Run Coverity Scan #83
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Run Coverity Scan" | |
| on: | |
| schedule: | |
| - cron: "0 0 * * FRI" | |
| workflow_dispatch: | |
| # Coverity Scan project name. Override by setting a repository variable named | |
| # COVERITY_PROJECT (Settings -> Secrets and variables -> Actions -> Variables); | |
| # it falls back to "LAMMPS" when the variable is unset. Keep this in sync with | |
| # the exact project name shown on scan.coverity.com. The matching COVERITY_TOKEN | |
| # and COVERITY_EMAIL live in Actions secrets. | |
| env: | |
| COVERITY_PROJECT: ${{ vars.COVERITY_PROJECT || 'LAMMPS' }} | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| if: ${{ github.repository == 'lammps/lammps' }} | |
| runs-on: ubuntu-latest | |
| container: | |
| image: lammps/buildenv:ubuntu22.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 2 | |
| - name: Create Build and Download Folder | |
| run: mkdir build download | |
| - name: Cache Coverity | |
| id: cache-coverity | |
| uses: actions/cache@v5 | |
| with: | |
| path: ./download/ | |
| key: ${{ runner.os }}-download-${{ hashFiles('**/coverity_tool.*') }} | |
| - name: Download Coverity if necessary | |
| id: download-coverity | |
| if: steps.cache-coverity.outputs.cache-hit != 'true' | |
| working-directory: download | |
| run: | | |
| if ! wget -nv --server-response \ | |
| --post-data "token=${{ secrets.COVERITY_TOKEN }}&project=${{ env.COVERITY_PROJECT }}" \ | |
| -O coverity_tool.tgz \ | |
| https://scan.coverity.com/download/linux64 2> wget.log; then | |
| cat wget.log | |
| if grep -q "ERROR 404" wget.log; then | |
| echo "::warning::Coverity Scan endpoint returned 404 (service likely offline); skipping." | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| exit 1 | |
| fi | |
| wget -nv https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_TOKEN }}&project=${{ env.COVERITY_PROJECT }}&md5=1" -O coverity_tool.md5 | |
| echo " coverity_tool.tgz" >> coverity_tool.md5 | |
| md5sum -c coverity_tool.md5 | |
| - name: Setup Coverity | |
| if: steps.download-coverity.outputs.skip != 'true' | |
| run: | | |
| tar xzf download/coverity_tool.tgz | |
| ln -s cov-analysis-linux64-* coverity | |
| - name: Configure LAMMPS via CMake | |
| if: steps.download-coverity.outputs.skip != 'true' | |
| shell: bash | |
| working-directory: build | |
| run: | | |
| cmake \ | |
| -C ../cmake/presets/clang.cmake \ | |
| -C ../cmake/presets/most.cmake \ | |
| -C ../cmake/presets/kokkos-openmp.cmake \ | |
| -D CMAKE_BUILD_TYPE="RelWithDebug" \ | |
| -D CMAKE_TUNE_FLAGS="-Wall -Wextra -Wno-unused-result" \ | |
| -D BUILD_MPI=on \ | |
| -D BUILD_OMP=on \ | |
| -D BUILD_SHARED_LIBS=on \ | |
| -D LAMMPS_SIZES=SMALLBIG \ | |
| -D DOWNLOAD_POTENTIALS=off \ | |
| -D PKG_H5MD=on \ | |
| -D PKG_INTEL=on \ | |
| -D PKG_LATBOLTZ=on \ | |
| -D PKG_MANIFOLD=on \ | |
| -D PKG_MDI=on \ | |
| -D PKG_MGPT=on \ | |
| -D PKG_ML-RANN=on \ | |
| -D PKG_ML-RUNNER=on \ | |
| -D PKG_ML-HDNNP=on \ | |
| -D PKG_ML-PACE=on \ | |
| -D PKG_APIP=on \ | |
| -D PKG_MOLFILE=on \ | |
| -D PKG_NETCDF=on \ | |
| -D PKG_PTM=on \ | |
| -D PKG_QTB=on \ | |
| -D PKG_SMTBQ=on \ | |
| ../cmake | |
| - name: Run Coverity Scan | |
| if: steps.download-coverity.outputs.skip != 'true' | |
| shell: bash | |
| working-directory: build | |
| run: | | |
| export PATH=$GITHUB_WORKSPACE/coverity/bin:$PATH | |
| cov-build --dir cov-int cmake --build . --parallel 2 | |
| - name: Create tarball with scan results | |
| if: steps.download-coverity.outputs.skip != 'true' | |
| shell: bash | |
| working-directory: build | |
| run: tar czf lammps.tgz cov-int | |
| - name: Upload scan result to Coverity | |
| if: steps.download-coverity.outputs.skip != 'true' | |
| shell: bash | |
| run: | | |
| curl --form token=${{ secrets.COVERITY_TOKEN }} \ | |
| --form email=${{ secrets.COVERITY_EMAIL }} \ | |
| --form file=@build/lammps.tgz \ | |
| --form version=${{ github.sha }} \ | |
| --form description="LAMMPS automated build" \ | |
| https://scan.coverity.com/builds?project=${{ env.COVERITY_PROJECT }} |