Add Coverity about libmcrx HOT 11 CLOSED

Sure, I'd love that I've used coverity before, I think it's great but hadn't tried to set up the automation. Is the secret token based on this: https://docs.github.com/en/actions/security-guides/encrypted-secrets ? Or something else?

What permissions do you need? Just write access to the repo?

from libmcrx.

from libmcrx.

OK, I sent an invite, if accepted I believe you'll have direct access and should hopefully bbe able to add the token. Thanks for doing all this, I think it's really helping the robustness to get these tools checking it, much obliged :)

from libmcrx.

from libmcrx.

It seems to say that's the only one besides owner, which can't be shared:
https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository

Can you screenshot the error you hit to add a secret token? Maybe that'll help find a workaround?

from libmcrx.

from libmcrx.

from libmcrx.

OK, this page says only the repo owner can add secrets:
https://docs.github.com/en/actions/security-guides/encrypted-secrets

So I went and added this repo as a coverity project and saved the token as COVERITY_SCAN_TOKEN, both for the repo and for a new "CoverityScan" environment (not sure if that's needed, but just in case). I ran an initial build with their tarbball and uploaded the results at https://scan.coverity.com/projects/grumpyoldtroll-libmcrx (it says there's 18 defects but won't let me see them until they review my association with the project and its open source compliance).

Is that enough to go ahead with bringing up the automation?

from libmcrx.

from libmcrx.

Confirmed the project name "GrumpyOldTroll/libmcrx" works with this command line:
wget -q https://scan.coverity.com/download/linux64 --post-data "token=$TOKEN&project=GrumpyOldTroll%2Flibmcrx" -O cov-analysis-linux64.tar.gz

The token name is COVERITY_SCAN_TOKEN, so the same ${{ secrets.COVERITY_SCAN_TOKEN }} should work, if I understand the docs correctly.

from libmcrx.

from libmcrx.