Coverity on Polaris Configuration File Overview

For each project to be analyzed with Coverity on Polaris, a configuration file determines how analysis happens. The configuration file contains important information such as the project name, how to build the project, and determines other non-build files to be included in the analysis.

The default configuration file name is polaris.yml, located in the root directory of the project.

You can use the -c option with the polaris command if you wish to specify a different configuration file name.
To upload a configuration file, pass the "--upload-local-config" option with polaris analyze .

The configuration file is a YAML file. YAML is a structured, human-readable representation of values. Configuration files can be edited using any plain text editor.

Warning: Be aware that you must use spaces, not tabs, to indent lines in YAML files.

Coverity on Polaris configuration files have the following sections, which are optional and can appear in any order: Refer to the Configuration File Schema for the full syntax.

Table 1. Sections of the Configuration File. This table describes the contents of the major sections of the polaris.yml file, but isn't exhaustive. There are additional attributes and others might be added.
Section name	Description
`version`	Contains a single value. The value is always `"1"`.
`serverUrl`	Contains a single value. The base URL of your organization's Coverity on Polaris instance.
`uploadServiceUrl`	Contains a single value. The URL to use for uploading capture data when it is not sent directly to the Coverity on Polaris server. For example the URL of a load-balancing server.
`noLogEnvironmentVariable`	Contains either disable or enable. Optional. Enabled by default. If the user wants to have the CLI environment variable log files created in the diagnostics folder, they will need to add it to the polaris.yml file and disable.
`install`	Contains a list of the tools used to analyze your project, tool versions, and the install directory. See The install Section.
`project`	Contains a basic description of the project, including project name, branch name, revision, project directory, custom properties, group assignment, SCM URL and capture directory. These settings determine how your project displays in the Coverity on Polaris Web Interface and what gets scanned. See The project Section.
`capture`	Contains the Coverity capture method to be used, build and clean commands, files to skip, capture directory, and cov-build options. See The capture Section.
`analyze`	The `analyze` section is used to pass additional options to Coverity analysis commands, including disable Sigma analysis engine, etc. It also stores the analysis mode, incremental settings, caching settings, and Buda settings. See The analyze Section.

Variables in the Configuration File

Values do not have to be literally defined. For example, for the project name, you can use a variable value ${scm.git.repo} to indicate that Coverity on Polaris should use the Git repository name as the project name.

Configuration File Examples

The following is a simple YML configuration file. It shows that analysis occurs when the project is built using make -f Makefile, and that Python files in the project directory are included in the analysis.


version: "1"
serverUrl: https://myorg.cop.blackduck.com
uploadServiceUrl: https://myBalancer.example.com/uploads
install:
  coverity:
    version: default
project:
  name: ${scm.git.repo}
  branch: ${scm.git.branch}
  revision:
    name: ${scm.git.commit}
    date: ${scm.git.commit.date}
capture:
  build:
    cleanCommands:
    - shell: [make, -f, Makefile, clean]
    buildCommands:
    - shell: [make, -f, Makefile]
  fileSystem:
    python:
      files:
      - directory: ${project.projectDir}

The following example shows the noLogEnvironmentalVariable enabled.


version: "1"
project:
  name: NodeGoat-master
  branch: NodeGoat-master
  revision:
    name: NodeGoat-master
    date: "2021-08-12T18:50:25Z"
capture:
  fileSystem:
    ears:
      extensions: [ear]
      files:
      - directory: ${project.projectDir}
    java:
      files:
      - directory: ${project.projectDir}
    javascript:
      files:
      - directory: ${project.projectDir}
      - excludeRegex: node_modules|bower_components|vendor
    php:
      files:
      - directory: ${project.projectDir}
    python:
      files:
      - directory: ${project.projectDir}
    ruby:
      files:
      - directory: ${project.projectDir}
    wars:
      extensions: [war]
      files:
      - directory: ${project.projectDir}
analyze:
  mode: central
install:
  coverity:
    version: default
serverUrl: https://qa.dev.cop.blackduck.com
noLogEnvironmentVariable: enable