1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
name: Coverity
on:
schedule:
- cron: '0 18 * * SUN'
workflow_dispatch:
#on:
# push:
# branches: [ master, coverity ]
# pull_request:
# types: [opened, synchronize, reopened]
jobs:
build:
name: Build and analyze
runs-on: ubuntu-latest
if: github.repository == 'OpenIDC/mod_auth_openidc'
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Dependencies
run: |
sudo apt-get update -y
sudo apt-get install -y apache2-dev libcjose-dev libssl-dev check pkg-config
sudo apt-get install -y libjansson-dev libcurl4-openssl-dev libhiredis-dev libpcre2-dev libjq-dev check
- name: Download Coverity Build Tool
env:
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
run: |
wget -q https://scan.coverity.com/download/cxx/linux64 --post-data "token=$TOKEN&project=OpenIDC%2Fmod_auth_openidc" -O cov-analysis-linux64.tar.gz
mkdir cov-analysis-linux64
tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
- name: Configure
run: |
./autogen.sh
./configure --with-jq
- name: Make with cov-build
run: |
pwd
export PATH=`pwd`/cov-analysis-linux64/bin:$PATH
cov-build --dir cov-int make check
- name: Submit to Coverity Scan
env:
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
run: |
tar czvf mod_auth_openidc.tgz cov-int
curl \
--form project=OpenIDC%2Fmod_auth_openidc \
--form token=$TOKEN \
--form email=hans.zandbelt@zmartzone.eu \
--form file=@mod_auth_openidc.tgz \
--form version=master \
--form description="`git rev-parse --abbrev-ref HEAD` `git rev-parse --short HEAD`" \
https://scan.coverity.com/builds?project=OpenIDC%2Fmod_auth_openidc
# - name: Coverity Scan
# uses: blackduck-inc/black-duck-security-scan@v2.0.0
# with:
# coverity_url: ${{ vars.COVERITY_URL }}
# coverity_project_name: ${{ vars.COVERITY_PROJECT_NAME }}
# coverity_user: ${{ vars.COVERITY_USER }}
# coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
# coverity_build_command: make all
# coverity_clean_command: make clean
|
