Repository navigation
task: coverity #3070
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
jharlow-intel
wants to merge
7
commits into
master
Choose a base branch
from
task/coverity
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+243
−0
Open
task: coverity #3070
Changes from all commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
6f30478
task: coverity workflow
jharlow-intel bb010f4
task: coverity
jharlow-intel c664190
Merge remote-tracking branch 'origin/master' into task/coverity
jharlow-intel 73c91ca
Pin Cython in the Coverity workflow for stable CIDs
jharlow-intel 48bd48f
Merge branch 'master' into task/coverity
jharlow-intel 0bd09e7
Use the native Intel compiler type and gate on capture rate in Coverity
jharlow-intel b01a398
Gate Coverity on per-source capture and submit only from master
jharlow-intel File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,242 @@ | ||
| name: Coverity Scan | ||
|
|
||
| # Public static analysis via the free Coverity Scan service (scan.coverity.com, | ||
| # operated by Black Duck). Coverity is a compiled-language analyzer: it must wrap | ||
| # the real C/C++ build with `cov-build`, so this workflow installs oneAPI, builds | ||
| # the SYCL extensions under capture, and uploads the result for analysis. | ||
| # | ||
| # One-time setup required before the first run: | ||
| # 1. Register IntelPython/dpnp at https://scan.coverity.com/github | ||
| # (sign in with GitHub; the project name must match COVERITY_PROJECT below). | ||
| # 2. Add two repository secrets (Settings -> Secrets and variables -> Actions): | ||
| # COVERITY_SCAN_TOKEN - the project token from the Project Settings tab | ||
| # COVERITY_SCAN_EMAIL - a maintainer email for build notifications | ||
| # | ||
| # dpnp is ~140K lines of C++/Cython, which puts it in the 100K-500K LOC free-tier | ||
| # bucket: 21 builds/week, max 3/day. Running weekly plus on demand stays well | ||
| # under that, and matters more here than for the smaller IntelPython projects | ||
| # because a full dpnp build under cov-build takes hours. | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: "0 1 * * 1" # Mondays 01:00 UTC; well under the free build quota | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| concurrency: | ||
| group: coverity-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| env: | ||
| COVERITY_PROJECT: IntelPython/dpnp | ||
| ONEAPI_ROOT: /opt/intel/oneapi | ||
|
|
||
| jobs: | ||
| coverity-scan: | ||
| # Forks lack the COVERITY_SCAN_* secrets; only run on the canonical repo. | ||
| if: github.repository == 'IntelPython/dpnp' | ||
| runs-on: ubuntu-latest | ||
| # Backstop for the whole job. dpnp's own conda-package build budgets 90 min | ||
| # and Coverity's emit roughly doubles compile time, so this is deliberately | ||
| # close to the 6 h hard cap GitHub imposes on a job. | ||
| timeout-minutes: 350 | ||
|
|
||
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| # versioneer needs the tags to compute the package version | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
|
|
||
| - name: Add Intel repository | ||
| run: | | ||
| wget -qO- https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB \ | ||
| | gpg --dearmor | sudo tee /usr/share/keyrings/oneapi-archive-keyring.gpg > /dev/null | ||
| echo "deb [signed-by=/usr/share/keyrings/oneapi-archive-keyring.gpg] https://apt.repos.intel.com/oneapi all main" \ | ||
| | sudo tee /etc/apt/sources.list.d/oneAPI.list | ||
| sudo apt-get update | ||
|
|
||
| - name: Install latest Intel OneAPI | ||
| # Same package set the coverage workflow uses: dpnp's CMakeLists requires | ||
| # IntelSYCL, MKL, TBB and oneDPL (libdpstd) to be found at configure time. | ||
| run: | | ||
| sudo apt-get install -y hwloc \ | ||
| intel-oneapi-mkl \ | ||
| intel-oneapi-umf \ | ||
| intel-oneapi-mkl-devel \ | ||
| intel-oneapi-tbb-devel \ | ||
| intel-oneapi-libdpstd-devel \ | ||
| intel-oneapi-compiler-dpcpp-cpp | ||
| sudo apt-get install -y ninja-build | ||
|
|
||
| - name: Setup Python | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | ||
| with: | ||
| python-version: '3.12' | ||
| architecture: x64 | ||
|
|
||
| - name: Install dpnp build dependencies | ||
| # Mirrors the build-time requirements in pyproject.toml. dpnp still uses | ||
| # classic scikit-build, so setup.py is the build entry point. | ||
| # Cython is pinned here only (not in pyproject.toml) to keep the generated | ||
| # code stable between scans, so Coverity CIDs and their triage survive; | ||
| # bump it deliberately, as the mkl_fft and mkl-service scans do. | ||
| run: | | ||
| pip install cmake "cython==3.3.0" ninja numpy scikit-build setuptools wheel \ | ||
| "versioneer[toml]==0.29" | ||
|
|
||
| - name: Install dpctl | ||
| # dpctl must come from pip, not conda: the conda package has a runtime | ||
| # dependency on DPC++ RT, which would be resolved independently of the | ||
| # apt-installed compiler above and can end up newer than it. DPC++ only | ||
| # guarantees backwards compatibility, so that skew breaks the build. | ||
| run: pip install -r environments/dpctl_pkg.txt | ||
|
|
||
| - name: Report compiler version | ||
| run: | | ||
| source "${ONEAPI_ROOT}/setvars.sh" | ||
| icpx --version | ||
|
|
||
| - name: Download Coverity Build Tool | ||
| timeout-minutes: 15 | ||
| env: | ||
| COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} | ||
| run: | | ||
| curl --location --no-progress-meter --fail-with-body \ | ||
| --retry 5 --retry-connrefused --retry-delay 5 \ | ||
| --data-urlencode "token=${COVERITY_SCAN_TOKEN}" \ | ||
| --data-urlencode "project=${COVERITY_PROJECT}" \ | ||
| --output cov-analysis.tar.gz \ | ||
| https://scan.coverity.com/download/linux64 | ||
| # An invalid token/project is answered with a small HTML error page and | ||
| # HTTP 200, not the multi-hundred-MB tarball, so --fail-with-body does | ||
| # not catch it. Fail loudly with a clear hint instead. | ||
| if [ "$(stat -c '%s' cov-analysis.tar.gz)" -lt 1000000 ]; then | ||
| echo "::error::Coverity build tool download failed. Verify the COVERITY_SCAN_TOKEN secret and that the registered project name matches '${COVERITY_PROJECT}'." | ||
| head -c 512 cov-analysis.tar.gz || true | ||
| exit 1 | ||
| fi | ||
| mkdir -p cov-analysis | ||
| tar -xzf cov-analysis.tar.gz --strip 1 -C cov-analysis | ||
| echo "${PWD}/cov-analysis/bin" >> "$GITHUB_PATH" | ||
|
|
||
| - name: Configure Coverity for the DPC++ compiler | ||
| run: | | ||
| source "${ONEAPI_ROOT}/setvars.sh" | ||
| # Cython-generated sources and the pybind11 extensions go through | ||
| # icpx, the sysroot/driver probing bits still use gcc | ||
| cov-configure --gcc | ||
| # Register icx/icpx with Coverity's native Intel oneAPI compiler type. | ||
| # The generic clangcc/clangcxx templates parse <sycl/sycl.hpp> without | ||
| # SYCL mode and fail on device-only builtins (__ocl_sampler_t, | ||
| # __ocl_image2d_ro_t, ...): dpctl's scan with that setup captures only | ||
| # 9 of its 30 sources, and nearly all of dpnp's sources include SYCL. | ||
| # The native type emits each SYCL source twice, as a host pass and a | ||
| # spir64 device pass; see the capture check below for the latter. | ||
| # intel_oneapi_icx is current; intel_icx:linux is the older spelling | ||
| # the Scan build tool still ships (what mkl_umath's scan resolves to). | ||
| comptypes="$(cov-configure --list-compiler-types | cut -d, -f1)" | ||
| comptype="" | ||
| for candidate in intel_oneapi_icx intel_oneapi_icx:linux intel_icx:linux; do | ||
| if grep -qxF "${candidate}" <<< "${comptypes}"; then | ||
| comptype="${candidate}" | ||
| break | ||
| fi | ||
| done | ||
| if [ -z "${comptype}" ]; then | ||
| echo "::error::No Intel oneAPI compiler type in this cov-analysis; refusing to fall back to the generic Clang configuration." | ||
| exit 1 | ||
| fi | ||
| echo "Using Coverity compiler type: ${comptype}" | ||
| # With --template, --compiler takes a bare executable name; capture | ||
| # matches on the name of the spawned executable, so this also covers | ||
| # the absolute icx/icpx paths CMake resolves. | ||
| cov-configure --template --comptype "${comptype}" --compiler icx | ||
| cov-configure --template --comptype "${comptype}" --compiler icpx | ||
|
|
||
| - name: Build under cov-build | ||
| # dpnp has ~250 translation units, many of them template-heavy SYCL | ||
| # kernels, and cov-build compiles each one a second time with its own | ||
| # frontend. Cap the step so a wedged capture fails before the job | ||
| # timeout eats the whole 6 h budget. | ||
| timeout-minutes: 300 | ||
| run: | | ||
| set -o pipefail | ||
| source "${ONEAPI_ROOT}/setvars.sh" | ||
| # --skip-editable: the in-place build_ext already compiled everything | ||
| # Coverity needs to see, a pip install would only repeat it | ||
| cov-build --dir cov-int \ | ||
| python scripts/build_locally.py --oneapi --skip-editable --verbose \ | ||
| 2>&1 | tee cov-build.log | ||
| { | ||
| echo "### Coverity capture" | ||
| echo '```' | ||
| grep -E "Emitted .*compilation unit|are ready for analysis" cov-build.log || true | ||
| echo '```' | ||
| } >> "$GITHUB_STEP_SUMMARY" | ||
| # A partial capture still uploads happily and uses up a scan, so | ||
| # require every project source to be emitted. This is checked per | ||
| # source rather than via the "Emitted N (P%)" total because that | ||
| # total also counts the spir64 device passes, which the Scan build | ||
| # tool's emitter cannot parse (it trips over and then crashes in the | ||
| # SPIR-V builtin headers), capping P near 50% for dpnp. The host | ||
| # pass of each source is what gets analyzed. CMake's own try-compile | ||
| # probes under CMakeFiles/ are not project code and often fail. | ||
| # `|| true` because a no-match grep would otherwise trip pipefail and | ||
| # end the step before the errors below are printed. | ||
| log=cov-int/build-log.txt | ||
| compiled="$(grep -oP '\[STATUS\] Compiling \K\S+' "${log}" | grep -F "${GITHUB_WORKSPACE}/" | grep -vF /CMakeFiles/ | sort -u || true)" | ||
| # Unanchored: parallel compiles can splice another unit's output onto | ||
| # the same line of the log. | ||
| emitted="$(grep -oP "Emit for file '\K[^']+(?=' \(TU [0-9]+\) complete\.)" "${log}" | sort -u || true)" | ||
| missing="$(comm -23 <(echo "${compiled}") <(echo "${emitted}"))" | ||
| total="$(grep -c . <<< "${compiled}" || true)" | ||
| nmissing="$(grep -c . <<< "${missing}" || true)" | ||
| echo "Coverity emitted $(( total - nmissing )) of ${total} project sources" | tee -a "$GITHUB_STEP_SUMMARY" | ||
| if [ "${total}" -eq 0 ]; then | ||
| echo "::error::No project sources were compiled under cov-build." | ||
| exit 1 | ||
| fi | ||
| if [ "${nmissing}" -gt 0 ]; then | ||
| echo "${missing}" | ||
| echo "::error::Coverity did not emit ${nmissing} of ${total} project sources (listed above)." | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Upload Coverity build log | ||
| if: always() | ||
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | ||
| with: | ||
| name: coverity-build-log | ||
| path: | | ||
| cov-build.log | ||
| cov-int/build-log.txt | ||
| retention-days: 7 | ||
| if-no-files-found: warn | ||
|
|
||
| - name: Submit results to Coverity Scan | ||
| # Scan keeps only the latest build, so a run dispatched on a feature | ||
| # branch would replace master's results; such runs stop after capture. | ||
| if: github.ref == 'refs/heads/master' | ||
| timeout-minutes: 30 | ||
| env: | ||
| COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} | ||
| COVERITY_SCAN_EMAIL: ${{ secrets.COVERITY_SCAN_EMAIL }} | ||
| run: | | ||
| tar -czf cov-int.tgz cov-int | ||
| # dpnp's emit database is far larger than the other IntelPython | ||
| # projects'; log the size because Scan rejects oversized submissions | ||
| # and the resulting error is otherwise opaque. | ||
| echo "Submitting $(du -h cov-int.tgz | cut -f1) of intermediate results" | ||
| curl --no-progress-meter --fail-with-body \ | ||
| --retry 5 --retry-connrefused --retry-delay 5 \ | ||
| --form token="${COVERITY_SCAN_TOKEN}" \ | ||
| --form email="${COVERITY_SCAN_EMAIL}" \ | ||
| --form file=@cov-int.tgz \ | ||
| --form version="${GITHUB_SHA}" \ | ||
| --form description="GitHub Actions ${GITHUB_REF_NAME} (run ${GITHUB_RUN_ID})" \ | ||
| --form project="${COVERITY_PROJECT}" \ | ||
| https://scan.coverity.com/builds | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nit: if Scan rejects this direct POST because the tarball is too large, the fallback is the upload flow from the project's "Submit build" page:
POST /projects/<id>/builds/initreturns an uploadurland abuild_id.PUTthe tarball to thaturl.PUT /projects/<id>/builds/<build_id>/enqueue.No change needed until the first run shows the size. Just flagging it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks. The step already logs the tarball size, so the first run will show whether we need the init/PUT/enqueue flow.