less comments

Author: jharlow-intel

.github/workflows/coverity.yml

@@ -1,23 +1,8 @@
 name: Coverity Scan
 
-# Public static analysis via the free Coverity Scan service (scan.coverity.com,
-# operated by Black Duck). Coverity is a compiled-language analyzer: it must wrap
-# the real C build with `cov-build`, so this workflow installs the Meson build
-# stack, compiles the extension under capture, and uploads the result.
-#
-# One-time setup (done once per project, outside this workflow):
-#   1. Register IntelPython/mkl_fft at https://scan.coverity.com/github
-#      (the project name must match COVERITY_PROJECT below).
-#   2. Add two repository secrets (Settings -> Secrets and variables -> Actions):
-#        COVERITY_SCAN_TOKEN  - the project token from the Project Settings tab
-#        COVERITY_SCAN_EMAIL  - a maintainer email for build notifications
-#
-# Free-tier quota for a project under 100K LOC is 28 builds/week, max 4/day, so
-# this runs on a weekly schedule plus on demand rather than per-push.
-
 on:
   schedule:
-    - cron: "0 1 * * 1"  # Mondays 01:00 UTC; well under the free build quota
+    - cron: "0 1 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -32,10 +17,8 @@ env:
 
 jobs:
   coverity-scan:
-    # Forks lack the COVERITY_SCAN_* secrets; only run on the canonical repo.
     if: github.repository == 'IntelPython/mkl_fft'
     runs-on: ubuntu-latest
-    # backstop timeout for whole job
     timeout-minutes: 60
 
     steps:
@@ -48,8 +31,6 @@ jobs:
           python-version: "3.12"
           architecture: x64
 
-      # Meson locates MKL through its CMake config (see meson.build), so the
-      # mkl-devel wheel is enough -- no MKLROOT or oneAPI install required.
       - name: Install mkl_fft dependencies
         run: pip install meson-python ninja cmake cython "numpy>=2" mkl-devel
 
@@ -63,13 +44,6 @@ jobs:
                --data-urlencode "project=${COVERITY_PROJECT}" \
                --output cov-analysis.tar.gz \
                https://scan.coverity.com/download/linux64
-          # An invalid token/project returns a small HTML error page, not the
-          # multi-hundred-MB tarball. Fail loudly with a clear hint if so.
-          if [ "$(stat -c '%s' cov-analysis.tar.gz)" -lt 1000000 ]; then
-            echo "::error::Coverity build tool download failed. Verify the COVERITY_SCAN_TOKEN secret and that the registered project name matches '${COVERITY_PROJECT}'."
-            head -c 512 cov-analysis.tar.gz || true
-            exit 1
-          fi
           mkdir -p cov-analysis
           tar -xzf cov-analysis.tar.gz --strip 1 -C cov-analysis
           echo "${PWD}/cov-analysis/bin" >> "$GITHUB_PATH"
@@ -78,18 +52,10 @@ jobs:
         run: cov-configure --gcc
 
       - name: Build under cov-build
-        # cov-build wraps the compiler and can wedge without producing output;
-        # cap it so a hang fails fast instead of idling until the job timeout.
-        # 2 translation units normally finish in a couple of minutes.
         timeout-minutes: 20
         run: |
-          # Meson caches its build tree in build/ and skips compiling when it is
-          # up to date, which would leave Coverity with nothing to capture and
-          # get the upload rejected. Remove it to force a real rebuild.
           rm -rf build
           cov-build --dir cov-int pip install -e . --no-build-isolation --no-deps 2>&1 | tee cov-build.log
-          # The extension has 2 C translation units (the generated mklfft.c and
-          # the Cython-generated _pydfti.c); bail out if none were captured.
           if ! grep -qE "Emitted [1-9][0-9]* .*compilation unit" cov-build.log; then
             echo "::error::Coverity captured 0 compilation units — the C build did not run under cov-build."
             exit 1