analyzer.yml

---
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This file is part of nvme.
# Copyright (c) 2026 SUSE LLC
#
# Authors: Daniel Wagner <dwagner@suse.de>
#          Nilay Shroff <nilay@linux.ibm.com>


name: Analyzers

on:
  workflow_dispatch:
    inputs:
      ref:
        description: 'Branch, tag, or ref to check out (leave empty for default branch)'
        required: false
        default: ''
  schedule:
    - cron: '0 01 * * *'

jobs:
  build-with-clang-analyzer:
    if: ${{ github.event_name == 'workflow_dispatch' || github.repository == 'linux-nvme/nvme-cli' }}
    name: build with clang analyzer
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/linux-nvme/fedora:latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.inputs.ref || github.ref }}
          fetch-depth: 0

      - name: Mark repo as safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Run Clang Static Analyzer
        continue-on-error: true
        run: scripts/build.sh -a

      - name: Upload scan result artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: clang-analyzer-report
          path: .build-ci/scan-results/

  upload-analyzer-report:
    if: ${{ github.repository == 'linux-nvme/nvme-cli' }}
    name: upload analyzer report to SFTP
    runs-on: ubuntu-latest
    needs: build-with-clang-analyzer
    steps:
      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: clang-analyzer-report
          path: scan-results

      - name: Archive analyzer report
        run: |
          REPORT="clang-analyzer-report-${GITHUB_RUN_NUMBER}-${GITHUB_SHA:0:12}.tar.gz"
          tar cvzf "$REPORT" scan-results
          echo "REPORT=$REPORT" >> "$GITHUB_ENV"

      - name: upload to SFTP server
        env:
          SFTP_USERNAME: ${{ secrets.SFTP_USERNAME }}
          SFTP_SERVER: ${{ secrets.SFTP_SERVER }}
          SFTP_HOST_KEY: ${{ secrets.SFTP_HOST_KEY }}
          SFTP_PRIVATE_KEY: ${{ secrets.SFTP_PRIVATE_KEY }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "${SFTP_HOST_KEY}" > ~/.ssh/known_hosts
          echo "${SFTP_PRIVATE_KEY}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          SFTP_BATCH=$(mktemp)
          trap 'rm -f "$SFTP_BATCH"' EXIT
          echo "cd /upload" > "$SFTP_BATCH"
          echo "put ${REPORT}" >> "$SFTP_BATCH"
          sftp -b "$SFTP_BATCH" "${SFTP_USERNAME}@${SFTP_SERVER}"

  coverity:
    if: github.repository == 'linux-nvme/nvme-cli'
    name: coverity scan
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/linux-nvme/debian:latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.inputs.ref || github.ref }}
          fetch-depth: 0

      - name: Mark repo as safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Get version info
        id: version
        run: |
          VERSION="$(git describe --always --abbrev=12 --dirty)"
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "Building version: ${VERSION}"
          echo "Current SHA: $(git rev-parse HEAD)"

      - name: Download Coverity Build Tool
        run: |
          curl -fsSL https://scan.coverity.com/download/linux64 \
            --data "token=${{ secrets.COVERITY_SCAN_TOKEN }}&project=linux-nvme%2Fnvme-cli" \
            --output coverity_tool.tgz
          mkdir coverity-tools
          tar xzf coverity_tool.tgz --strip-components=1 -C coverity-tools

      - name: Configure build
        run: |
          meson setup .build

      - name: Build with Coverity
        run: |
          export PATH="$PWD/coverity-tools/bin:$PATH"
          cov-build --dir cov-int ninja -C .build

      - name: Create Coverity tarball
        run: |
          tar czvf nvme-cli-coverity.tgz cov-int

      - name: Upload to Coverity Scan
        run: |
          curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \
            --form email=${{ secrets.COVERITY_SCAN_EMAIL }} \
            --form file=@nvme-cli-coverity.tgz \
            --form version="${{ steps.version.outputs.version }}" \
            --form description="Automated Coverity Scan from ${{ github.event_name }}" \
            https://scan.coverity.com/builds?project=linux-nvme%2Fnvme-cli

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        name: upload coverity artifacts
        if: failure()
        with:
          name: coverity-results
          path: |
            cov-int/
            nvme-cli-coverity.tgz