task: coverity - #244
Open
jharlow-intel wants to merge 1 commit into
Open
task: coverity#244jharlow-intel wants to merge 1 commit into
jharlow-intel wants to merge 1 commit into
Conversation
jharlow-intel
requested review from
antonwolfy,
ndgrigorian,
vlad-perevezentsev and
xaleryb
as code owners
September 15, 2026 13:25
There was a problem hiding this comment.
🟡 Changes recommended
Critical build-tool and Coverity project configuration issues remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds scheduled/manual Coverity Scan integration for the C/Cython build and a README status badge.
Changes:
- Adds a GitHub Actions workflow for Coverity setup, build capture, and submission.
- Adds a Coverity Scan badge to
README.md.
File summaries
| File | Summary | Review findings |
|---|---|---|
README.md |
Adds the Coverity Scan status badge. | No findings. |
.github/workflows/coverity.yml |
Configures oneMKL installation, Coverity capture, and result submission. | Critical: Install meson-python, ninja, and cmake before the non-isolated build. Critical: Correct COVERITY_PROJECT to the registered project identifier (also on line 151). Nit: Update the outdated setup.py diagnostic comment. |
Review details
Suppressed comments (1)
.github/workflows/coverity.yml:152
- The Coverity upload API selects the project from the
projectquery parameter; passing it only as a multipart form field does not target the registered project. As written, this submission will not be associated withIntelPython/mkl-service; putCOVERITY_PROJECTin the upload URL instead.
--form project="${COVERITY_PROJECT}" \
https://scan.coverity.com/builds
- Files reviewed: 2/2 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| cancel-in-progress: true | ||
|
|
||
| env: | ||
| COVERITY_PROJECT: IntelPython/mkl-service |
| - name: Install build dependencies | ||
| # Cython is pinned here only (not in pyproject.toml) to keep the generated | ||
| # code stable between scans, so Coverity CIDs and their triage survive | ||
| run: pip install "setuptools>=77" "cython==3.3.0" "wheel>=0.45.1" |
Collaborator
There was a problem hiding this comment.
That is a valid point.
mkl-service is currently built using Meson
@jharlow-intel please update it
Comment on lines
+122
to
+124
| # setup.py hard-requires MKLROOT and only raises a bare ValueError if | ||
| # it is unset, so surface what setvars.sh resolved it to. | ||
| echo "MKLROOT=${MKLROOT}" |
| - name: Install build dependencies | ||
| # Cython is pinned here only (not in pyproject.toml) to keep the generated | ||
| # code stable between scans, so Coverity CIDs and their triage survive | ||
| run: pip install "setuptools>=77" "cython==3.3.0" "wheel>=0.45.1" |
Collaborator
There was a problem hiding this comment.
That is a valid point.
mkl-service is currently built using Meson
@jharlow-intel please update it
Comment on lines
+75
to
+81
| - name: Install Intel oneMKL | ||
| # Only oneMKL is needed: both conda recipes pin `c_compiler: gcc`, so the | ||
| # shipped packages are gcc builds and that is what Coverity should see. | ||
| # icx is exercised separately by build-with-clang.yml, and pulling the | ||
| # DPC++ compiler in here would analyze a configuration we do not ship. | ||
| timeout-minutes: 25 | ||
| run: sudo apt-get install -y intel-oneapi-mkl-devel |
Collaborator
There was a problem hiding this comment.
Do we need that step?
mkl-devel is already in [build-system].requires and meson.build finds MKL via CMake.
mkl_fft only does pip install mkl-devel in its Coverity workflow
| source "${ONEAPI_ROOT}/setvars.sh" | ||
| # setup.py hard-requires MKLROOT and only raises a bare ValueError if | ||
| # it is unset, so surface what setvars.sh resolved it to. | ||
| echo "MKLROOT=${MKLROOT}" |
Collaborator
There was a problem hiding this comment.
I think this won't be necessary after you switch to meson
echo "MKLROOT=${MKLROOT}"
| # `mkl-service` - Python package for run-time control of Intel® oneAPI Math Kernel Library (oneMKL). | ||
| [](https://github.com/IntelPython/mkl-service/actions/workflows/conda-package.yml) | ||
| [](https://github.com/IntelPython/mkl-service/actions/workflows/build-with-clang.yml) | ||
| [](https://scan.coverity.com/projects/intelpython-mkl-service) |
Collaborator
There was a problem hiding this comment.
Is the path to badge.svg correct?
In mkl_fft the link contains a numeric project ID
[](https://scan.coverity.com/projects/intelpython-mkl_fft)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://scan.coverity.com/projects/intelpython-mkl-service?tab=overview
adding mkl-service to open-source coverity scanning w/ a github action workflow