coverity setup

[vapier]

@pierrejoye can you add me as an admin to https://scan.coverity.com/projects/libgd ? i'm setting up the GH action workflow for it but need access to the secrets to connect GH to it.

i have the action working on other OSS projects, so should be pretty easy for gd.

[pierrejoye]

Done, thansk!

[vapier]

thanks, should be live now:
https://github.com/libgd/libgd/actions/workflows/coverity.yml

we get ~10 scans a day, so should be good enough for us.
https://scan.coverity.com/projects/libgd

[cmb69]

"38 new defect(s) introduced to libgd/libgd found with Coverity Scan." ugh

[vapier]

i'm just the messenger ;)

[pierrejoye]

Thanks Mike. :) I see many are in gdTests or tests themselves. 2-3 are actaully in GD but I am not sure if they are not false positives (or sanitizer and co would have failed too I suppose, but I don't know how they fuzz it or only static analyzes) )I will take a look asap.

…

On Tue, Oct 5, 2021 at 8:35 PM Mike Frysinger ***@***.***> wrote: i'm just the messenger ;) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#783 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACE6KE3XUHYYB7TCRGB3E3UFL5JTANCNFSM5FKZNYJA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- Pierre @pierrejoye | http://www.libgd.org

[cmb69]

Coverity is just static analysis.

[vapier]

I debated whether to include the tests in the build. I ended up including them because the tests largely are "real" programs in that they all use the API correctly and as we intend. the checker might highlight something we didn't think of in how the API works. usually bad inputs are passed in as blobs which the checker wouldn't see

I'm sure sometimes we're a bit lazy with the tests and how we do (or do not) include error checking or cleanups. I figure it's a small price to include all the right asserts and cleanups to improve the checker and fuzzer and leak detector.

but if people feel strongly, we can always update the builder, or add those subdirs to the ignore list.

[pierrejoye]

That's totally fine. They should be clean too for the reasons you mentioned :)

…

On Wed, Oct 6, 2021 at 6:21 PM Mike Frysinger ***@***.***> wrote: I debated whether to include the tests in the build. I ended up including them because the tests largely are "real" programs in that they all use the API correctly and as we intend. the checker might highlight something we didn't think of in how the API works. usually bad inputs are passed in as blobs which the checker wouldn't see I'm sure sometimes we're a bit lazy with the tests and how we do (or do not) include error checking or cleanups. I figure it's a small price to include all the right asserts and cleanups to improve the checker and fuzzer and leak detector. but if people feel strongly, we can always update the builder, or add those subdirs to the ignore list. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#783 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACE6KGAYEE7U25ZWWAX4PTUFQWKNANCNFSM5FKZNYJA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- Pierre @pierrejoye | http://www.libgd.org

[pierrejoye]

For the record here, all cleaned. All green in coverty, 0 left :)