[CI] Coverity scan enabling (#709)

Author: vyevtyus

.github/workflows/coverity.yml

@@ -0,0 +1,110 @@
+# *******************************************************************************
+# Copyright (C) 2025 Intel Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+name: Coverity Scan
+
+on:
+  # Only run on push to main branch
+  push:
+    branches: [develop]
+
+permissions: read-all
+
+env:
+  COVERITY_PROJECT: uxlfoundation%2FoneMath
+  LAPACK_VERSION: 3.12.0
+
+jobs:
+  coverity_linux:
+    name: Coverity Linux
+    if: github.repository == 'uxlfoundation/oneMath'
+    runs-on: [ubuntu-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download Coverity Build Tool (linux64)
+        run: |
+          curl --fail https://scan.coverity.com/download/cxx/linux64 --output ${GITHUB_WORKSPACE}/cov-linux64-tool.tar.gz \
+            --data "token=${{secrets.COVERITY_TOKEN}}&project=${{env.COVERITY_PROJECT}}" || { echo "Download failed"; exit 1; }
+          mkdir cov-linux64-tool
+          tar -xzf cov-linux64-tool.tar.gz --strip 1 -C cov-linux64-tool
+          cd cov-linux64-tool/config
+          git apply --check ${GITHUB_WORKSPACE}/.github/workflows/fix.coverity-2024.12.patch
+          if patch -p1 < ${GITHUB_WORKSPACE}/.github/workflows/fix.coverity-2024.12.patch; then
+            echo "Coverity Build Tool configs successfully patched"
+          else
+            echo "Coverity Build Tool configs patching failed, check patch relevance to current Coverity Build Tool version"
+            exit 1
+          fi
+
+      - name: Install Intel compiler
+        run: |
+          wget --progress=dot:giga https://registrationcenter-download.intel.com/akdlm/IRC_NAS/39c79383-66bf-4f44-a6dd-14366e34e255/intel-dpcpp-cpp-compiler-2025.2.0.527_offline.sh
+          sudo bash intel-dpcpp-cpp-compiler-2025.2.0.527_offline.sh -s -a -s --action install --eula accept
+
+      - name: Install Intel oneMKL
+        run: |
+          wget --progress=dot:giga https://registrationcenter-download.intel.com/akdlm/IRC_NAS/47c7d946-fca1-441a-b0df-b094e3f045ea/intel-onemkl-2025.2.0.629_offline.sh
+          sudo bash intel-onemkl-2025.2.0.629_offline.sh -s -a -s --action install --eula accept
+
+      - name: Restore netlib from cache
+        id: cache-lapack
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        with:
+          path: lapack/install
+          key: lapack-3.12.0
+
+      - name: Install netlib
+        if: steps.cache-lapack.outputs.cache-hit != 'true'
+        run: |
+          curl -sL https://github.com/Reference-LAPACK/lapack/archive/refs/tags/v${LAPACK_VERSION}.tar.gz | tar zx
+          SHARED_OPT="lapack-${LAPACK_VERSION} -DBUILD_SHARED_LIBS=on -DCBLAS=on -DLAPACKE=on -DCMAKE_INSTALL_PREFIX=${PWD}/lapack/install"
+          # 32 bit int
+          cmake ${SHARED_OPT} -B lapack/build32
+          cmake --build lapack/build32 ${PARALLEL} --target install
+          # 64 bit int
+          cmake ${SHARED_OPT} -DBUILD_INDEX64=on -B lapack/build64
+          cmake --build lapack/build64 ${PARALLEL} --target install
+
+      - name: Prepare and run Coverity build
+        run: |
+          source /opt/intel/oneapi/setvars.sh
+          export PATH="${PWD}/cov-linux64-tool/bin:${PATH}"
+          cov-configure --template --compiler icpx --comptype intel_icpx:linux
+          export LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:${GITHUB_WORKSPACE}/lapack/install/lib
+          cmake -DTARGET_DOMAINS="blas rng lapack dft sparse_blas" -DREF_BLAS_ROOT=${GITHUB_WORKSPACE}/lapack/install -DREF_LAPACK_ROOT=${GITHUB_WORKSPACE}/lapack/install -B build
+          cov-build --dir cov-int cmake --build build -j 2 --target all
+
+      - name: Archive Coverity build results
+        id: check_size
+        run: |
+          tar -czvf cov-int.tgz cov-int
+          size=$(du -m cov-int.tgz | cut -f1)
+          echo "Artifact size: $size MB"
+          echo "size=$size" >> $GITHUB_OUTPUT
+
+      - name: Submit Coverity results for analysis
+        run: |
+          curl \
+            --form token="${{secrets.COVERITY_TOKEN}}" \
+            --form email="${{secrets.COVERITY_EMAIL}}" \
+            --form file=@cov-int.tgz \
+            --form version="${GITHUB_SHA}" \
+            --form description="" \
+            "https://scan.coverity.com/builds?project=${{env.COVERITY_PROJECT}}"