name: Coverity

on:
  workflow_dispatch:
  schedule:
  - cron: "0 0 * * *"

jobs:
  scan:
    runs-on: ubuntu-latest
    if: ${{ github.repository_owner == 'libressl' }}
    env:
      COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable'
      COVERITY_SCAN_BRANCH_PATTERN: '*'
      COVERITY_SCAN_NOTIFICATION_EMAIL: 'libressl-security@openbsd.org'
      COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .."
      COVERITY_SCAN_BUILD_COMMAND: "ninja"
    steps:
    - uses: actions/checkout@main
    - name: Install apt dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y cmake ninja-build
    - name: Run Coverity Scan
      env:
        COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
      run: |
        curl -fsSL "https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh" | bash || true
