

introduce workflow mentioned in #842

Type of Change

Bug fix (non-breaking change)
New feature (non-breaking change)
Breaking change (fix or feature with breaking changes)
Documentation update

Additional Context

next steps:

grant Cloudberry developers permissions on Coverity project (I can add by email or feel free to request join at https://scan.coverity.com/projects/cloudberry?tab=overview )
add COVERITY_SCAN_TOKEN to GHA secrets
enjoy

P.S. I forgot to mention reeasoning for daily scheduling. Coverity has limits

my-ship-it · 2025-01-08T08:33:37Z

.github/workflows/coverity.yml

@@ -0,0 +1,46 @@
+
+name: Coverity


Thanks for the contribution. Please add LICENSE header and comments?
You can refer to the file:
https://github.com/apache/cloudberry/blob/main/.github/workflows/build-cloudberry.yml

edespino · 2025-01-08T08:50:11Z

@chipitsine Thank you for your PR that adds Coverity scanning to the project's CI pipeline. I appreciate your effort to enhance our code quality checks.

I am currently checking with the Apache Infrastructure team about policies regarding the use of Coverity Scan services for Apache projects.

Additionally, I noticed a few technical items in the workflow that would need adjustment:

There's a syntax error in the cron expression ("0 0 * **")
The notification email is hardcoded to a personal address
The workflow assumes access to a COVERITY_SCAN_TOKEN
It is good practice to add an Apache v2.0 header.

I'll keep you updated once I have more information about Apache's policies regarding Coverity usage. We can then address the workflow specifics based on what I learn.

Thanks again for contributing to the project!

chipitsine · 2025-01-08T08:59:22Z

@edespino do you have an ETA for your investigations ?

edespino · 2025-01-08T10:22:46Z

@chipitsine I have just sent the following to the ASF Infrastructure team.

As a contributor to Apache Cloudberry (Incubating), I'm exploring options for incorporating static analysis into our codebase, which uses C, C++, Python and Go. While investigating common practices across Apache projects, I've noticed Sonar appears to be widely adopted, while Coverity is used by some projects but less frequently. One of our developers recently identified some issues through a Coverity scan.
Given Apache's ecosystem and our multi-language codebase, what would be the recommended approach for static analysis tooling? We're particularly interested in comparing Coverity, CodeQL, and Sonar. Are there any specific recommendations or preferences within the Apache community for these or other static analysis tools?

chipitsine · 2025-01-08T10:30:10Z

I've approved your request, you should see findings now. Let me know if not.

as for Coverity, CodeQL, and Sonar - I'd start with Coverity (for c/c++ projects).

well, those options are not mutually exclusive. if you have enough appetite, you can enable all of them

chipitsine · 2025-01-08T12:52:19Z

regarding those

There's a syntax error in the cron expression ("0 0 * **")

yep, it's minor error. actually, I copied from other workflow, so it even works )) but I'll fix, nevermind

The notification email is hardcoded to a personal address

notification email is mandatory. if you have some preference, Ill change it. or we can use secrets (if you want to keep it secret)

The workflow assumes access to a COVERITY_SCAN_TOKEN

yep. someone has to add that token from coverity admin area to secrets

It is good practice to add an Apache v2.0 header.

do you have an example ?

edespino · 2025-01-08T19:56:13Z

The infra team mentioned that the Apache Software Foundation (ASF) has a SonarQube Cloud sponsorship. I am going to investigate setting it up and we can compare the functionality and usefulness of both tools.

https://sonarcloud.io/organizations/apache/projects

@chipitsine do you have any experience with SonarQube?

chipitsine · 2025-01-08T20:43:57Z

Could you please help me understand the motivation behind this task?

edespino · 2025-01-09T11:02:50Z

Could you please help me understand the motivation behind this task?

@chipitsine I am simply trying to determine if SonarQube would give us a similar static analysis as Coverity. It is possible Coverity is the way to go. But I would like to spend a few days reviewing both tools.

chipitsine · 2025-01-29T23:39:54Z

@edespino , hope this finds you well. how do you estimate several days ?

chipitsine · 2025-03-10T07:36:50Z

@edespino hope you are doing well. did you have a chance to review ?

tuhaihe · 2025-03-12T10:31:15Z

Hi @chipitsine, since we haven't heard from Ed in a while, I think we can proceed with this. If something is wrong, we can create a new PR to fix it or just revert the changes.

By the way, could you please replace your personal token and account info with mine as follows? I've informed the Cloudberry PPMC.

curl --form token=GRwsqwix2twFnhOXVMGnvQ \
  --form [email protected] \
  --form file=@tarball/file/location \
  --form version="Version" \
  --form description="Description" \
  https://scan.coverity.com/builds?project=apache%2Fcloudberry

chipitsine · 2025-03-12T14:06:31Z

I decided to rebase and met some problems

#991

either it will be fixed or I'll get some linux computer

tuhaihe · 2025-03-12T14:11:58Z

I decided to rebase and met some problems

#991

either it will be fixed or I'll get some linux computer

Hi thanks! Looking forward to your new PR.

chipitsine · 2025-03-12T14:29:24Z

as for token, I'm against keeping it open text.
the best thing would be to use github secrets (we need someone with admin rights on repo to add a secret)

tuhaihe · 2025-03-13T03:04:54Z

as for token, I'm against keeping it open text. the best thing would be to use github secrets (we need someone with admin rights on repo to add a secret)

Ok, let me talk with the Apache infra team to see how we can do it.

By the way, could you provide some steps on this, assuming you're the admin, which can be a reference for the ASF infra team. Thanks!

tuhaihe · 2025-03-14T03:35:10Z

Hi @chipitsine, I already requested that the ASF infra team help set the secret. The secret name is still COVERITY_SCAN_TOKEN. You can find the email thread here: https://lists.apache.org/thread/0gqpyzhpx65j7gv826kg8cx8xgttvsb5

chipitsine · 2025-03-14T03:49:02Z

assuming you are an admin, you can add secret here: https://github.com/apache/cloudberry/settings/secrets/actions

chipitsine · 2025-03-14T05:33:57Z

@tuhaihe , I've reopened.

        curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \
          --form [email protected] \
          --form [email protected] \
          --form version="Commit $GITHUB_SHA" \
          --form description="Build submitted via CI" \
          https://scan.coverity.com/builds?project=cloudberry

"project" must be the same as it is in Coverity

tuhaihe · 2025-03-14T05:44:40Z

Hi, you can use this in the CURL cmd:

https://scan.coverity.com/builds?project=apache%2Fcloudberry

You can visit the new Coverity page for Apache Cloudberry: https://scan.coverity.com/projects/apache-cloudberry-1f6d497c-9dcb-4204-a37b-0d79c6c5bec3

chipitsine · 2025-03-14T06:10:16Z

ok, it;s another project.
I've changed curl command

tuhaihe requested review from edespino and my-ship-it January 8, 2025 05:34

my-ship-it reviewed Jan 8, 2025

View reviewed changes

tuhaihe self-requested a review March 12, 2025 10:37

chipitsine closed this Mar 12, 2025

chipitsine force-pushed the main branch from d190dbb to 8da7660 Compare March 12, 2025 13:56

CI: enable daily coverity scan

182cefb

chipitsine reopened this Mar 14, 2025

adjust project name

414a802

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CI: enable daily coverity scan #849

CI: enable daily coverity scan #849

chipitsine commented Jan 8, 2025 •

edited

Loading

my-ship-it Jan 8, 2025

edespino commented Jan 8, 2025

chipitsine commented Jan 8, 2025

edespino commented Jan 8, 2025

chipitsine commented Jan 8, 2025 •

edited

Loading

chipitsine commented Jan 8, 2025

edespino commented Jan 8, 2025

chipitsine commented Jan 8, 2025

edespino commented Jan 9, 2025 •

edited

Loading

chipitsine commented Jan 29, 2025

chipitsine commented Mar 10, 2025

tuhaihe commented Mar 12, 2025

chipitsine commented Mar 12, 2025

tuhaihe commented Mar 12, 2025

chipitsine commented Mar 12, 2025

tuhaihe commented Mar 13, 2025

tuhaihe commented Mar 14, 2025

chipitsine commented Mar 14, 2025

chipitsine commented Mar 14, 2025

tuhaihe commented Mar 14, 2025 •

edited

Loading

chipitsine commented Mar 14, 2025

CI: enable daily coverity scan #849

Are you sure you want to change the base?

CI: enable daily coverity scan #849

Conversation

chipitsine commented Jan 8, 2025 • edited Loading

What does this PR do?

Type of Change

Additional Context

my-ship-it Jan 8, 2025

Choose a reason for hiding this comment

edespino commented Jan 8, 2025

chipitsine commented Jan 8, 2025

edespino commented Jan 8, 2025

chipitsine commented Jan 8, 2025 • edited Loading

chipitsine commented Jan 8, 2025

edespino commented Jan 8, 2025

chipitsine commented Jan 8, 2025

edespino commented Jan 9, 2025 • edited Loading

chipitsine commented Jan 29, 2025

chipitsine commented Mar 10, 2025

tuhaihe commented Mar 12, 2025

chipitsine commented Mar 12, 2025

tuhaihe commented Mar 12, 2025

chipitsine commented Mar 12, 2025

tuhaihe commented Mar 13, 2025

tuhaihe commented Mar 14, 2025

chipitsine commented Mar 14, 2025

chipitsine commented Mar 14, 2025

tuhaihe commented Mar 14, 2025 • edited Loading

chipitsine commented Mar 14, 2025

chipitsine commented Jan 8, 2025 •

edited

Loading

chipitsine commented Jan 8, 2025 •

edited

Loading

edespino commented Jan 9, 2025 •

edited

Loading

tuhaihe commented Mar 14, 2025 •

edited

Loading