On Thu, Oct 07, 2021 at 09:42:11AM +0200, Ævar Arnfjörð Bjarmason wrote: > Interesting mix... > [...] > ...of curl & wget :) Heh, yeah, I noticed that, too. This is literally cut and paste from coverity's "here's how to automate a scan" instructions, which yes, use both tools. I don't think it's a big deal, but we could pretty easily swap the wget invocation for curl. > > - any repo which wants to use this has to set up the secret token > > (COVERITY_SCAN_TOKEN here). That involves creating a coverity > > account, and then setting the token in the GitHub web interface. > > Presumably we'd just bail immediately if that token isn't set, so > > forks aside from git/git would have to enable it independently. > > I tried creating one of these now, requested access at > https://scan.coverity.com/projects/git & it's pending. So that isn't actually my project. ;) That's the old dead one that Stefan used to do builds for. Now I do have access to that and saw your request, but it's not actually receiving new builds. I probably _could_ upload to that one, of course, but the builds I'm doing are of my private topics. My thinking was that if Junio is OK with it, we'd have this in the main tree and the git/git ones would be the main builds. > Sounds good, I wonder if they (if contacted) provide upon request some > community-wide keys for projects such as git, so it would Just Work for > forks without their owners needing to sign up themselves... I get the impression that it's a fairly hefty CPU cost for something they're offering for free, and they really don't want everybody's random fork doing analyses. I.e., they'd rather see open source projects set up an analysis project for their official tree and that's it. OTOH, another concern of theirs is that the results aren't disclosed publicly, since they may have security implications. But they've made it easy enough for people to submit their random GitHub repositories, which can contain anybody's code, so it doesn't seem like much of a secret. So I dunno. They're nice enough to offer the service for free, and I want to respect their wishes. But I'm having a hard-time finding documents describing exactly what's OK and what's next with respect to forks. They do have some limits posted here: https://scan.coverity.com/faq#frequency It's on the order of 3 builds per day for a code base of our size. Which is plenty for our integration branches, but not enough to test every topic branch. And though we could get around that with treating forks as separate projects, I think that's violating the spirit of the limit. -Peff
