From: Jeff King <peff@peff.net>
Date: Wed, 17 Aug 2022 00:57:16 GMT
Subject: Re: Coverity, was Re: What's cooking in git.git (Oct 2021, #02; Wed, 6)
Message-ID: <Yvw87DJOOu+/jG6o@coredump.intra.peff.net>
In-Reply-To: <2n33pn8n-7529-443q-rq7n-q12nrqrn8p27@tzk.qr>

On Tue, Aug 16, 2022 at 11:05:48AM +0200, Johannes Schindelin wrote:

> > It sounds like Taylor is volunteering to set up the Coverity side for
> > git.git, and I can help him with getting those COVERITY_* variables into
> > the GitHub environment.
> 
> Given the challenges with Coverity (false positives, lack of support on
> Synopsys' side, severely limited access to the reports), and given the
> renewed efforts by OSTIF that focus not on Coverity but on CodeQL, I am
> in favor of abandoning the idea to integrate Coverity in our GitHub
> workflow.
> 
> Regarding CodeQL, I am still uncertain what level of integration we will
> end up with, and the contacts I am working with are currently all on
> vacation, but I am confident that we will have an easier time going
> forward with static analysis using CodeQL instead of Coverity.

OK. I haven't been that impressed with CodeQL for C so far, but it may
be getting better. I certainly would be happier with a system that made
it easier to display and share reports.

Coverity does have a lot of false positives, but I've at least been able
to pick useful fixes out of them (especially because it is good about
saying "here are 5 new things to look at"). I've been continuing to
build my private branch with it, so we'll see if it turns up anything
useful. I do agree that inflicting it on ordinary users may be
counter-productive (I often have to stare really hard to understand why
its false positives are false, and that is not something I would wish
on, say, a GGG user).

-Peff