3 # Copyright 2019 Samsung Electronics Co., Ltd.
5 # Licensed under the Apache License, Version 2.0 (the "License");
6 # you may not use this file except in compliance with the License.
7 # You may obtain a copy of the License at
9 # http://www.apache.org/licenses/LICENSE-2.0
11 # Unless required by applicable law or agreed to in writing, software
12 # distributed under the License is distributed on an "AS IS" BASIS,
13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 # See the License for the specific language governing permissions and
15 # limitations under the License.
18 PS4='+['$(readlink -f "$0")' ${FUNCNAME[0]%main}#$LINENO] '
20 echo '---> maven-coverity.sh'
23 SUBMISSION_INITIAL_REST_INTERVAL=30 # seconds, will be doubled after each attempt
25 #-----------------------------------------------------------------------------
26 # Process parameters for JS/TS/Python/Ruby/PHP files analysis
28 if [ -n "${SEARCH_PATHS:=}" ]; then
29 for SEARCH_PATH in ${SEARCH_PATHS}; do
30 if [ -d "${SEARCH_PATH}" ]; then
31 FS_CAPTURE_SEARCH_PARAMS="${FS_CAPTURE_SEARCH_PARAMS:=} --fs-capture-search '${SEARCH_PATH}'"
33 echo "'${SEARCH_PATH}' from \$SEARCH_PATHS is not an existing directory." >&2
38 for EXCLUDE_REGEX in ${SEARCH_EXCLUDE_REGEXS:=}; do
39 EXCLUDE_REGEX=${EXCLUDE_REGEX//\'/\'\\\'\'} # escape single quote "'"
40 FS_CAPTURE_SEARCH_PARAMS="${FS_CAPTURE_SEARCH_PARAMS} --fs-capture-search-exclude-regex '${EXCLUDE_REGEX}'"
42 # FIXME: a hack to deal with temporary(?) non-functional filter to ignore
43 # specific source code parts by Coverity Scan ("--fs-capture-search-exclude-regex"
44 # CLI parameter for "cov-build" tool). The hack can be removed when this CLI
45 # parameter is fixed on Coverity side.
46 FS_CAPTURE_SEARCH_EXCLUDE_HACK_PARAMS="${FS_CAPTURE_SEARCH_EXCLUDE_HACK_PARAMS:=} --tu-pattern 'file('\\''${EXCLUDE_REGEX}'\\'')'"
50 #-----------------------------------------------------------------------------
51 # Check if we are allowed to submit results to Coverity Scan service
52 # and have not exceeded our upload quota limits
53 # See also: https://scan.coverity.com/faq#frequency
55 if [ "${DRY_RUN}" != 'true' ]; then
62 --form "project=${COVERITY_PROJECT_NAME}" \
63 --form "token=${COVERITY_TOKEN}" \
64 'https://scan.coverity.com/api/upload_permitted'
67 IS_COVERITY_UPLOAD_PERMITTED=$(
68 echo "${CURL_OUTPUT}" \
69 | jq '.upload_permitted'
71 if [ x"${IS_COVERITY_UPLOAD_PERMITTED}" != x'true' ]; then
72 echo "Upload quota reached. Next upload permitted at "$(echo "${CURL_OUTPUT}" | jq '.next_upload_permitted_at') >&2
77 #-----------------------------------------------------------------------------
78 # Get Coverity Scan build tool
85 --form "project=${COVERITY_PROJECT_NAME}" \
86 --form "token=${COVERITY_TOKEN}" \
87 --output 'coverity_tool.tgz' \
88 'https://scan.coverity.com/download/linux64'
95 --form "project=${COVERITY_PROJECT_NAME}" \
96 --form "token=${COVERITY_TOKEN}" \
98 --output 'coverity_tool.md5' \
99 'https://scan.coverity.com/download/linux64'
101 echo -n ' coverity_tool.tgz' >> 'coverity_tool.md5'
102 md5sum --check 'coverity_tool.md5'
107 --file='coverity_tool.tgz'
109 COVERITY_BUILD_TOOL_DIRECTORY=$(
114 --file='coverity_tool.tgz'
117 COVERITY_BINARY_DIRECTORY="${COVERITY_BUILD_TOOL_DIRECTORY}bin"
118 test -d "${COVERITY_BINARY_DIRECTORY}" \
120 export PATH="${PATH}:${COVERITY_BINARY_DIRECTORY}"
122 rm 'coverity_tool.tgz'
124 #-----------------------------------------------------------------------------
132 ${FS_CAPTURE_SEARCH_PARAMS:=} \
133 "${MVN}" clean install \
135 --global-settings "${GLOBAL_SETTINGS_FILE}" \
136 --settings "${SETTINGS_FILE}" \
140 # FIXME: a hack to deal with temporary(?) non-functional filter to ignore
141 # specific source code parts by Coverity Scan ("--fs-capture-search-exclude-regex"
142 # CLI parameter for "cov-build" tool). The hack can be removed when this CLI
143 # parameter is fixed on Coverity side.
144 if [ -n "${FS_CAPTURE_SEARCH_EXCLUDE_HACK_PARAMS:=}" ]; then
145 eval cov-manage-emit \
147 ${FS_CAPTURE_SEARCH_EXCLUDE_HACK_PARAMS} \
151 # Extract git data for analysed files
156 # List all analysed files from the project
162 '^Translation unit:$' \
165 's!^[[:digit:]]+ -> !!' \
167 > 'cov-int/coverity-scan-analysed-files.txt'
169 # List all analyzed files that are not tracked by SCM repository
177 > 'cov-int/scm-untracked-files.txt'
179 #-----------------------------------------------------------------------------
180 # Submit results to Coverity service
182 if [ "${DRY_RUN}" != 'true' ]; then
186 --file='results.tgz' \
189 for (( ATTEMPT=1; ATTEMPT<=SUBMISSION_ATTEMPTS; ATTEMPT++ )); do
196 --write-out '\n%{http_code}' \
197 --form "project=${COVERITY_PROJECT_NAME}" \
198 --form "email=${COVERITY_USER_EMAIL}" \
199 --form "token=${COVERITY_TOKEN}" \
200 --form 'file=@results.tgz' \
201 --form "version=${GIT_COMMIT:0:7}" \
202 --form "description=${GIT_BRANCH}" \
203 'https://scan.coverity.com/builds'
205 HTTP_RESPONSE_CODE=$(echo -n "${CURL_OUTPUT}" | tail -1)
206 test x"${HTTP_RESPONSE_CODE}" = x"200" \
209 sleep "${SUBMISSION_REST_INTERVAL:-$SUBMISSION_INITIAL_REST_INTERVAL}"
211 SUBMISSION_REST_INTERVAL=$(( ${SUBMISSION_REST_INTERVAL:-$SUBMISSION_INITIAL_REST_INTERVAL} * 2 ))
214 HTTP_RESPONSE=$(echo -n "${CURL_OUTPUT}" | head -n -1 | tr -d '\n')
215 if [ x"${HTTP_RESPONSE}" != x"Build successfully submitted." ]; then
216 echo "Coverity Scan service responded with '${HTTP_RESPONSE}' while 'Build successfully submitted.' expected." >&2
221 #-----------------------------------------------------------------------------