coverity-sarif.yml

# example pipeline for Coverity scans using the Black Duck Security Scan Extension for ADO
# https://marketplace.visualstudio.com/items?itemName=blackduck.blackduck-security-scan
# and the SARIF SAST Scans Tab extension from Microsoft DevLabs
# https://marketplace.visualstudio.com/items?itemName=sariftools.scans
pool:
  name: private-linux
variables:
  - group: poc222.coverity.synopsys.com
  - name: COVERITY_TOOL_HOME
    value: /opt/coverity/analysis/2024.12.0
workspace:
  clean: all
steps:
- task: Maven@4
  displayName: 'Maven Build'
  inputs:
    options: '-B -DskipTests'
- task: BlackDuckSecurityScan@2
  displayName: 'Coverity Scan'
  inputs:
    coverity_url: $(COVERITY_URL)
    coverity_user: $(COV_USER)
    coverity_passphrase: $(COVERITY_PASSPHRASE)
    coverity_policy_view: 'Outstanding Issues'
    mark_build_status: 'SucceededWithIssues'
    coverity_local: true
    coverity_install_directory: $(COVERITY_TOOL_HOME)
- script: |
    set -ex
    IDIR=$(find $(Build.SourcesDirectory)/.bridge -name idir)
    $COVERITY_TOOL_HOME/bin/cov-format-errors --dir "$IDIR" --json-output-v10 issues.json
    $COVERITY_TOOL_HOME/node/bin/node $COVERITY_TOOL_HOME/SARIF/cov-format-sarif-for-github.js \
      --inputFile issues.json --outputFile coverity-report.sarif --githubUrl https://dev.azure.com \
      --repoName chuckaude/hello-java --checkoutPath chuckaude/hello-java $(Build.SourcesDirectory) $(Build.SourceVersion)
    zip CodeAnalysisLogs.zip coverity-report.sarif
  displayName: 'Create SARIF Report'
- task: PublishBuildArtifacts@1
  displayName: 'Publish SARIF Report'
  inputs:
    PathtoPublish: 'coverity-report.sarif'
    ArtifactName: CodeAnalysisLogs