Add Coverity and Trivy scan workflow (#3)

* Add Coverity scan workflow

* Restructure CI: move coverity and trivy into reusable actions under analysis

* Trigger CI and daily build on PRs targeting main

* Fix coverity download: prefer wget with --no-proxy over curl

* Fix coverity: use --gcc template to capture all compiler variants

* Fix coverity: configure cc compiler and clean build for proper capture

* Fix coverity: use executable name 'cc' not full path with --template

* Fix coverity: trust SSL cert for commit-defects, simplify compiler config

* Fix coverity: remove --ssl flag (incompatible with https URL), keep --on-new-cert trust

* Add SSL cert import step to coverity action

* Remove coverity download/install and cert import steps (pre-installed on runner)

* Remove cov-commit-defects and unused secrets/inputs

* ci: serialize scans, consolidate reports under single artifact

- Add shellcheck as dedicated sub-action (analysis/shellcheck/)
- Remove analysis wrapper action.yml (no longer needed)
- Save coverity console output to reports/coverity_scan.txt
- Save trivy console output to reports/trivy_scan.txt
- Move all coverity/trivy reports to \/reports/
- Remove binary size/symbol check from build action
- Serialize build, smoke, unit-tests, shellcheck, coverity, trivy
  in a single job across ci, daily_build, pull_request workflows
- Upload all reports under one artifact link per workflow run

* ci: remove pull_request trigger from daily_build workflow

daily_build was firing on PRs to main alongside ci, causing
duplicate runs. Restrict to schedule and push to main only.

---------

Co-authored-by: D M, Karthik <karthik.d.m@intel.com>

Author: roshan-ku

.github/actions/analysis/coverity/action.yml

@@ -0,0 +1,56 @@
+#
+# BSD 3-Clause License
+# Copyright (C) 2026 Intel Corporation
+# SPDX-License-Identifier: BSD-3-Clause
+#
+name: 'Coverity Scan'
+description: 'Run Coverity static analysis (assumes Coverity pre-installed on runner)'
+
+runs:
+  using: composite
+  steps:
+    - name: Set up MTL environment
+      shell: bash
+      run: |
+        if pkg-config --exists mtl 2>/dev/null; then
+          echo "MTL already discoverable via pkg-config"
+          exit 0
+        fi
+        MTL_PC=$(find /usr /home /opt -name "mtl.pc" 2>/dev/null | head -1)
+        if [ -z "$MTL_PC" ]; then
+          echo "ERROR: MTL pkg-config file not found under /usr, /home, or /opt."
+          echo "Please ensure Media Transport Library is built and installed on the runner."
+          exit 1
+        fi
+        MTL_PC_DIR=$(dirname "$MTL_PC")
+        echo "Found MTL pkgconfig at: $MTL_PC_DIR"
+        echo "PKG_CONFIG_PATH=${MTL_PC_DIR}:${PKG_CONFIG_PATH}" >> "$GITHUB_ENV"
+
+    - name: Coverity Scan
+      shell: bash
+      run: |
+        cd "$GITHUB_WORKSPACE"
+        REPORT_DIR="$GITHUB_WORKSPACE/reports"
+        mkdir -p "$REPORT_DIR"
+
+        {
+          # Configure Coverity for cc (meson uses cc which is gcc)
+          $HOME/coverity/bin/cov-configure --compiler cc --comptype gcc --template
+
+          # Clean and setup meson build directory
+          rm -rf build coverity_output
+          meson setup build
+
+          # Run cov-build wrapping the ninja compilation
+          $HOME/coverity/bin/cov-build --dir coverity_output/ ninja -C build
+
+          # Analyze captured build
+          $HOME/coverity/bin/cov-analyze --dir coverity_output/ \
+            --webapp-security \
+            --enable-audit-checkers \
+            --enable-default
+
+          # Generate JSON report
+          $HOME/coverity/bin/cov-format-errors --dir coverity_output/ \
+            --json-output-v8 "$REPORT_DIR/coverity-report.json"
+        } 2>&1 | tee "$REPORT_DIR/coverity_scan.txt"

.github/actions/analysis/shellcheck/action.yml

@@ -0,0 +1,19 @@
+#
+# BSD 3-Clause License
+# Copyright (C) 2026 Intel Corporation
+# SPDX-License-Identifier: BSD-3-Clause
+#
+name: 'ShellCheck'
+description: 'Run shellcheck on shell scripts. Report written to $GITHUB_WORKSPACE/reports/'
+
+runs:
+  using: composite
+  steps:
+    - name: shellcheck scripts
+      shell: bash
+      run: |
+        REPORT_DIR="$GITHUB_WORKSPACE/reports"
+        mkdir -p "$REPORT_DIR"
+        echo "===== shellcheck Script Analysis ====="
+        shellcheck scripts/build.sh scripts/test.sh 2>&1 | tee "$REPORT_DIR/shellcheck-report.txt" || true
+        echo "shellcheck scan complete. Report: $REPORT_DIR/shellcheck-report.txt"

.github/actions/analysis/trivy/action.yml

@@ -0,0 +1,53 @@
+#
+# BSD 3-Clause License
+# Copyright (C) 2026 Intel Corporation
+# SPDX-License-Identifier: BSD-3-Clause
+#
+name: 'Trivy Scan'
+description: 'Run Trivy filesystem, config, and secret scans'
+
+runs:
+  using: composite
+  steps:
+    - name: Verify Trivy installation
+      shell: bash
+      run: |
+        if ! command -v trivy > /dev/null 2>&1; then
+          echo "ERROR: Trivy is not installed or not available in PATH for the runner user."
+          echo "Install Trivy on the self-hosted runner and ensure PATH includes the binary location."
+          echo "If installed via snap, verify /snap/bin is available to the runner service."
+          exit 1
+        fi
+        trivy --version
+
+    - name: Trivy filesystem scan
+      shell: bash
+      run: |
+        REPORT_DIR="$GITHUB_WORKSPACE/reports"
+        mkdir -p "$REPORT_DIR"
+        {
+          echo "===== Trivy Filesystem Scan ====="
+          trivy fs --list-all-pkgs --format json \
+            --output "$REPORT_DIR/trivy-fs-full-report.json" . || true
+          trivy fs --ignore-unfixed . | tee "$REPORT_DIR/trivy-fs-report.txt"
+        } 2>&1 | tee -a "$REPORT_DIR/trivy_scan.txt"
+
+    - name: Trivy config scan
+      shell: bash
+      run: |
+        REPORT_DIR="$GITHUB_WORKSPACE/reports"
+        mkdir -p "$REPORT_DIR"
+        {
+          echo "===== Trivy Config Scan ====="
+          trivy config . | tee "$REPORT_DIR/trivy-config-report.txt"
+        } 2>&1 | tee -a "$REPORT_DIR/trivy_scan.txt" || true
+
+    - name: Trivy secret scan
+      shell: bash
+      run: |
+        REPORT_DIR="$GITHUB_WORKSPACE/reports"
+        mkdir -p "$REPORT_DIR"
+        {
+          echo "===== Trivy Secret Scan ====="
+          trivy fs --scanners secret . | tee "$REPORT_DIR/trivy-secret-report.txt"
+        } 2>&1 | tee -a "$REPORT_DIR/trivy_scan.txt" || true

.github/actions/build-dvledtx/action.yml

@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: BSD-3-Clause
 #
 name: 'Build dvledtx'
-description: 'Build dvledtx with FFMPEG and MTL TX APIs, keep both binaries, run binary size/symbol check for each'
+description: 'Build dvledtx with FFMPEG and MTL TX APIs, keep both binaries'
 
 runs:
   using: composite
@@ -34,26 +34,3 @@ runs:
         mkdir -p ./bins
         cp ./build/dvledtx ./bins/dvledtx-mtl
         echo "MTL build saved: $(file ./bins/dvledtx-mtl)"
-
-    - name: Binary size and symbol check
-      shell: bash
-      run: |
-        REPORT_DIR="$GITHUB_WORKSPACE/reports"
-        mkdir -p "$REPORT_DIR"
-
-        for BINARY in ./bins/dvledtx-ffmpeg ./bins/dvledtx-mtl; do
-          NAME=$(basename "$BINARY")
-          echo "" | tee -a "$REPORT_DIR/binary-report.txt"
-          echo "===== $NAME: Binary Size =====" | tee -a "$REPORT_DIR/binary-report.txt"
-          size "$BINARY" | tee -a "$REPORT_DIR/binary-report.txt"
-
-          echo "" | tee -a "$REPORT_DIR/binary-report.txt"
-          echo "===== $NAME: Shared Library Dependencies =====" | tee -a "$REPORT_DIR/binary-report.txt"
-          readelf -d "$BINARY" | grep NEEDED | tee -a "$REPORT_DIR/binary-report.txt"
-
-          echo "" | tee -a "$REPORT_DIR/binary-report.txt"
-          echo "===== $NAME: Undefined External Symbols =====" | tee -a "$REPORT_DIR/binary-report.txt"
-          nm -u "$BINARY" | tee -a "$REPORT_DIR/binary-report.txt"
-        done
-
-        echo "Binary report saved to $REPORT_DIR/binary-report.txt"

.github/actions/environment-check/action.yml

@@ -49,12 +49,12 @@ runs:
         fi
         echo "All required pip packages present."
 
-    - name: Check static analysis tools
+    - name: Check analysis tools
       shell: bash
       run: |
-        echo "===== Static Analysis Tools Check ====="
+        echo "===== Analysis Tools Check ====="
         MISSING=""
-        for TOOL in cppcheck flawfinder shellcheck codespell; do
+        for TOOL in shellcheck; do
           if command -v "$TOOL" &>/dev/null; then
             echo "  [OK] $TOOL ($(command -v "$TOOL"))"
           else
@@ -63,10 +63,10 @@ runs:
           fi
         done
         if [ -n "$MISSING" ]; then
-          echo "ERROR: Missing static analysis tools:$MISSING"
+          echo "ERROR: Missing analysis tools:$MISSING"
           exit 1
         fi
-        echo "All required static analysis tools present."
+        echo "All required analysis tools present."
 
     - name: Check system libraries
       shell: bash

.github/actions/static-analysis/action.yml

@@ -3,21 +3,26 @@
 # Copyright (C) 2026 Intel Corporation
 # SPDX-License-Identifier: BSD-3-Clause
 #
-name: DVLED App CI
+name: Continuous Integration
 
 on:
   push:
     branches:
       - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
 
 jobs:
-  static-analysis:
+  ci:
     name: Continuous Integration
     runs-on: self-hosted
     steps:
       - name: Clean up previous run
         run: |
           find "${{ github.workspace }}" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          rm -rf /tmp/trivy-*
 
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -28,13 +33,28 @@ jobs:
       - name: Environment check
         uses: ./.github/actions/environment-check
 
-      - name: Static analysis
-        uses: ./.github/actions/static-analysis
+      - name: Build dvledtx
+        uses: ./.github/actions/build-dvledtx
+
+      - name: Smoke test
+        uses: ./.github/actions/smoke-tests
+
+      - name: Run unit tests
+        uses: ./.github/actions/unit-tests
+
+      - name: ShellCheck
+        uses: ./.github/actions/analysis/shellcheck
+
+      - name: Coverity Scan
+        uses: ./.github/actions/analysis/coverity
+
+      - name: Trivy Scan
+        uses: ./.github/actions/analysis/trivy
 
-      - name: Upload static analysis reports
+      - name: Upload all reports
         uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: static-analysis-reports-${{ github.run_id }}
+          name: all-scan-reports-${{ github.run_id }}
           path: ${{ github.workspace }}/reports/
           retention-days: 30

.github/workflows/ci.yml

@@ -13,7 +13,6 @@ on:
   push:
     branches:
       - main
-
   workflow_dispatch:
 
 jobs:
@@ -46,8 +45,14 @@ jobs:
       - name: Run unit tests
         uses: ./.github/actions/unit-tests
 
-      - name: Static analysis
-        uses: ./.github/actions/static-analysis
+      - name: ShellCheck
+        uses: ./.github/actions/analysis/shellcheck
+
+      - name: Coverity Scan
+        uses: ./.github/actions/analysis/coverity
+
+      - name: Trivy Scan
+        uses: ./.github/actions/analysis/trivy
 
       - name: Upload daily build reports
         uses: actions/upload-artifact@v4

.github/workflows/daily_build.yml

@@ -45,8 +45,14 @@ jobs:
       - name: Run unit tests
         uses: ./.github/actions/unit-tests
 
-      - name: Static analysis
-        uses: ./.github/actions/static-analysis
+      - name: ShellCheck
+        uses: ./.github/actions/analysis/shellcheck
+
+      - name: Coverity Scan
+        uses: ./.github/actions/analysis/coverity
+
+      - name: Trivy Scan
+        uses: ./.github/actions/analysis/trivy
 
       - name: Upload PR reports
         uses: actions/upload-artifact@v4