6db81ded28
Adds a new YAML file to handle Coverity analysis using the licensed on-prem server instead of the free Coverity Scan service. References: PCF-1795 Signed-off-by: Mouna Aloui <mouna.aloui@softathome.com>
121 lines
4.5 KiB
YAML
121 lines
4.5 KiB
YAML
include:
|
|
- project: blackduck-inc/black-duck-security-scan
|
|
ref: v2.3.0
|
|
file: templates/security_scan.yml
|
|
|
|
.coverity scan config:
|
|
stage: coverity
|
|
image: "$CI_REGISTRY_IMAGE/$CI_DESIGNATED_BRANCH_SLUG/builder:latest"
|
|
needs: []
|
|
timeout: 10 hours
|
|
tags:
|
|
- firmware-builder
|
|
variables:
|
|
BRIDGE_COVERITY_CONNECT_URL: https://coverity.prplfoundation.org
|
|
BRIDGE_COVERITY_CONNECT_USER_NAME: admin
|
|
BRIDGE_COVERITY_CONNECT_USER_PASSWORD: $COVERITY_PASSPHRASE
|
|
BRIDGE_GITLAB_USER_TOKEN: $GITLAB_API_KEY_EXTERNAL
|
|
BRIDGE_COVERITY_LOCAL: true
|
|
# INCLUDE_DIAGNOSTICS: 'true'
|
|
rules:
|
|
- if: ($CI_COMMIT_REF_NAME =~ $SCAN_BRANCHES && $CI_PIPELINE_SOURCE != 'merge_request_event')
|
|
variables:
|
|
BRIDGE_COVERITY_CONNECT_POLICY_VIEW: Outstanding Issues
|
|
- if: ($CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ $SCAN_BRANCHES && $CI_PIPELINE_SOURCE == 'merge_request_event')
|
|
variables:
|
|
BRIDGE_COVERITY_AUTOMATION_PRCOMMENT: true
|
|
before_script:
|
|
- apt-get -qq update && apt-get install -y curl file unzip
|
|
- touch .build_failed
|
|
- mkdir -p logs
|
|
- set -o pipefail
|
|
- git config --global --add safe.directory '*'
|
|
|
|
- |
|
|
crlf_check_failed=$(rgrep -U $'\x0D' profiles | cut -d: -f1 | sort -u || true)
|
|
if test -n "$crlf_check_failed"; then
|
|
echo -e "ERROR: detected CRLF issues in the following YAML profiles:\n"
|
|
for profile in $crlf_check_failed; do
|
|
echo " * $profile"
|
|
done
|
|
echo -e "\nIt might result in hard to debug issues, please fix them."
|
|
exit 1
|
|
fi
|
|
|
|
- |
|
|
if [ -z "$CI_COMMIT_TAG" ] && [ "$CI_DESIGNATED_BRANCH" != "$CI_COMMIT_BRANCH" ]; then
|
|
echo "Enabling coredumps and exception tracing in the build."
|
|
export CI_BUILD_ENABLE_COREDUMPS=1
|
|
export CI_BUILD_ENABLE_EXCEPTION_TRACE=1
|
|
else
|
|
echo "Coredumps and exception tracing are disabled in this build."
|
|
fi
|
|
|
|
- for script in .gitlab/scripts/build.d/*; do bash "$script"; done
|
|
|
|
- >
|
|
if echo "$CI_RUNNER_DESCRIPTION" | grep -v -q "Restricted.*OSP"; then
|
|
sed -i -E 's;git.openwrt.org/(feed|project);github.com/openwrt;' feeds.conf.default
|
|
export CI_BUILD_PROFILE="$(echo $CI_JOB_NAME | sed 's/coverity scan \(.*\)/\1/')"
|
|
scripts/gen_config.py $CI_BUILD_PROFILE 2>&1 | tee logs/build.log
|
|
git checkout -- feeds.conf.default
|
|
|
|
for option in $CI_BUILD_CONFIG $CI_BUILD_CONFIG_EXTRA; do
|
|
echo "$option" | sed -E "s/^\+(.*)$/CONFIG_\1=y/;s/^\-(.*)$/CONFIG_\1=n/" >> .config
|
|
done
|
|
cat .config
|
|
make defconfig | tee --append logs/build.log
|
|
|
|
make -j $(nproc) tools/tar/compile 2>&1 | tee --append logs/build.log
|
|
if [[ "$CI_MERGE_REQUEST_LABELS" == *"skip_integrity_check"* ]]; then
|
|
make -j $(nproc) download 2>&1 | tee --append logs/build.log
|
|
else
|
|
make -j $(nproc) download check FIXUP=1 2>&1 | tee --append logs/build.log
|
|
fi
|
|
else
|
|
grep --color -e "Error updating feeds" -e "ERROR:.*failed to build." logs/build.log && exit 1
|
|
fi
|
|
|
|
- >
|
|
git diff-index --exit-code HEAD || {
|
|
ret=$?
|
|
echo "Package integrity issues, please check the output bellow or packages-hash-issues.patch from artifacts"
|
|
git diff | tee packages-hash-issues.patch
|
|
exit $ret
|
|
}
|
|
|
|
- >
|
|
topdir=$(pwd);
|
|
for feed in $(find feeds -name .git); do
|
|
pushd $(dirname $feed) > /dev/null; git diff-index --exit-code HEAD || {
|
|
ret=$?
|
|
echo "Feed $(dirname $feed) packages integrity issues, please check the output bellow or feed-packages-hash-issues.patch from artifacts"
|
|
git diff | tee --append $topdir/feed-packages-hash-issues.patch
|
|
exit $ret
|
|
}
|
|
popd > /dev/null
|
|
done
|
|
|
|
- >
|
|
trap "
|
|
grep -qz 'package/install[[:space:]]make -r world' logs/build.log && {
|
|
echo '[!] ERROR: package/install seems to fail, enabling verbose output'
|
|
make package/install V=s 2>&1 | tee --append logs/build.log
|
|
grep -C5 'Collected errors:' logs/build.log
|
|
}
|
|
echo '[!] ERROR: build failed'
|
|
exit 1
|
|
" ERR
|
|
- >
|
|
trap "
|
|
grep -qz 'ERROR: target/linux failed to build' logs/build.log && {
|
|
echo '[!] ERROR: target/linux seems to fail, enabling verbose output'
|
|
make target/install -j $(nproc) V=s 2>&1 | tee --append logs/build.log
|
|
}
|
|
echo '[!] ERROR: build failed'
|
|
exit 1
|
|
" ERR
|
|
- make toolchain/compile -j $(nproc) 2>&1 | tee --append logs/build.log
|
|
|
|
extends: .run-black-duck-tools
|