Coverity Scan

What Coverity Scan is

Coverity Scan provides static analysis for registered open source projects. It examines source code without running it and can trace possible execution paths to identify defects, including resource leaks, null pointer dereferences, memory corruption, buffer overruns, concurrency issues, and insecure data handling. For each defect, it explains the root cause to help developers address the underlying problem. Supported languages are Java, C/C++, C#, JavaScript, Ruby, and Python. Developers can sign in with GitHub and import projects for analysis. Build automation with Travis CI is also described on the sign-in page. Registered Eclipse Foundation projects can send build and source control information for cloud analysis using a Coverity Scan plugin on a Hudson server. The service is cloud-only and offers web and API access. Its free plan is limited to registered open source projects, with possible discretionary approval for projects initiated and maintained by for-profit corporations. Detailed results are generally available to project members approved by the project administrator, under a responsible disclosure policy. Build allowances depend on project size, and only the latest two tool releases are supported.

Who it suits

Coverity Scan suits maintainers of registered open source projects who want static analysis across its listed programming languages. It may also fit registered Eclipse Foundation projects using Hudson, or teams automating builds with Travis CI.

Limits

The free plan is restricted to registered open source projects, with weekly limits of 7 to 28 builds and daily limits of 1 to 4 depending on project size. Excess weekly build requests are rejected.

Getting started

1. Open the Coverity Scan website
2. Sign in with GitHub
3. Import a GitHub project for analysis
4. Automate builds with Travis CI if needed
5. For a registered Eclipse Foundation project, use the Coverity Scan plugin on a Hudson server to send build and source control information

Verdict

Choose Coverity Scan if your registered open source project needs cloud static analysis and its build allowances suit your needs. Look elsewhere if your project is not eligible or needs support for older tool releases.