Skip to content

Commit 07ec076

Browse files
bradleysmith23bradleysmith23
authored
Merge pull request #13 from bradleysmith23/main
Add CHANGELOG.md, SECURITY.md, and README.md for coverity
2 parents 4de1835 + 2f59841 commit 07ec076

File tree

5 files changed

+225
-0
lines changed

5 files changed

+225
-0
lines changed

‎.github/workflows/ci.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,8 @@ jobs:
111111
env:
112112
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
113113
uses: FreeRTOS/CI-CD-Github-Actions/link-verifier@main
114+
with:
115+
exclude-urls: https://github.com/aws/aws-iot-core-mqtt-file-streams-embedded-c/blob/main/tools/coverity/misra.config
114116

115117
verify-manifest:
116118
runs-on: ubuntu-latest

‎.github/workflows/release.yml

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
name: Release automation
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
commit_id:
7+
description: 'Commit ID to tag and create a release for'
8+
required: true
9+
version_number:
10+
description: 'Release Version Number (Eg, v1.0.0)'
11+
required: true
12+
13+
jobs:
14+
tag-commit:
15+
name: Tag commit
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v3
20+
with:
21+
ref: ${{ github.event.inputs.commit_id }}
22+
- name: Configure git identity
23+
run: |
24+
git config --global user.name ${{ github.actor }}
25+
git config --global user.email ${{ github.actor }}@users.noreply.github.com
26+
- name: create a new branch that references commit id
27+
run: git checkout -b ${{ github.event.inputs.version_number }} ${{ github.event.inputs.commit_id }}
28+
- name: Generate SBOM
29+
uses: FreeRTOS/CI-CD-Github-Actions/sbom-generator@main
30+
with:
31+
repo_path: ./
32+
source_path: ./source
33+
- name: commit SBOM file
34+
run: |
35+
git add .
36+
git commit -m 'Update SBOM'
37+
git push -u origin ${{ github.event.inputs.version_number }}
38+
- name: Tag Commit and Push to remote
39+
run: |
40+
git tag ${{ github.event.inputs.version_number }} -a -m "AWS IoT Core MQTT File Streams ${{ github.event.inputs.version_number }}"
41+
git push origin --tags
42+
- name: Verify tag on remote
43+
run: |
44+
git tag -d ${{ github.event.inputs.version_number }}
45+
git remote update
46+
git checkout tags/${{ github.event.inputs.version_number }}
47+
git diff ${{ github.event.inputs.commit_id }} tags/${{ github.event.inputs.version_number }}
48+
create-zip:
49+
needs: tag-commit
50+
name: Create ZIP and verify package for release asset.
51+
runs-on: ubuntu-latest
52+
steps:
53+
- name: Install ZIP tools
54+
run: sudo apt-get install zip unzip
55+
- name: Checkout code
56+
uses: actions/checkout@v3
57+
with:
58+
ref: ${{ github.event.inputs.commit_id }}
59+
path: aws-iot-core-mqtt-file-streams-embedded-c
60+
submodules: recursive
61+
- name: Checkout disabled submodules
62+
run: |
63+
cd aws-iot-core-mqtt-file-streams-embedded-c
64+
git submodule update --init --checkout --recursive
65+
- name: Create ZIP
66+
run: |
67+
zip -r aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip aws-iot-core-mqtt-file-streams-embedded-c -x "*.git*"
68+
ls ./
69+
- name: Validate created ZIP
70+
run: |
71+
mkdir zip-check
72+
mv aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip zip-check
73+
cd zip-check
74+
unzip aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip -d aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}
75+
ls aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}
76+
diff -r -x "*.git*" aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}/aws-iot-core-mqtt-file-streams-embedded-c/ ../aws-iot-core-mqtt-file-streams-embedded-c/
77+
cd ../
78+
- name: Build
79+
run: |
80+
cd zip-check/aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}/aws-iot-core-mqtt-file-streams-embedded-c
81+
sudo apt-get install -y lcov
82+
cmake -S test -B build/ \
83+
-G "Unix Makefiles" \
84+
-DCMAKE_BUILD_TYPE=Debug \
85+
-DBUILD_CLONE_SUBMODULES=ON \
86+
-DCMAKE_C_FLAGS='--coverage -Wall -Wextra -Werror'
87+
make -C build/ all
88+
- name: Test
89+
run: |
90+
cd zip-check/aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}/aws-iot-core-mqtt-file-streams-embedded-c/build/
91+
ctest -E system --output-on-failure
92+
cd ..
93+
- name: Create artifact of ZIP
94+
uses: actions/upload-artifact@v2
95+
with:
96+
name: aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip
97+
path: zip-check/aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip
98+
deploy-doxygen:
99+
needs: tag-commit
100+
name: Deploy doxygen documentation
101+
runs-on: ubuntu-latest
102+
steps:
103+
- name: Doxygen generation
104+
uses: FreeRTOS/CI-CD-Github-Actions/doxygen-generation@main
105+
with:
106+
ref: ${{ github.event.inputs.version_number }}
107+
add_release: "true"
108+
create-release:
109+
needs:
110+
- create-zip
111+
- deploy-doxygen
112+
name: Create Release and Upload Release Asset
113+
runs-on: ubuntu-latest
114+
steps:
115+
- name: Create Release
116+
id: create_release
117+
uses: actions/create-release@v1
118+
env:
119+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
120+
with:
121+
tag_name: ${{ github.event.inputs.version_number }}
122+
release_name: ${{ github.event.inputs.version_number }}
123+
body: Release ${{ github.event.inputs.version_number }} of AWS IoT Core MQTT File Streams Embedded C.
124+
draft: false
125+
prerelease: false
126+
- name: Download ZIP artifact
127+
uses: actions/download-artifact@v2
128+
with:
129+
name: aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip
130+
- name: Upload Release Asset
131+
id: upload-release-asset
132+
uses: actions/upload-release-asset@v1
133+
env:
134+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
135+
with:
136+
upload_url: ${{ steps.create_release.outputs.upload_url }}
137+
asset_path: ./aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip
138+
asset_name: aws-iot-core-mqtt-file-streams-embedded-c-${{ github.event.inputs.version_number }}.zip
139+
asset_content_type: application/zip

‎CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
## v1.0.0 (November 2023)
2+
3+
This is the first release of the AWS IoT MQTT File Streaming Embedded C Library in this
4+
repository.

‎SECURITY.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Reporting a Vulnerability
2+
3+
If you discover a potential security issue in this project, we ask that you notify AWS/Amazon Security
4+
via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [email protected].
5+
Please do **not** create a public github issue.

‎tools/coverity/README.md

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Static code analysis for AWS-IoT-Core-MQTT-File-Streams-Embedded-C library
2+
This directory is made for the purpose of statically testing the MISRA C:2012 compliance of AWS-IoT-Core-MQTT-File-Streams-Embedded-C library using
3+
[Synopsys Coverity](https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html) static analysis tool.
4+
To that end, this directory provides a [configuration file](https://github.com/aws/aws-iot-core-mqtt-file-streams-embedded-c/blob/main/tools/coverity/misra.config) to use when
5+
building a binary for the tool to analyze.
6+
7+
> **Note**
8+
For generating the report as outlined below, we have used Coverity version 2018.09.
9+
10+
## Getting Started
11+
### Prerequisites
12+
You can run this on a platform supported by Coverity. The list and other details can be found [here](https://sig-docs.synopsys.com/polaris/topics/c_coverity-compatible-platforms.html).
13+
To compile and run the Coverity target successfully, you must have the following:
14+
15+
1. CMake version >= 3.16.0 (You can check whether you have this by typing `cmake --version`)
16+
2. GCC compiler
17+
- You can see the downloading and installation instructions [here](https://gcc.gnu.org/install/).
18+
3. Download the repo using the following commands.
19+
- `git clone [email protected]:aws/aws-iot-core-mqtt-file-streams-embedded-c.git ./aws-iot-core-mqtt-file-streams-embedded-c`
20+
- `cd ./aws-iot-core-mqtt-file-streams-embedded-c`
21+
22+
### To build and run coverity:
23+
Go to the root directory of the library and run the following commands in terminal:
24+
1. Update the compiler configuration in Coverity
25+
~~~
26+
cov-configure --force --compiler cc --comptype gcc
27+
~~~
28+
2. Create the build files using CMake in a `build` directory
29+
~~~
30+
cmake -B build -S test
31+
~~~
32+
3. Go to the build directory and copy the coverity configuration file
33+
~~~
34+
cd build/
35+
~~~
36+
4. Build the static analysis target
37+
~~~
38+
cov-build --emit-complementary-info --dir cov-out make coverity_analysis
39+
~~~
40+
5. Go to the Coverity output directory (`cov-out`) and begin Coverity static analysis
41+
~~~
42+
cd cov-out/
43+
cov-analyze --dir . --coding-standard-config ../../tools/coverity/misra.config --tu-pattern "file('.*/source/.*')"
44+
~~~
45+
6. Format the errors in HTML format so that it is more readable while removing the test and build directory from the report
46+
~~~
47+
cov-format-errors --dir . --file "source" --exclude-files '(/build/|/test/)' --html-output html-out;
48+
~~~
49+
7. Format the errors in JSON format to perform a jq query to get a simplified list of any exceptions.
50+
NOTE: A blank output means there are no defects that aren't being suppressed by the config or inline comments.
51+
~~~
52+
cov-format-errors --dir . --file "source" --exclude-files '(/build/|/test/)' --json-output-v2 defects.json;
53+
echo -e "\n-------------------------Non-Suppresed Deviations, if any, Listed Below-------------------------\n";
54+
jq '.issues[] | .events[] | .eventTag ' defects.json | sort | uniq -c | sort -nr;
55+
echo -e "\n-------------------------Non-Suppresed Deviations, if any, Listed Above-------------------------\n";
56+
~~~
57+
58+
For your convenience the commands above are below to be copy/pasted into a UNIX command friendly terminal.
59+
~~~
60+
cov-configure --force --compiler cc --comptype gcc;
61+
cmake -B build -S test;
62+
cd build/;
63+
cov-build --emit-complementary-info --dir cov-out make coverity_analysis;
64+
cd cov-out/
65+
cov-analyze --dir . --coding-standard-config ../../tools/coverity/misra.config;
66+
cov-format-errors --dir . --file "source" --exclude-files '(/build/|/test/)' --html-output html-out;
67+
cov-format-errors --dir . --file "source" --exclude-files '(/build/|/test/)' --json-output-v2 defects.json;
68+
echo -e "\n-------------------------Non-Suppresed Deviations, if any, Listed Below-------------------------\n";
69+
jq '.issues[] | .events[] | .eventTag ' defects.json | sort | uniq -c | sort -nr;
70+
echo -e "\n-------------------------Non-Suppresed Deviations, if any, Listed Above-------------------------\n";
71+
cd ../../;
72+
~~~
73+
74+
You should now have the HTML formatted violations list in a directory named `build/cov-out/html-output`.
75+
With the current configuration and the provided project, you should not see any deviations.

0 commit comments

Comments
 (0)