Skip to content

Run Coverity Scan

Run Coverity Scan #83

Workflow file for this run

name: "Run Coverity Scan"
on:
schedule:
- cron: "0 0 * * FRI"
workflow_dispatch:
# Coverity Scan project name. Override by setting a repository variable named
# COVERITY_PROJECT (Settings -> Secrets and variables -> Actions -> Variables);
# it falls back to "LAMMPS" when the variable is unset. Keep this in sync with
# the exact project name shown on scan.coverity.com. The matching COVERITY_TOKEN
# and COVERITY_EMAIL live in Actions secrets.
env:
COVERITY_PROJECT: ${{ vars.COVERITY_PROJECT || 'LAMMPS' }}
jobs:
analyze:
name: Analyze
if: ${{ github.repository == 'lammps/lammps' }}
runs-on: ubuntu-latest
container:
image: lammps/buildenv:ubuntu22.04
steps:
- name: Checkout repository
uses: actions/checkout@v7
with:
fetch-depth: 2
- name: Create Build and Download Folder
run: mkdir build download
- name: Cache Coverity
id: cache-coverity
uses: actions/cache@v5
with:
path: ./download/
key: ${{ runner.os }}-download-${{ hashFiles('**/coverity_tool.*') }}
- name: Download Coverity if necessary
id: download-coverity
if: steps.cache-coverity.outputs.cache-hit != 'true'
working-directory: download
run: |
if ! wget -nv --server-response \
--post-data "token=${{ secrets.COVERITY_TOKEN }}&project=${{ env.COVERITY_PROJECT }}" \
-O coverity_tool.tgz \
https://scan.coverity.com/download/linux64 2> wget.log; then
cat wget.log
if grep -q "ERROR 404" wget.log; then
echo "::warning::Coverity Scan endpoint returned 404 (service likely offline); skipping."
echo "skip=true" >> "$GITHUB_OUTPUT"
exit 0
fi
exit 1
fi
wget -nv https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_TOKEN }}&project=${{ env.COVERITY_PROJECT }}&md5=1" -O coverity_tool.md5
echo " coverity_tool.tgz" >> coverity_tool.md5
md5sum -c coverity_tool.md5
- name: Setup Coverity
if: steps.download-coverity.outputs.skip != 'true'
run: |
tar xzf download/coverity_tool.tgz
ln -s cov-analysis-linux64-* coverity
- name: Configure LAMMPS via CMake
if: steps.download-coverity.outputs.skip != 'true'
shell: bash
working-directory: build
run: |
cmake \
-C ../cmake/presets/clang.cmake \
-C ../cmake/presets/most.cmake \
-C ../cmake/presets/kokkos-openmp.cmake \
-D CMAKE_BUILD_TYPE="RelWithDebug" \
-D CMAKE_TUNE_FLAGS="-Wall -Wextra -Wno-unused-result" \
-D BUILD_MPI=on \
-D BUILD_OMP=on \
-D BUILD_SHARED_LIBS=on \
-D LAMMPS_SIZES=SMALLBIG \
-D DOWNLOAD_POTENTIALS=off \
-D PKG_H5MD=on \
-D PKG_INTEL=on \
-D PKG_LATBOLTZ=on \
-D PKG_MANIFOLD=on \
-D PKG_MDI=on \
-D PKG_MGPT=on \
-D PKG_ML-RANN=on \
-D PKG_ML-RUNNER=on \
-D PKG_ML-HDNNP=on \
-D PKG_ML-PACE=on \
-D PKG_APIP=on \
-D PKG_MOLFILE=on \
-D PKG_NETCDF=on \
-D PKG_PTM=on \
-D PKG_QTB=on \
-D PKG_SMTBQ=on \
../cmake
- name: Run Coverity Scan
if: steps.download-coverity.outputs.skip != 'true'
shell: bash
working-directory: build
run: |
export PATH=$GITHUB_WORKSPACE/coverity/bin:$PATH
cov-build --dir cov-int cmake --build . --parallel 2
- name: Create tarball with scan results
if: steps.download-coverity.outputs.skip != 'true'
shell: bash
working-directory: build
run: tar czf lammps.tgz cov-int
- name: Upload scan result to Coverity
if: steps.download-coverity.outputs.skip != 'true'
shell: bash
run: |
curl --form token=${{ secrets.COVERITY_TOKEN }} \
--form email=${{ secrets.COVERITY_EMAIL }} \
--form file=@build/lammps.tgz \
--form version=${{ github.sha }} \
--form description="LAMMPS automated build" \
https://scan.coverity.com/builds?project=${{ env.COVERITY_PROJECT }}