Stabilize Coverity Scan triage and document known false positives - #266
Merged
Conversation
antonwolfy
force-pushed
the
coverity-triage-docs
branch
from
September 3, 2026 09:59
b3886f6 to
578e3f2
Compare
Pin Cython in the Coverity Scan workflow (only) so the generated _patch_numpy.c is byte-stable between scans. Coverity derives CIDs from a hash of the analyzed code, so an unpinned Cython bump regenerates the file, resets every CID, and silently discards prior triage on the Cython-boilerplate false positives. Production builds keep Cython unpinned in pyproject.toml, so this does not affect shipped wheels or Python support. Add coverity/README.md recording where findings come from across the four translation units (hand-written ufuncsmodule.c, template-generated mkl_umath_loops.c, generate_umath.py-generated __umath_generated.c, and Cython _patch_numpy.c), the five verified Minor-severity false positives (one DEADCODE in InitOperators plus four Cython __pyx_*/__Pyx_* findings), and a review checklist that keeps first-party sources and __pyx_pf_* bodies in scope rather than blanket-excluding the generated units.
antonwolfy
force-pushed
the
coverity-triage-docs
branch
from
September 3, 2026 10:01
578e3f2 to
5e21e23
Compare
antonwolfy
marked this pull request as ready for review
September 3, 2026 10:02
antonwolfy
requested review from
jharlow-intel,
ndgrigorian,
vlad-perevezentsev and
xaleryb
as code owners
September 3, 2026 10:02
antonwolfy
added a commit
to IntelPython/mkl_fft
that referenced
this pull request
Sep 3, 2026
Backport of IntelPython/mkl_umath#266, adapted to mkl_fft. - Pin cython==3.3.0 in the Coverity workflow (only there, not in pyproject.toml) so the generated _pydfti.c stays byte-stable between scans and Coverity CIDs plus their triage survive. Works because the scan build uses --no-build-isolation. - Add coverity/README.md: where findings come from across mkl_fft's two translation units (template-generated mklfft.c, which is our DFTI logic and stays in scope, and Cython-generated _pydfti.c), the Cython-pin rationale, an opt-in Project Component, a review checklist, and the one verified Cython-boilerplate false positive that applies to mkl_fft (a DEADCODE in the tp_traverse slot of Cython genexpr scope structs). mkl_umath's other documented false positives (the __umath_generated.c InitOperators DEADCODE, the with-statement and __Pyx__Import DEADCODE, and the _patch_impl FORWARD_NULL) do not occur in mkl_fft and are deliberately omitted.
antonwolfy
added a commit
to IntelPython/mkl_fft
that referenced
this pull request
Sep 3, 2026
Backport of IntelPython/mkl_umath#266, adapted to mkl_fft. - Pin cython==3.3.0 in the Coverity workflow (only there, not in pyproject.toml) so the generated _pydfti.c stays byte-stable between scans and Coverity CIDs plus their triage survive. Works because the scan build uses --no-build-isolation. - Add coverity/README.md: where findings come from across mkl_fft's two translation units (template-generated mklfft.c, which is our DFTI logic and stays in scope, and Cython-generated _pydfti.c), the Cython-pin rationale, an opt-in Project Component, a review checklist, and the verified false-positive families for the mkl_fft project. The known false positives are grouped by checker + mechanism from the current scan: Cython-generated boilerplate (tp_traverse DEADCODE, version/ABI-guarded helper DEADCODE, a reference-cleanup UNUSED_VALUE, a CHECKED_RETURN) and two dead-by-construction families in our own .pyx (redundant is-NULL guards Cython already proves, and an intentional in-place placeholder stub) - all triaged Intentional / Ignore. The genuine __create_descriptor_1d UNUSED_VALUE defects were fixed in #365, not suppressed, so mklfft.c stays in scope. mkl_umath's own documented false positives were not ported blind; the table was rebuilt from mkl_fft's own scan and generated code.
antonwolfy
added a commit
to IntelPython/mkl_fft
that referenced
this pull request
Sep 3, 2026
Backport of IntelPython/mkl_umath#266, adapted to mkl_fft. - Pin cython==3.3.0 in the Coverity workflow (only there, not in pyproject.toml) so the generated _pydfti.c stays byte-stable between scans and Coverity CIDs plus their triage survive. Works because the scan build uses --no-build-isolation. - Add coverity/README.md: where findings come from across mkl_fft's two translation units (template-generated mklfft.c, which is our DFTI logic and stays in scope, and Cython-generated _pydfti.c), the Cython-pin rationale, an opt-in Project Component, a review checklist, and the verified false-positive families for the mkl_fft project. The known false positives are grouped by checker + mechanism (matched on checker + mechanism, not CID, since CIDs reset on a Cython bump): Cython-generated boilerplate (tp_traverse DEADCODE, version/ABI-guarded helper DEADCODE, a reference-cleanup UNUSED_VALUE, a CHECKED_RETURN) and two dead-by-construction families in our own .pyx (redundant is-NULL guards Cython already proves, and an intentional in-place placeholder stub) - all triaged Intentional / Ignore. mkl_umath's own documented false positives were not ported blind; the table was rebuilt from mkl_fft's own scan and generated code.
ndgrigorian
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Coverity Scan runs weekly against
mkl_umath. Every finding to date is a false positive in generated code — the Cython-generated_patch_numpy.cand thegenerate_umath.py-generated__umath_generated.c— not in the code we maintain. A Cython version bump regenerates_patch_numpy.cwholesale, churning the Coverity CIDs and silently dropping all prior triage on the boilerplate.This PR makes triage durable and records the policy so the noise stays filtered while real signal keeps getting reviewed. It ports the approach from IntelPython/mkl_random#164, adapted to mkl_umath's translation units.
Changes
cython==3.3.0in.github/workflows/coverity.yml). A Cython bump regenerates_patch_numpy.c, which churns CIDs and their triage; pinning keeps the generated code stable between scans. The pin takes effect because the build runs with--no-build-isolation. Production builds leave Cython unpinned inpyproject.toml, so shipped wheels and Python-version support are unaffected.coverity/README.md, a triage guide with:ufuncsmodule.c, template-generatedmkl_umath_loops.c,generate_umath.py-generated__umath_generated.c, and Cython_patch_numpy.c.mkl_umath/src/and__pyx_pf_*bodies in scope rather than blanket-excluding the generated units.InitOperators(__umath_generated.c) plus four Cython__pyx_*/__Pyx_*findings (DEADCODE tp_traverse, DEADCODEwith-statement codegen, DEADCODE import helper, FORWARD_NULL in__cinit__).cov-manage-emit).Rationale
We deliberately do not hard-exclude the generated units: that would also drop the
__pyx_pf_*bodies (the C translation of our.pyxlogic) and could hide a genuine bug. The chosen approach cuts the recurring noise (CID stability via the pin + a documented triage policy) while preserving coverage of the hand-written and template-generated C, where a real defect is most likely to appear.Changelog
Added a
Changedentry under[dev].