Using the GitHub App with Coverity

• The table below outlines the secrets, variables and GitHub token required for generating a workflow for a Coverity scan. Secrets and variables should be configured in the organization and/or repositories where the GitHub workflow file will be deployed.
  Note: A GitHub Token is required for injecting Pull Request comments in addition to creating fix Pull Requests and SARIF reports. Please refer to secrets and variables setup for further details on how to configure.

  Type	Name	Description	Example
  Variable	COVERITY_URL	Coverity server URL	https://coverity.blackduck.com
  Secret	COVERITY_USER	Coverity username	COVERITY_USERNAME
  Secret	COVERITY_PASSPHRASE	Coverity password	COVERITY_PASSWORD
  Token	GITHUB_TOKEN	By default, the workflow uses GitHub’s built-in GITHUB_TOKEN, which must be granted additional permissions (including write access) in your repository or organization settings. This option is enabled by default. Alternatively, for setups that require more granular control, a Personal Access Token (PAT) can be created and stored in a secret associated with the organization or repository. For detailed instructions on configuring token permissions, please refer to the User Guide.	github_token: ${{ secrets.GITHUB_TOKEN }} or BRIDGE_GITHUB_USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

• Branches: Scans can be configured to trigger in response to push events and when a Pull Request is created or updated. Use the push events and pull request text boxes to specify which branches will initiate scans for each type of event.

• Runner: Choose the environment for the GitHub runner, such as ubuntu-latest.

• Platform: Select Coverity to generate a workflow that will perform a Coverity scan. Upon selection, the Dashboard UI will dynamically update to display platform scan-specific options and instructions, such as which GitHub variables and secrets are required for the generated workflow to run successfully.

  Scan method: Choose between:

  • GitHub Action (default): Generate a scan workflow that uses Black Duck Security Scan GitHub Action.

  • CLI: Generate a scan workflow that downloads the latest Bridge CLI and uses it directly to perform a security scan.

• Decorate pull requests with comments: Each new policy violation introduced within a Pull Request will be summarised within a review comment.

# Quickstart: Black Duck Security Scan Action with coverity:
#     https://docs.blackduck.com/r/bridge/latest/bridge-cli-guide/quickstart-black-duck-security-scan-action-with-coverity.html
name: Coverity Scan
on:
  push:
    branches:
      - main
      - master
      - develop
      - stage
      - release
  pull_request:
    branches:
      - main
      - master
      - develop
      - stage
      - release
  workflow_dispatch: {}
# GitHub token permissions for post-scan actions. Required for built-in GITHUB_TOKEN; if using a PAT with equivalent scopes, permissions block can be commented out.
permissions:
  contents: write               # Enables pushing commits and creating fix branches
  pull-requests: write          # Allows commenting on and creating pull requests
jobs:
  coverity:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@v5

      - name: Coverity Scan
        id: coverity-scan
        uses: blackduck-inc/black-duck-security-scan@v2
        with:
          ### SCANNING: Required fields
          coverity_url: ${{ vars.COVERITY_URL }}
          coverity_user: ${{ secrets.COVERITY_USER }}
          coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
          ### GITHUB TOKEN
          github_token: ${{ secrets.GITHUB_TOKEN }}  # Required when PR comments or sarif reports enabled
          coverity_prComment_enabled: true


          ### LOCAL ANALYSIS: Uncomment below to enable
          # coverity_local: false # Enable local analysis mode

          ### SCAN CONFIGURATION: Uncomment below to enable
          # coverity_waitForScan: true # Wait for scan completion before proceeding

          ### Mark build status if policy violating issues are found
          # mark_build_status: failure # Set to success, failure, or skip

          ### Uncomment below configuration if Bridge diagnostic files needs to be uploaded
          # include_diagnostics: false

name: Coverity Bridge CLI Scan
on:
  push:
    branches:
      - main
      - master
      - develop
      - stage
      - release
  pull_request:
    branches:
      - main
      - master
      - develop
      - stage
      - release
  workflow_dispatch: {}
# GitHub token permissions for post-scan actions. Required for built-in GITHUB_TOKEN; if using a PAT with equivalent scopes, permissions block can be commented out.
permissions:
  contents: write               # Required to push changes or create fix branches
  pull-requests: write          # Required to add comments or create fix pull requests
jobs:
  coverity:
    runs-on: ubuntu-latest
    env:
      ### SCANNING: Required fields
      BRIDGE_COVERITY_CONNECT_URL: ${{ vars.COVERITY_URL }}
      BRIDGE_COVERITY_CONNECT_USER_NAME: ${{ secrets.COVERITY_USER }}
      BRIDGE_COVERITY_CONNECT_USER_PASSWORD: ${{ secrets.COVERITY_PASSPHRASE }}
      ### SCANNING: Configuration fields
      BRIDGE_COVERITY_CONNECT_PROJECT_NAME: ${{ github.event.repository.name }}
      BRIDGE_COVERITY_CONNECT_STREAM_NAME: ${{ github.event.repository.name }}-${{ github.base_ref || github.ref_name }}
      ### GitHub repository information
      BRIDGE_GITHUB_REPOSITORY_OWNER_NAME: ${{ github.repository_owner }}
      BRIDGE_GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
      BRIDGE_GITHUB_REPOSITORY_BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
      ### LOCAL ANALYSIS
      BRIDGE_COVERITY_LOCAL: "true"
      ### PULL REQUEST COMMENTS
      BRIDGE_COVERITY_PRCOMMENT_ENABLED: "true"
      ### GITHUB TOKEN
      BRIDGE_GITHUB_USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      ### GitHub pull request information
      BRIDGE_GITHUB_REPOSITORY_PULL_NUMBER: ${{ github.event.pull_request.number || github.event.number || 0 }}
      ### TOOLING: Bridge CLI download URL
      BRIDGE_DOWNLOAD_URL: https://repo.blackduck.com/bds-integrations-release/com/blackduck/integration/bridge/binaries/bridge-cli-bundle/latest

      ### SCANNING: Optional fields
      # BRIDGE_COVERITY_WAIT_FOR_SCAN: true
    steps:
      - name: Checkout Source
        uses: actions/checkout@v5

      - name: Download & Setup Bridge CLI on Windows
        if: runner.os == 'Windows'
        shell: powershell
        run: |-
          curl.exe -L -o $env:TEMP\bridge.zip "$env:BRIDGE_DOWNLOAD_URL/bridge-cli-bundle-win64.zip"
          Expand-Archive $env:TEMP\bridge.zip -DestinationPath $env:TEMP\bridge -Force
          $exe = Get-ChildItem $env:TEMP\bridge -Recurse -Filter bridge-cli.exe | Select-Object -First 1
          "BRIDGE_CLI_INSTALL_DIR=$($exe.FullName)" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Download & Setup Bridge CLI on macOS/Linux
        if: runner.os != 'Windows'
        shell: bash
        run: |-
          OS=$([[ "$RUNNER_OS" == "macOS" ]] && ([[ $(uname -m) =~ arm ]] && echo macos_arm || echo macosx) || ([[ $(uname -m) =~ arm ]] && echo linux_arm || echo linux64))
          curl -sSL -o bridge.zip "$BRIDGE_DOWNLOAD_URL/bridge-cli-bundle-$OS.zip"
          unzip -qo bridge.zip -d "$RUNNER_TEMP"
          echo "BRIDGE_CLI_INSTALL_DIR=$(find "$RUNNER_TEMP" -type f -name bridge-cli | head -n1)" >> "$GITHUB_ENV"

      - name: Coverity Scan
        run: ${{ env.BRIDGE_CLI_INSTALL_DIR }} --stage connect  --diagnostics

1. Use the Edit button, if required to make changes and then click Save.
2. Use the Filename text box to update the default workflow filename if required.

3. Click the Next button to confirm that the workflow has been reviewed and any necessary amendments have been made.