name: Coverity Scan analysis

on:
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  COVERITY_EMAIL: ${{ secrets.CoverityEmail }}
  COVERITY_TOKEN: ${{ secrets.CoverityToken }}
  BASE_DIR: "/dev/shm"
  PACKAGE: "/dev/shm/coverity-package/coverity.tar.zst"
  PACKAGE_DIR: "/dev/shm/coverity-package"
  # Latest package: https://scan.coverity.com/download
  PACKAGE_VERSION: "2023.6.2"
  # One-time download, then lives in GitHub cache
  TARBALL_URL: "https://kcgen.duckdns.org/coverity-2023.tar.zst"
  TARBALL_SHA256: "eeda957cab17f8f1602b011b4d187ebd6cb8e78b79bc4f5b0eab59ba38441104"

jobs:
  coverity_scan:
    name: Coverity static analyzer
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: false

      - run:  sudo apt-get update

      - name: Log and setup environment
        run: |
          ./scripts/log-env.sh
          mkdir -p "${PACKAGE_DIR}"

      - name: Install C++ compiler and dependencies
        run: |
          sudo apt-get install curl zstd clang $(cat packages/ubuntu-22.04-apt.txt)
          sudo pip3 install --upgrade meson ninja

      - name: Cache subprojects
        id:   cache-subprojects
        uses: actions/cache@v3.3.2
        with:
          path: subprojects.tar
          key: subprojects-${{ hashFiles('subprojects/*.wrap') }}-1
          enableCrossOsArchive: true

      - if:   steps.cache-subprojects.outputs.cache-hit != 'true'
        name: Generate subprojects cache
        run:  scripts/fetch-and-tar-subprojects.sh

      - name: Extract subprojects cache
        run:  scripts/extract-subprojects-tar.sh

      - name: Prepare the Coverity package cache
        uses: actions/cache@v3.3.2
        id: cache-coverity
        with:
          path: ${{ env.PACKAGE_DIR }}
          key: coverity-${{ env.PACKAGE_VERSION }}
      - name:  Fetch the Coverity package
        if:    steps.cache-coverity.outputs.cache-hit != 'true'
        run:   curl -L "${TARBALL_URL}" > "${PACKAGE}"

      - name: Install the Coverity package
        run: |
          set -xeuo pipefail
          echo "$TARBALL_SHA256 $PACKAGE" | sha256sum --check --status
          zstd --long=31 -dc "${PACKAGE}" | tar -C "${BASE_DIR}" -x

      - name: Build and instrument the project
        # Note: a non-debug buildtype is deliberately used to
        # prevent Coverity from reporting hundreds of warnings
        # against STL internals that we have no control over.
        run: |
          set -xeu
          CC="clang" CXX="clang++" meson setup \
          -Dbuildtype=minsize \
          -Db_ndebug=false \
          -Dunit_tests=disabled \
          -Duse_alsa=false \
          -Duse_fluidsynth=false \
          -Duse_mt32emu=false \
          -Duse_opengl=false \
          -Duse_sdl2_net=false \
          -Duse_slirp=false \
          -Duse_xinput2=false \
          -Duse_zlib_ng=false \
          build
          PATH="${BASE_DIR}/cov-analysis-linux64-${PACKAGE_VERSION}/bin:${PATH}"
          cov-build --dir cov-int meson compile -C build
          tar -cvaf package.tar.gz cov-int

      - name: Upload the package to Coverity
        run: |
          curl \
          --form token="${COVERITY_TOKEN}" \
          --form email="${COVERITY_EMAIL}" \
          --form file=@package.tar.gz \
          --form version="${GITHUB_REF}" \
          --form description="${GITHUB_REPOSITORY}" \
          "https://scan.coverity.com/builds?project=dosbox-staging"
