task: coverity by jharlow-intel · Pull Request #244 · IntelPython/mkl-service

jharlow-intel · 2026-09-15T13:25:20Z

https://scan.coverity.com/projects/intelpython-mkl-service?tab=overview

adding mkl-service to open-source coverity scanning w/ a github action workflow

Copilot

🟡 Changes recommended

Critical build-tool and Coverity project configuration issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds scheduled/manual Coverity Scan integration for the C/Cython build and a README status badge.

Changes:

Adds a GitHub Actions workflow for Coverity setup, build capture, and submission.
Adds a Coverity Scan badge to README.md.

File summaries

File	Summary	Review findings
`README.md`	Adds the Coverity Scan status badge.	No findings.
`.github/workflows/coverity.yml`	Configures oneMKL installation, Coverity capture, and result submission.	Critical: Install `meson-python`, `ninja`, and `cmake` before the non-isolated build. Critical: Correct `COVERITY_PROJECT` to the registered project identifier (also on line 151). Nit: Update the outdated `setup.py` diagnostic comment.

Review details

Suppressed comments (1)

.github/workflows/coverity.yml:152

The Coverity upload API selects the project from the project query parameter; passing it only as a multipart form field does not target the registered project. As written, this submission will not be associated with IntelPython/mkl-service; put COVERITY_PROJECT in the upload URL instead.

               --form project="${COVERITY_PROJECT}" \
               https://scan.coverity.com/builds

Files reviewed: 2/2 changed files
Comments generated: 3
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

jharlow-intel · 2026-10-19T18:04:41Z

+  cancel-in-progress: true
+
+env:
+  COVERITY_PROJECT: IntelPython/mkl-service


IntelPython/mkl-service is the registered project name: the heading at https://scan.coverity.com/projects/intelpython-mkl-service reads "Coverity Scan: IntelPython/mkl-service", and intelpython-mkl-service is only the URL slug derived from it. mkl_fft's workflow sends IntelPython/mkl_fft the same way and its weekly scans pass. Kept the value and added a comment explaining the distinction in 9a06323.

vlad-perevezentsev · 2026-09-22T12:29:34Z

+      - name: Install build dependencies
+        # Cython is pinned here only (not in pyproject.toml) to keep the generated
+        # code stable between scans, so Coverity CIDs and their triage survive
+        run: pip install "setuptools>=77" "cython==3.3.0" "wheel>=0.45.1"


That is a valid point.
mkl-service is currently built using Meson
@jharlow-intel please update it

Done in 9a06323: the step now runs pip install meson-python ninja cmake "cython==3.3.0" mkl-devel, the same tooling build-with-standard-clang.yml uses, and the oneAPI apt repo / setvars.sh steps are gone. Verified locally on current master in a fresh venv: pip install . --no-build-isolation --no-deps finds MKL through CMake, compiles all three extensions, and the test suite passes.

jharlow-intel · 2026-10-19T18:05:25Z

+          # setup.py hard-requires MKLROOT and only raises a bare ValueError if
+          # it is unset, so surface what setvars.sh resolved it to.
+          echo "MKLROOT=${MKLROOT}"


Removed in 9a06323 along with the setvars.sh/MKLROOT lines. The diagnostic note now sits on the install step and describes the real lookup: meson.build's dependency('MKL', method: 'cmake') finds the mkl-devel wheel's CMake config because CMake's find_package searches PATH entries with bin/ stripped as install prefixes.

vlad-perevezentsev · 2026-09-22T12:29:34Z

+      - name: Install build dependencies
+        # Cython is pinned here only (not in pyproject.toml) to keep the generated
+        # code stable between scans, so Coverity CIDs and their triage survive
+        run: pip install "setuptools>=77" "cython==3.3.0" "wheel>=0.45.1"


That is a valid point.
mkl-service is currently built using Meson
@jharlow-intel please update it

vlad-perevezentsev · 2026-09-22T12:38:02Z

+      - name: Install Intel oneMKL
+        # Only oneMKL is needed: both conda recipes pin `c_compiler: gcc`, so the
+        # shipped packages are gcc builds and that is what Coverity should see.
+        # icx is exercised separately by build-with-clang.yml, and pulling the
+        # DPC++ compiler in here would analyze a configuration we do not ship.
+        timeout-minutes: 25
+        run: sudo apt-get install -y intel-oneapi-mkl-devel


Do we need that step?
mkl-devel is already in [build-system].requires and meson.build finds MKL via CMake.
mkl_fft only does pip install mkl-devel in its Coverity workflow

No, it is not needed. Dropped the apt repo and intel-oneapi-mkl-devel steps in 9a06323; the install step now does pip install ... mkl-devel like mkl_fft.

vlad-perevezentsev · 2026-09-22T12:40:17Z

+          source "${ONEAPI_ROOT}/setvars.sh"
+          # setup.py hard-requires MKLROOT and only raises a bare ValueError if
+          # it is unset, so surface what setvars.sh resolved it to.
+          echo "MKLROOT=${MKLROOT}"


I think this won't be necessary after you switch to meson
echo "MKLROOT=${MKLROOT}"

Agreed, removed together with the setvars.sh sourcing in 9a06323.

vlad-perevezentsev · 2026-09-22T12:46:16Z

 # `mkl-service` - Python package for run-time control of Intel® oneAPI Math Kernel Library (oneMKL).
 [![Conda package](https://github.com/IntelPython/mkl-service/actions/workflows/conda-package.yml/badge.svg)](https://github.com/IntelPython/mkl-service/actions/workflows/conda-package.yml)
 [![Build mkl-service with clang](https://github.com/IntelPython/mkl-service/actions/workflows/build-with-clang.yml/badge.svg)](https://github.com/IntelPython/mkl-service/actions/workflows/build-with-clang.yml)
+[![Coverity Scan Build Status](https://scan.coverity.com/projects/intelpython-mkl-service/badge.svg)](https://scan.coverity.com/projects/intelpython-mkl-service)


Is the path to badge.svg correct?
In mkl_fft the link contains a numeric project ID

[![Coverity Scan Build Status](https://scan.coverity.com/projects/33202/badge.svg)](https://scan.coverity.com/projects/intelpython-mkl_fft)

Yes, both forms resolve. https://scan.coverity.com/projects/intelpython-mkl-service/badge.svg returns HTTP 200 image/svg+xml and currently renders "coverity | pending" because no build has been uploaded yet. Coverity's embed snippet uses the numeric ID, which is what mkl_fft copied, but the slug form works and matches the link target, so I kept it.

- Install meson-python, ninja, cmake and mkl-devel from PyPI, as the other --no-build-isolation workflows do, instead of the oneAPI apt repo - Drop setvars.sh/MKLROOT; meson.build locates oneMKL through CMake - Refresh comments for the three extensions built by meson.build and document why COVERITY_PROJECT is the owner/repo name, not the URL slug - Pin actions/checkout and actions/setup-python to the SHAs master uses - List the workflow in .github/AGENTS.md

antonwolfy · 2026-10-20T12:23:53Z

+on:
+  schedule:
+    - cron: "0 1 * * 1"  # Mondays 01:00 UTC; well under the free build quota
+  workflow_dispatch:


There is no github.ref check, so a run started from a feature branch replaces the master results on the dashboard. Fix: add github.ref == 'refs/heads/master' to the job's if:.

antonwolfy · 2026-10-20T12:26:11Z

+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"


Can we bump python version? Can we use 3.14t?

antonwolfy · 2026-10-20T12:26:48Z

+          # _mkl_memory.c) are genuinely recompiled under cov-build. An editable
+          # install reusing a stale build/ would instead yield "No files were
+          # emitted", which the upload rejects.
+          cov-build --dir cov-int pip install . --no-build-isolation --no-deps 2>&1 | tee cov-build.log


Saving cov-build.log and cov-int/build-log.txt as artifacts (if: always()) would make post-merge failures possible to debug.

antonwolfy · 2026-10-20T12:28:14Z

 - **build_pip.yml** — validates editable build
 - **pre-commit.yml** — code quality checks (flake8, etc.)
 - **openssf-scorecard.yml** — security posture scanning
+- **coverity.yml** — weekly Coverity Scan static analysis of the C/Cython extensions (scan.coverity.com)


The root AGENTS.md workflow list also needs a coverity.yml entry.

task: coverity

a17b55f

jharlow-intel self-assigned this Sep 15, 2026

Copilot AI lite review requested due to automatic review settings September 15, 2026 13:25

jharlow-intel requested review from antonwolfy, ndgrigorian, vlad-perevezentsev and xaleryb as code owners September 15, 2026 13:25

Copilot started reviewing on behalf of jharlow-intel September 15, 2026 13:25

View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

antonwolfy added this to the 2.9.0 release milestone Sep 19, 2026

vlad-perevezentsev reviewed Sep 22, 2026

View reviewed changes

Merge branch 'master' into task/coverity

97d684e

antonwolfy modified the milestones: 2.9.0 release, 2.10.0 release Oct 2, 2026

ndgrigorian and others added 3 commits October 5, 2026 07:50

Merge branch 'master' into task/coverity

a1e9f9c

Merge remote-tracking branch 'origin/master' into task/coverity

ced9ad0

jharlow-intel requested a review from vlad-perevezentsev October 19, 2026 18:05

antonwolfy reviewed Oct 20, 2026

View reviewed changes

Conversation

jharlow-intel commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants