Re: What's cooking in git.git (Oct 2021, #02; Wed, 6)

> The reason for that is that I didn't find it by inspection; I've started
> running my personal builds through coverity. It wasn't too bad to set up
> with a GitHub Action, like so:
>
> [...]

> Is there interest in having something like this in the main repo? We'd
> need to tweak some values:
>
>   - we have to send the project name (here peff/git); we can presumably
>     get this on the fly from the Actions environment

>   - any repo which wants to use this has to set up the secret token
>     (COVERITY_SCAN_TOKEN here). That involves creating a coverity
>     account, and then setting the token in the GitHub web interface.
>     Presumably we'd just bail immediately if that token isn't set, so
>     forks aside from git/git would have to enable it independently.
>
>   - likewise it needs the email address for the coverity account. That
>     could probably be set in the environment, too.

> There are tons of existing warnings, many of which are false positives.
> But it keeps track of which problems are new, and emails out a summary
> of only the new ones (which is how I saw the leak here, which just hit
> next). I don't care all that much about leaks here (we have other
> techniques for finding them), but when Stefan used to do regular
> coverity builds in the past, it routinely found useful errors.