way less commenting

Author: jharlow-intel

.github/workflows/coverity.yml

@@ -1,27 +1,8 @@
 name: Coverity Scan
 
-# Public static analysis via the free Coverity Scan service (scan.coverity.com,
-# operated by Black Duck). Coverity is a compiled-language analyzer: it must wrap
-# the real C build with `cov-build`, so this workflow installs the toolchain,
-# compiles the extensions under capture, and uploads the result.
-#
-# This project must be built with Intel icx, not gcc: CMakeLists.txt applies
-# -fveclib=SVML, -fvectorize and -fimf-precision=high unconditionally, and gcc
-# rejects all three. That mirrors build-with-clang.yml and the conda recipe.
-#
-# One-time setup (done once per project, outside this workflow):
-#   1. Register IntelPython/mkl_umath at https://scan.coverity.com/github
-#      (the project name must match COVERITY_PROJECT below).
-#   2. Add two repository secrets (Settings -> Secrets and variables -> Actions):
-#        COVERITY_SCAN_TOKEN  - the project token from the Project Settings tab
-#        COVERITY_SCAN_EMAIL  - a maintainer email for build notifications
-#
-# Free-tier quota for a project under 100K LOC is 28 builds/week, max 4/day, so
-# this runs on a weekly schedule plus on demand rather than per-push.
-
 on:
   schedule:
-    - cron: "0 1 * * 1"  # Mondays 01:00 UTC; well under the free build quota
+    - cron: "0 1 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -37,11 +18,8 @@ env:
 
 jobs:
   coverity-scan:
-    # Forks lack the COVERITY_SCAN_* secrets; only run on the canonical repo.
     if: github.repository == 'IntelPython/mkl_umath'
     runs-on: ubuntu-latest
-    # backstop timeout for whole job; larger than the sibling projects because
-    # this one also has to apt-install the oneAPI compiler and MKL.
     timeout-minutes: 90
 
     steps:
@@ -63,8 +41,6 @@ jobs:
           sudo apt-get update
 
       - name: Install Intel oneAPI
-        # Multi-GB apt download; cap it so a stalled mirror fails here with a
-        # clear culprit rather than eating the whole job budget.
         timeout-minutes: 25
         run: |
           sudo apt-get install -y intel-oneapi-compiler-dpcpp-cpp
@@ -83,37 +59,19 @@ jobs:
                --data-urlencode "project=${COVERITY_PROJECT}" \
                --output cov-analysis.tar.gz \
                https://scan.coverity.com/download/linux64
-          # An invalid token/project returns a small HTML error page, not the
-          # multi-hundred-MB tarball. Fail loudly with a clear hint if so.
-          if [ "$(stat -c '%s' cov-analysis.tar.gz)" -lt 1000000 ]; then
-            echo "::error::Coverity build tool download failed. Verify the COVERITY_SCAN_TOKEN secret and that the registered project name matches '${COVERITY_PROJECT}'."
-            head -c 512 cov-analysis.tar.gz || true
-            exit 1
-          fi
           mkdir -p cov-analysis
           tar -xzf cov-analysis.tar.gz --strip 1 -C cov-analysis
           echo "${PWD}/cov-analysis/bin" >> "$GITHUB_PATH"
 
       - name: Build under cov-build
-        # cov-build wraps the compiler and can wedge without producing output;
-        # cap it so a hang fails fast instead of idling until the job timeout.
-        # 4 translation units under icx normally finish in a few minutes.
         timeout-minutes: 20
         run: |
           # shellcheck disable=SC1091
           source "${ONEAPI_ROOT}/setvars.sh"
           export CC="${CMPLR_ROOT}/bin/icx"
-          # icx is clang-based but not auto-configured like gcc, so teach the
-          # Coverity front-end about it before capturing the build.
           cov-configure --template --comptype clangcc --compiler "${CC}"
-          # scikit-build caches its CMake tree in _skbuild and will skip
-          # recompiling translation units that are already up to date, which
-          # under-reports (or empties) the Coverity emit. Force a real rebuild.
           rm -rf _skbuild
           cov-build --dir cov-int pip install . --no-build-isolation --no-deps 2>&1 | tee cov-build.log
-          # The project has 4 C translation units (mkl_umath_loops.c,
-          # ufuncsmodule.c, generated __umath_generated.c and Cython
-          # _patch_numpy.c); bail out if none were captured.
           if ! grep -qE "Emitted [1-9][0-9]* .*compilation unit" cov-build.log; then
             echo "::error::Coverity captured 0 compilation units — the C build did not run under cov-build."
             exit 1