From 0a2172ad40775f5782413d683eb8b304eb639eec Mon Sep 17 00:00:00 2001
From: Black Duck <tech-support@blackduck.com>
Date: Mon, 11 May 2026 07:36:44 +0000
Subject: [PATCH] Black Duck Security: Committed
 .github/workflows/coverity-workflow.yml

---
 .github/workflows/coverity-workflow.yml | 60 +++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 .github/workflows/coverity-workflow.yml

diff --git a/.github/workflows/coverity-workflow.yml b/.github/workflows/coverity-workflow.yml
new file mode 100644
index 0000000000000..e1ba02cba222f
--- /dev/null
+++ b/.github/workflows/coverity-workflow.yml
@@ -0,0 +1,60 @@
+# Quickstart: Bridge CLI with coverity:
+#     https://blackduck-dev.zoominsoftware.io/bundle/bridge/page/documentation/c_using-bridge-with-coverity-connect.html
+name: Coverity Bridge CLI Scan
+on:
+  push:
+    branches:
+      - main
+      - master
+      - develop
+      - stage
+      - release
+  pull_request:
+    branches:
+      - main
+      - master
+      - develop
+      - stage
+      - release
+  workflow_dispatch: {}
+jobs:
+  coverity:
+    runs-on: ubuntu-latest
+    env:
+      ### SCANNING: Required fields
+      BRIDGE_COVERITY_CONNECT_URL: ${{ vars.COVERITY_URL }}
+      BRIDGE_COVERITY_CONNECT_USER_NAME: ${{ secrets.COVERITY_USER }}
+      BRIDGE_COVERITY_CONNECT_USER_PASSWORD: ${{ secrets.COVERITY_PASSPHRASE }}
+      ### SCANNING: Configuration fields
+      BRIDGE_COVERITY_CONNECT_PROJECT_NAME: ${{ github.event.repository.name }}
+      BRIDGE_COVERITY_CONNECT_STREAM_NAME: ${{ github.event.repository.name }}-${{ github.base_ref || github.ref_name }}
+      ### GitHub repository information
+      BRIDGE_GITHUB_REPOSITORY_OWNER_NAME: ${{ github.repository_owner }}
+      BRIDGE_GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
+      BRIDGE_GITHUB_REPOSITORY_BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+      ### TOOLING: Bridge CLI download URL
+      BRIDGE_DOWNLOAD_URL: https://repo.blackduck.com/bds-integrations-release/com/blackduck/integration/bridge/binaries/bridge-cli-bundle/latest
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v4
+
+      - name: Download & Setup Bridge CLI on Windows
+        if: runner.os == 'Windows'
+        shell: powershell
+        run: |-
+          curl.exe -L -o $env:TEMP\bridge.zip "$env:BRIDGE_DOWNLOAD_URL/bridge-cli-bundle-win64.zip"
+          Expand-Archive $env:TEMP\bridge.zip -DestinationPath $env:TEMP\bridge -Force
+          $exe = Get-ChildItem $env:TEMP\bridge -Recurse -Filter bridge-cli.exe | Select-Object -First 1
+          "BRIDGE_CLI_INSTALL_DIR=$($exe.FullName)" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Download & Setup Bridge CLI on macOS/Linux
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |-
+          OS=$([[ "$RUNNER_OS" == "macOS" ]] && ([[ $(uname -m) =~ arm ]] && echo macos_arm || echo macosx) || ([[ $(uname -m) =~ arm ]] && echo linux_arm || echo linux64))
+          curl -sSL -o bridge.zip "$BRIDGE_DOWNLOAD_URL/bridge-cli-bundle-$OS.zip"
+          unzip -qo bridge.zip -d "$RUNNER_TEMP"
+          echo "BRIDGE_CLI_INSTALL_DIR=$(find "$RUNNER_TEMP" -type f -name bridge-cli | head -n1)" >> "$GITHUB_ENV"
+
+      - name: Coverity Scan
+        run: "${{ env.BRIDGE_CLI_INSTALL_DIR }} --stage connect "