Coverity step configuration

Scan code repositories with Coverity.

You can ingest scan results from Coverity Scan into Harness STO.

Important notes for running Coverity scans in STO

Root access requirements

For more information

Coverity step configuration

The following steps outline the recommended workflow:

1. Add a Build or Security stage to your pipeline.

2. Add a Run step to upload your Coverity scan results to the pipeline workspace.

3. Add a Coverity step after the Run step and then configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and variant detection

Name

Variant

Ingestion File

Log Level

Fail on Severity

Additional Configuration

In the Additional Configuration settings, you can use the following options:

• Privileged

• Image Pull Policy

• Run as User

• Set Container Resources

Advanced settings

In the Advanced settings, you can use the following options:

• Conditional Execution

• Failure Strategy

• Looping Strategy

• Policy Enforcement

YAML pipeline example

The following pipeline example illustrates an ingestion workflow. It consists of two steps:

• A Run step that generates a simple Coverity data file.

• A Coverity step that ingests the XML data.

pipeline:
  name: coverity-example
  identifier: coverityexample
  projectIdentifier: STO
  orgIdentifier: default
  tags: {}
  stages:
    - stage:
        name: coverity-ingest
        identifier: coverityingest
        description: ""
        type: SecurityTests
        spec:
          cloneCodebase: false
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Run
                  name: generate_coverity_results_file
                  identifier: Run_1
                  spec:
                    shell: Sh
                    command: |-
                      cat <<EOF >> coverity-results.xml
                      <?xml version='1.0' encoding='UTF-8'?>
                      <cov:exportedProjectDefects xmlns:cov="http://coverity.com">
                          <cov:mergedDefect cid="153368" type="Resource leak" impact="High" status="New" firstDetected="10/24/15" owner="Unassigned" classification="Unclassified" severity="High" action="Undecided" displayComponent="Other" category="Resource leaks" file="/webgoat-container/src/main/java/org/owasp/webgoat/session/UserDatabase.java" function="UserDatabase.getUsers" checker="RESOURCE_LEAK" occurrenceCount="1" cwe="404" externalReference="" issueKind="Various" Language="Java" LineNumber="132" Score=""/>
                          <cov:mergedDefect cid="59180" type="Explicit null dereferenced" impact="Medium" status="New" firstDetected="09/20/14" owner="Unassigned" classification="Unclassified" severity="Medium" action="Undecided" displayComponent="Other" category="Null pointer dereferences" file="/webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatProperties.java" function="WebgoatProperties.main" checker="FORWARD_NULL" occurrenceCount="1" cwe="476" externalReference="" issueKind="Quality" Language="Java" LineNumber="143" Score=""/>
                      </cov:exportedProjectDefects>
                      EOF
              - step:
                  type: Coverity
                  name: ingest_coverity_data
                  identifier: ingest_coverity_data
                  spec:
                    mode: ingestion
                    config: default
                    target:
                      type: repository
                      name: coverity-test
                      variant: test
                    advanced:
                      log:
                        level: info
                    ingestion:
                      file: coverity-results.xml