Code Sight can run analyses locally, but it can also be configured to share certain data with an analysis server.

Typically, if Code Sight is synchronized, an administrator will set this up for your particular installation. Once synchronization is enabled, Code Sight downloads issue information for the most recent full central scan, either from Coverity Connect or from Coverity on Polaris.

When it has a server connection, there are two kinds of data that Code Sight shares:

  • Analysis summaries

  • Triage Information

By default, Code Sight does not display issues that are not duplicated locally. You can control this behavior by using the Filter controls.

Analysis summaries

Coverity Analysis creates summaries when you run a full SAST scan of the code base. It uses such summaries to improve the accuracy of single-file scans.

When connected, Code Sight obtains analysis summaries from the server. This reduces the need to run full scans locally.

If you do not connect to one of the analysis servers, we recommend that you run a full scan from time to time.

What about issues that are not found by a local scan?

In the Code Analysis view for Eclipse, if you choose Remote mode, you might see from the issues list that the central scan has reported issues that your local Coverity Analysis scan did not report. There are a number of reasons why this might happen. Probably the most common reasons for this situation are as follows:

  • The Coverity Connect server does not have analysis summary data.

    This can happen if an analysis summary failed to upload: for example, if the Internet connection was interrupted.

  • The local and central code bases were configured for a different target.

    This might be the case if, for example, one base was configured for a debug build and the other for a release build; if the two bases are targeted for two different operating systems; and so on.

  • The local and central code bases used different versions of the source code.

    This situation is known as version skew.

When the code targets or the code versions fail to synchronize, you can take steps to make sure that your local system and the Coverity Connect server are analyzing the same code.

For a more complete list of reasons why a local scan and a central scan might return different results, see the section “Reasons for results differences” in chapter 5 of the Coverity Desktop Analysis User Guide. The “Reasons for results differences” section also describes workarounds for some of these reasons.

Remember: Coverity documents, including the Coverity Desktop Analysis User Guide are installed with the Coverity Analysis scan engine. Look for the installation directory; for example: /Users/<username>/.blackduck/desktop/controller/installedtools/coverity-analysis/<version>/doc/en/. On a Windows system, the installation folder has basically the same path, except that it typically begins with <DISK>:\Users\<Username>\AppData\Roaming\BlackDuck\desktop\....