Skip to content

Commit ac06db0

Browse files
sowmiar1sowmiar1
authored
[CI/CD][DLSPS] Added coverity scan for dlsps. (open-edge-platform#570)
1 parent d9515cd commit ac06db0

File tree

3 files changed

+190
-45
lines changed

3 files changed

+190
-45
lines changed

‎.github/workflows/dlsps-build-scans-pr-workflow.yaml‎

Lines changed: 92 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,6 @@ jobs:
3434
persist-credentials: false
3535
path: edge-ai-libraries-repo
3636

37-
- name: Init submodules
38-
run: |
39-
cd edge-ai-libraries-repo
40-
git submodule update --init libraries/dl-streamer/thirdparty/spdlog
41-
4237
- name: Log in to GitHub Container Registry
4338
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #3.4.0
4439
with:
@@ -93,7 +88,7 @@ jobs:
9388
uses: actions/upload-artifact@v4
9489
with:
9590
name: Coverage-reports
96-
path: /tmp/htmlcov
91+
path: /tmp/htmlcov
9792
- name: Scan Docker image with Trivy
9893
uses: ./edge-ai-libraries-repo/.github/actions/common/trivy-image-scan
9994
with:
@@ -108,12 +103,33 @@ jobs:
108103
severity: "CRITICAL"
109104
# output-format: "json"
110105
output-file: "dlsps-${{ matrix.ubuntu_version }}-extended-trivy-image-report.txt"
111-
- name: Upload Trivy report as artifact
106+
- name: Upload Trivy image report as artifact
112107
if: always()
113108
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #4.6.2
114109
with:
115110
name: dlsps-${{ matrix.ubuntu_version }}-trivy-image-report
116111
path: dlsps-${{ matrix.ubuntu_version }}*-trivy-image-report.txt
112+
113+
- name: Run Trivy Filesystem Scan
114+
if: matrix.ubuntu_version == 'ubuntu22'
115+
run: |
116+
117+
docker pull aquasec/trivy:0.63.0
118+
cd edge-ai-libraries-repo/microservices/dlstreamer-pipeline-server/
119+
mkdir -p reports
120+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/html.tpl -o trivy-html.tpl
121+
122+
docker run --rm -v `pwd`:/src aquasec/trivy:0.63.0 fs /src/ --format template --template "@/src/trivy-html.tpl" -o "/src/reports/trivy_fs_code_scan.html" || true
123+
docker run --rm -v `pwd`:/src aquasec/trivy:0.63.0 fs --list-all-pkgs --format template --template "@/src/trivy-html.tpl" --output "/src/reports/trivy-fs-full-report.csv" /src/ || true
124+
docker run --rm -v `pwd`:/src aquasec/trivy:0.63.0 fs --ignore-unfixed /src | tee ./reports/trivy-fs-full-report.txt
125+
mv ./reports ${{ github.workspace }}
126+
- name: Upload Trivy Filesystem Reports
127+
if: matrix.ubuntu_version == 'ubuntu22'
128+
uses: actions/upload-artifact@v4
129+
with:
130+
name: trivy-fs-reports
131+
path: reports/*
132+
117133
- name: Create summary
118134
if: always()
119135
run: |
@@ -173,52 +189,83 @@ jobs:
173189
docker rmi -f $(docker images -aq) || true
174190
fi
175191
176-
filter-docker-related-changes:
192+
193+
trivy-config-dockerfile-scan:
177194
permissions:
178195
contents: read
179-
name: Detect changes in docker directory
196+
name: Scan Dockerfile
197+
strategy:
198+
fail-fast: false
199+
uses: ./.github/workflows/trivy-config-mode.yaml
200+
with:
201+
dockerfile-path: microservices/dlstreamer-pipeline-server/Dockerfile
202+
trivy-report-format: 'json'
203+
severity-levels: 'HIGH,CRITICAL'
204+
output-report-path: reports/dlsps_trivy_report.json
205+
name: dlsps_trivy_report
206+
207+
pylint:
180208
runs-on: ubuntu-latest
181-
outputs:
182-
docker_changed: ${{ steps.check.outputs.docker_changed }}
209+
183210
steps:
184211
- name: Check out edge-ai-libraries repository
185212
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
186213
with:
187214
persist-credentials: false
188-
fetch-depth: 0
215+
path: edge-ai-libraries-repo
189216

190-
- name: Fetch main branch for comparison
191-
run: git fetch origin main
217+
- name: Set up Python
218+
uses: actions/setup-python@v5
219+
with:
220+
python-version: '3.10'
192221

193-
- id: check
194-
name: Detect changes in docker directory
222+
- name: Install dependencies from all requirements.txt files
195223
run: |
196-
echo "🔍 Checking for changes in 'microservices/dlstreamer-pipeline-server/docker'..."
197-
CHANGED_FILES=$(git diff --name-only origin/main HEAD)
198-
echo "📄 Changed files:"
199-
echo "$CHANGED_FILES"
200-
if echo "$CHANGED_FILES" | grep -q '^microservices/dlstreamer-pipeline-server/docker'; then
201-
echo "docker_changed=true" >> "$GITHUB_OUTPUT"
202-
echo "🟡 Docker-related changes detected."
203-
else
204-
echo "docker_changed=false" >> "$GITHUB_OUTPUT"
205-
echo "✅ No docker-related changes."
206-
fi
207-
208-
trivy-config-scan:
209-
permissions:
210-
contents: read
211-
needs: [filter-docker-related-changes]
212-
if: needs.filter-docker-related-changes.outputs.docker_changed == 'true'
213-
name: Scan dlsps docker file
214-
strategy:
215-
fail-fast: false
216-
217-
uses: ./.github/workflows/trivy-config-mode.yaml
218-
with:
219-
dockerfile-path: microservices/dlstreamer-pipeline-server/
220-
trivy-report-format: 'json'
221-
severity-levels: 'HIGH,CRITICAL'
222-
output-report-path: reports/dlsps_trivy_report.json
223-
name: dlsps_trivy_report
224-
224+
python -m pip install --upgrade pip
225+
cd edge-ai-libraries-repo/microservices/dlstreamer-pipeline-server/
226+
find . -type f -iname 'requirements.txt' -exec pip install -r {} \;
227+
228+
- name: Install pylint
229+
run: pip install pylint
230+
231+
- name: Run pylint
232+
run: |
233+
cd edge-ai-libraries-repo/microservices/dlstreamer-pipeline-server
234+
find . -type f -iname '*.py' -exec pylint --errors-only --disable=import-error {} \; > pylint_report.txt || true
235+
cp pylint_report.txt ${{ github.workspace }}
236+
echo "### Pylint Results" >> $GITHUB_STEP_SUMMARY
237+
echo "Please find pylint report in pylint-report.txt" >> $GITHUB_STEP_SUMMARY
238+
239+
- name: Upload pylint report as artifact
240+
uses: actions/upload-artifact@v4
241+
with:
242+
name: pylint-report
243+
path: pylint_report.txt
244+
shellcheck:
245+
runs-on: ubuntu-latest
246+
247+
steps:
248+
- name: Check out edge-ai-libraries repository
249+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
250+
with:
251+
persist-credentials: false
252+
path: edge-ai-libraries-repo
253+
254+
- name: Install ShellCheck
255+
run: sudo apt-get update && sudo apt-get install -y shellcheck
256+
257+
- name: Run ShellCheck
258+
run: |
259+
cd edge-ai-libraries-repo/microservices/dlstreamer-pipeline-server/
260+
echo "Scanning for .sh files and running ShellCheck..."
261+
find . -type f -name "*.sh" | tee shell_files.txt | xargs -r shellcheck -f gcc > shellcheck_report.txt || true
262+
echo "### ShellCheck Results" >> $GITHUB_STEP_SUMMARY
263+
echo "Please find ShellCheck report in shellcheck_report.txt" >> $GITHUB_STEP_SUMMARY
264+
cp shellcheck_report.txt ${{ github.workspace }}
265+
266+
- name: Upload ShellCheck report
267+
uses: actions/upload-artifact@v4
268+
with:
269+
name: shellcheck-report
270+
path: shellcheck_report.txt
271+

‎.github/workflows/dlsps_coverity.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: "[DLSPS] Coverity workflow for C/C++"
2+
run-name: "[DLSPS] Coverity scan (by @${{ github.actor }} via ${{ github.event_name }})"
3+
on:
4+
push:
5+
branches:
6+
- 'main'
7+
paths:
8+
- 'microservices/dlstreamer-pipeline-server/**'
9+
10+
pull_request:
11+
paths:
12+
- 'microservices/dlstreamer-pipeline-server/**'
13+
14+
workflow_call:
15+
permissions: {}
16+
17+
18+
jobs:
19+
coverity-scan:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
packages: write
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- ubuntu_version: ubuntu22
30+
31+
steps:
32+
- name: Check out edge-ai-libraries repository
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
34+
with:
35+
persist-credentials: false
36+
path: edge-ai-libraries-repo
37+
- name: Log in to GitHub Container Registry
38+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #3.4.0
39+
with:
40+
registry: ghcr.io
41+
username: ${{ github.actor }}
42+
password: ${{ secrets.GITHUB_TOKEN }}
43+
- name: Build dls-pipeline-server-img
44+
run: |
45+
cd edge-ai-libraries-repo/microservices/dlstreamer-pipeline-server/docker
46+
export DLSTREAMER_PIPELINE_SERVER_IMAGE=intel/dlstreamer-pipeline-server:coverity-${{ matrix.ubuntu_version }}
47+
export DLSTREAMER_PIPELINE_SERVER_DOCKERFILE=Dockerfile
48+
export BASE_IMAGE="ghcr.io/open-edge-platform/edge-ai-libraries/deb-final-img-ubuntu22:candidate1407"
49+
export BUILD_TARGET=gstudfloader-builder
50+
docker compose build --no-cache --pull
51+
52+
- name: Run Coverity Scans.
53+
run: |
54+
cd edge-ai-libraries-repo/microservices/dlstreamer-pipeline-server/tests
55+
echo DLSPS_COVERITY_TOKEN=${{secrets.DLSPS_COVERITY_TOKEN}} >> .env
56+
echo DLSPS_COVERITY_EMAIL=${{secrets.DLSPS_COVERITY_EMAIL}} >> .env
57+
echo DLSPS_COVERITY_PROJECT=${{secrets.DLSPS_COVERITY_PROJECT}} >> .env
58+
docker run --rm --env-file .env -v `pwd`:/app -v /tmp:/tmp intel/dlstreamer-pipeline-server:coverity-ubuntu22 /bin/bash /app/coverity.sh
59+
- name: Upload Coverity Reports to Github
60+
61+
uses: actions/upload-artifact@v4
62+
with:
63+
name: Coverity-reports
64+
path: /tmp/coverity-output.tgz
65+
- name: Clean up
66+
if: always()
67+
run: |
68+
rm -rf edge-ai-libraries-repo
69+
sudo rm -rf /tmp/coverity-output.tgz
70+
docker rmi intel/dlstreamer-pipeline-server:coverity-${{ matrix.ubuntu_version }} || true
71+

‎microservices/dlstreamer-pipeline-server/tests/coverity.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
#
3+
# Apache v2 license
4+
# Copyright (C) 2024 Intel Corporation
5+
# SPDX-License-Identifier: Apache-2.0
6+
#
7+
8+
apt update
9+
apt install -y curl
10+
cd /home/pipeline-server/gst-udf-loader/
11+
wget --quiet https://scan.coverity.com/download/linux64 --post-data "token=$DLSPS_COVERITY_TOKEN&project=$DLSPS_COVERITY_PROJECT" -O coverity_tool.tgz
12+
mkdir cov-analysis
13+
tar xzf coverity_tool.tgz --strip-components=1 -C cov-analysis
14+
/bin/bash -c "cd /home/pipeline-server/gst-udf-loader/ \
15+
&& if [ -d \"build\" ] ; then rm -rf build ; fi \
16+
&& mkdir build \
17+
&& cd gst_plugin && sed -i '/dlstreamer_gst_meta/c\\\t/opt/intel/dlstreamer/lib/libdlstreamer_gst_meta.so' CMakeLists.txt && cd .. \
18+
&& cd build \
19+
&& cmake -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} -DCMAKE_INSTALL_INCLUDEDIR=${CMAKE_INSTALL_PREFIX}/include -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX} .. \
20+
&& /home/pipeline-server/gst-udf-loader/cov-analysis/bin/cov-build --dir cov-int make"
21+
22+
cd /home/pipeline-server/gst-udf-loader/build
23+
echo "Create tarball for upload"
24+
tar czf coverity-output.tgz cov-int
25+
echo "Upload to Coverity Scan"
26+
curl --form token=$DLSPS_COVERITY_TOKEN --form email=$DLSPS_COVERITY_EMAIL --form [email protected] --form version="`date +%Y%m%d%H%M%S`" --form description="GitHub Action upload" https://scan.coverity.com/builds?project=$DLSPS_COVERITY_PROJECT
27+
cp coverity-output.tgz /tmp/

0 commit comments

Comments
 (0)