How to setup a Travis/Rails project to submit to Coverity Scan?

问题

I'm looking for a std travis coverity setup for a rails application.

My current .travis.yml file looks like this:

# environment settings
env:
  - DB=sqlite
  - DB=mysql
  - DB=postgresql
env:
  global:
   # The next declaration is the encrypted COVERITY_SCAN_TOKEN, created
   #   via the "travis encrypt" command using the project repo's public key
   - secure: "<SECURE>"

# project language
language: ruby
rvm:
  - 2.3.1

# branches to build (whitelist)
branches:
  only:
    - master
    - coverity_scan
    - testing

# command to run before install
before_install:
      - echo -n | openssl s_client -connect scan.coverity.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | sudo tee -a /etc/ssl/certs/ca-

# arguments for the bundler
bundler_args: --without production development

# addons
addons:
  coverity_scan:
    project:
      name: "<PROJECT_NAME>"
      description: "Build submitted via Travis CI"
    notification_email: <MY_EMAIL>
    build_command_prepend: ""
    build_command: "--no-command"
    branch_pattern: coverity_scan

# script
script:
  - RAILS_ENV=test bundle exec rake db:migrate --trace
  - bundle exec rake db:test:prepare
  - bundle exec rspec spec/
  - bundle exec cucumber

# run before script
before_script:
  - mysql -e 'create database my_app_test'
  - psql -c 'create database my_app_test' -U postgres

I'm not sure what to put in the build_command part of addons.coverity_scan. I already tried leaving it empty, --no-command, bundle install, and bundle install --jobs=3 --retry=3, but none of them worked. --no_command, for example, gives me the following message:

Coverity Scan analysis selected for branch coverity_scan.
Coverity Scan analysis authorized per quota.
$ curl -s https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh | COVERITY_SCAN_PROJECT_NAME="$PROJECT_NAME" COVERITY_SCAN_NOTIFICATION_EMAIL="<MY_EMAIL>" COVERITY_SCAN_BUILD_COMMAND="--no-command" COVERITY_SCAN_BUILD_COMMAND_PREPEND="" COVERITY_SCAN_BRANCH_PATTERN=coverity_scan bash
Note: COVERITY_SCAN_PROJECT_NAME and COVERITY_SCAN_TOKEN are available on Project Settings page on scan.coverity.com
Coverity Scan configured to run on branch coverity_scan
Coverity Scan analysis authorized per quota.
Downloading Coverity Scan Analysis Tool...
2016-09-13 23:26:36 URL:https://scan.coverity.com/download/Linux [449455458/449455458] -> "/tmp/cov-analysis-Linux.tgz" [1]
Extracting Coverity Scan Analysis Tool...
/tmp/coverity-scan-analysis ~/build/<PROJECT_NAME>
~/build/<PROJECT_NAME>
Running Coverity Scan Analysis Tool...
Coverity Build Capture (64-bit) version 8.5.0.3 on Linux 3.13.0-92-generic x86_64
Internal version numbers: db70178643 p-kent-push-26368.949
[WARNING] No files were emitted. This may be due to a problem with your configuration
or because no files were actually compiled by your build command.
Please make sure you have configured the compilers actually used in the compilation.
 For more details, please look at: 
    /home/travis/build/<PROJECT_NAME>/cov-int/build-log.txt
Extracting SCM data for 0 files...
Please see the log file '/home/travis/build/<PROJECT_NAME>/cov-int/scm_log.txt' for warnings and SCM command issues.
[WARNING] Unable to gather all SCM data - see log at /home/travis/build/<PROJECT_NAME>/cov-int/scm_log.txt for details.
Successfully added SCM data for 0 files
Tarring Coverity Scan Analysis results...
Uploading Coverity Scan Analysis results...

And because I'm using travis I'm not able to look into the log files...

When the command is empty it fails with the error, that a command needs to be given and it does nothing.

Can someone help me with some kind of a std setup for a rails app?

Thanks in advance!

回答1:

Instructions for using Coverity SCAN the new languages supported by 8.5 are found here : https://scan.coverity.com/download?tab=other . We assume that users first read these instructions prior to attempting TravisCI integration. It is also highly recommended that local integration is tested to ensure clean captures before attempting any CI.

回答2:

Ruby is supported in Coverity 8.5. Debugging this is difficult without the log. It's possible the SCAN kit is missing a config for Ruby, which can be fixed by running cov-configure --ruby.

The more likely problem, however, is that Ruby is what Coverity considers a "non-compiled" language (meaning you don't usually have a build that compiles them before they can be used). So this means you need to inform cov-build about where your Ruby files are. Looking at your travis config, I expect you need to add this to your build_command: --fs-capture-search /path/to/your/ruby/files

回答3:

It seems that it is not possible to analyse rails (interpreted ones in general) projects (correct me if I'm wrong). I deleted my project from coverity.

来源：https://stackoverflow.com/questions/39480654/how-to-setup-a-travis-rails-project-to-submit-to-coverity-scan

标签

ruby-on-rails

travis-ci

coverity