static_analysis.yml

---
  name: Coverity Static Analysis
  on:
    workflow_dispatch:
    schedule:
      - cron: "0 3 * * *"

  jobs:
    polaris-scan:
      name: Polaris Coverity Static Analysis
      permissions:
        packages: write
      runs-on: ubuntu-22.04
      env:
        VCPKG_NUGET_USER: ${{secrets.VCPKG_NUGET_USER || github.repository_owner}}
        VCPKG_NUGET_TOKEN: ${{secrets.VCPKG_NUGET_TOKEN || secrets.GITHUB_TOKEN}}
      steps:
        - name: Get number of CPU cores
          uses: SimenB/github-actions-cpu-cores@97ba232459a8e02ff6121db9362b09661c875ab8
          id: cpu-cores

        - name: Checkout Source
          uses: actions/checkout@v4
          with:
            submodules: recursive
            fetch-depth: 0

        - name: Setup build dependencies
          run: |
            sudo apt-get update
            sudo apt-get install -y gcc-10 g++-10 make mono-complete libkrb5-dev libsasl2-dev

        - name: Setup VCPKG cache
          run: |
            . build_tooling/vcpkg_caching.sh
            echo -e "VCPKG_BINARY_SOURCES=$VCPKG_BINARY_SOURCES
            VCPKG_ROOT=$PLATFORM_VCPKG_ROOT" | tee -a $GITHUB_ENV

        - name: Get CMake
          uses: lukka/get-cmake@latest

        - name: CMake configure
          uses: lukka/run-cmake@v10.8
          env:
            CC: "gcc-10"
            CXX: "g++-10"
          with:
            cmakeListsTxtPath: ${{github.workspace}}/cpp/CMakeLists.txt
            configurePreset: linux-release
            configurePresetAdditionalArgs: "['-DVCPKG_INSTALL_OPTIONS=--clean-after-build', '-DCMAKE_C_COMPILER=gcc-10', '-DCMAKE_CXX_COMPILER=g++-10']"

        - name: Copy Coverity config
          run: cp ${{github.workspace}}/coverity.yaml ${{github.workspace}}/cpp/out/linux-release-build

        - name: Polaris PR Scan
          uses: synopsys-sig/synopsys-action@v1.13.0
          with:
            polaris_server_url: ${{ vars.POLARIS_SERVER_URL }}
            polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }}
            polaris_application_name: "ArcticDB"
            polaris_project_name: "ArcticDB-core"
            polaris_assessment_types: "SAST"
            polaris_prComment_enabled: true
            polaris_waitForScan: true
            coverity_build_command: make -j ${{ steps.cpu-cores.outputs.count }}
            coverity_clean_command: make clean
            github_token: ${{ secrets.POLARIS_GITHUB_TOKEN }}
            project_directory: ${{github.workspace}}/cpp/out/linux-release-build
            include_diagnostics: true
            polaris_reports_sarif_create: true
            polaris_reports_sarif_groupSCAIssues: true
            polaris_upload_sarif_report: true
            polaris_prComment_severities: "high,critical,medium,low"