coverity-scan-ubuntu.yml

name: Coverity Scan

# We only want to test official release code, not every pull request.
on:
  push:
    branches: [modernize]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  coverity:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      security-events: write

    steps:
      - name: Tools
        run: |
          #sudo add-apt-repository ppa:ubuntu-toolchain-r/test
          sudo apt-get update
          sudo apt-get dist-upgrade -y
          sudo apt-get install -y gcc-11 g++-11 gettext
          sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 50
          sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-11 50

      - name: Get cmake and ninja
        uses: lukka/get-cmake@latest

      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Configure
        run: |
          cmake --preset=linux-release -B build -S .

      - name: Coverity Scan
        uses: vapier/coverity-scan-action@v1
        with:
          working-directory: build
          command: cmake --build .
          email: ${{ secrets.COVERITY_SCAN_EMAIL }}
          token: ${{ secrets.COVERITY_SCAN_TOKEN }}