Re: What's cooking in git.git (Oct 2021, #02; Wed, 6)

From: Jeff King <peff@peff.net>
Date: Oct 20, 2021, 16:13 UTC
Message-ID: <YXBALFsf305U8mJs@coredump.intra.peff.net>
In-Reply-To: <nycvar.QRO.7.76.6.2110201416390.56@tvgsbejvaqbjf.bet>

On Wed, Oct 20, 2021 at 02:27:30PM +0200, Johannes Schindelin wrote:

Show 21 quoted lines

> Hi Peff,
> 
> On Fri, 8 Oct 2021, Jeff King wrote:
> 
> > On Fri, Oct 08, 2021 at 09:51:33AM +0200, Johannes Schindelin wrote:
> >
> > > FWIW I have set up an Azure Pipeline to keep Git for Windows' `main`
> > > branch covered by Coverity:
> > >
> > > https://dev.azure.com/git-for-windows/git/_build?definitionId=35
> > >
> > > It essentially calls into this scripted code:
> > > https://github.com/git-for-windows/build-extra/blob/4676f286a1ec830a5038b32400808a353dc6c48d/please.sh#L1820-L1915
> >
> > Do you have any objection to adding something like the Action I showed
> > eariler? It would do nothing in git-for-windows/git unless you set up
> > the right environment, so there shouldn't be any downside.
> 
> No objection. I'd just ask to use `${{github.repository}}` instead of
> hard-coding `peff/git`, and to really not run the workflow unless
> configured. So something like this:

Yep, those were directions I was planning to take it.

> I am very much in favor of having this in git/git. Do you want to provide
> the commit message, or do you want me to shepher this?

I'd be just as happy if you did (I hadn't even looked at it since my earlier email).

It sounds like Taylor is volunteering to set up the Coverity side for git.git, and I can help him with getting those COVERITY_* variables into the GitHub environment.

Show 8 quoted lines

> > I admit I was not really planning to try to suppress the false positives
> > as you've done here; my plan was to just keep an eye on the "new"
> > entries (having already gone through the existing ones years ago).
> 
> I think we will _have_ to suppress the false positives at some point, as
> something like 9 out of 10 new reports I receive are about these, and it
> takes time to analyze & dismiss them. In general, I have no trouble
> finding more fun things to do with my time.

The volume is low enough that I've been OK just manually skipping past them. But if we have mitigations to make that happen automatically, I'm all in favor. We can do that incrementally on top, but the fact that you've already figured out most of it means it may make sense to just do it from the start (and is another good reason for you to submit the patches).

Sorry, I didn't mean to make more work/patches for you. :)

-Peff