-
-
Notifications
You must be signed in to change notification settings - Fork 0
96 lines (81 loc) · 3.69 KB
/
synopsys-security-scan.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# This file is parttly based on https://github.com/marketplace/actions/synopsys-intelligent-security-scan.
name: Coverity
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
schedule:
- cron: '30 2 * * *' # Run once per day, to avoid Coverity's submission limits
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
Coverity:
runs-on: ubuntu-latest
env:
COV_URL: ${{ secrets.SYNOPSYS_ACCESS_URL }}
COV_USER: ${{ secrets.SYNOPSYS_ACCESS_EMAIL }}
COVERITY_PASSPHRASE: ${{ secrets.SYNOPSYS_ACCESS_TOKEN }}
CSA: cov-analysis-linux64-2020.12
COVERITY_PROJECT: franziska-wegner/egoa
BLDCMD: mvn -B clean package -DskipTests
CHECKERS: --webapp-security
steps:
- name: Checkout EGOA
uses: actions/checkout@v4
- name: Coverity Download
run: |
wget -q https://scan.coverity.com/download/cxx/linux64 --post-data "token=$COVERITY_PASSPHRASE&project=franziska-wegner%2Fegoa" -O coverity_tool.tgz
mkdir cov-scan
tar ax -f coverity_tool.tgz --strip-components=1 -C cov-scan
# - name: Coverity Full Scan
# if: ${{ github.event_name != 'pull_request' }}
# run: |
# export PATH=$PATH:/tmp/$CSA/bin
# set -x
# cov-build --dir idir --fs-capture-search $GITHUB_WORKSPACE $BLDCMD
# cov-analyze --dir idir --ticker-mode none --strip-path $GITHUB_WORKSPACE $CHECKERS
# cov-commit-defects --dir idir --ticker-mode none --url $COV_URL --stream $COVERITY_PROJECT-${GITHUB_REF##*/} --scm git \
# --description $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID --target $RUNNER_OS --version $GITHUB_SHA
# - name: Coverity Quality Gate
# if: ${{ github.event_name != 'pull_request' }}
# run: |
# curl -fLsS --user $COV_USER:$COVERITY_PASSPHRASE $COV_URL/api/viewContents/issues/v1/OWASP%20Web%20Top%2010?projectId=$COVERITY_PROJECT > results.json
# if [ $(cat results.json | jq .viewContentsV1.totalRows) -ne 0 ]; then cat results.json | jq .viewContentsV1.rows; exit 1; fi
# - id: changeset
# name: Get Pull Request Changeset
# uses: jitterbit/get-changed-files@v1
# if: ${{ github.event_name == 'pull_request' }}
# - name: Coverity Incremental Scan
# if: ${{ github.event_name == 'pull_request' && steps.changeset.outputs.added_modified != '' }}
# run: |
# export PATH=$PATH:/tmp/$CSA/bin
# set -x
# cov-run-desktop --dir idir --url $COV_URL --stream $COVERITY_PROJECT-$GITHUB_BASE_REF --build $BLDCMD
# cov-run-desktop --dir idir --url $COV_URL --stream $COVERITY_PROJECT-$GITHUB_BASE_REF --present-in-reference false \
# --ignore-uncapturable-inputs true --exit1-if-defects true ${{ steps.changeset.outputs.added_modified }}
- name: Setup environment
run: |
echo "$(pwd)/cov-scan/bin" >> $GITHUB_PATH
echo "NPROC=$(getconf _NPROCESSORS_ONLN)" >> $GITHUB_ENV
- name: Configure egoa
run: |
mkdir build
cmake -S . -B build -D EGOA_BUILD_TYPE=Release CMAKE_BUILD_TYPE=Release -G "Unix Makefiles"
- name: Run coverity build/scan
run: |
cd build && cov-build --dir cov-int make -j${NPROC}
- name: Submit results
run: |
cd build
tar zcf cov-scan.tgz cov-int
curl --form token=$COVERITY_PASSPHRASE \
--form email=$COV_USER \
--form [email protected] \
--form version="$(git rev-parse HEAD)" \
--form description="Automatic GHA scan" \
'https://scan.coverity.com/builds?project=franziska-wegner%2Fegoa'