Coverity filters

[richardlau]

Earlier this month I fixed the daily job that ran static analysis/submission to Coverity (nodejs/build#2183) which had been broken for a long time (it stopped working sometime during Node.js 13 when we updated some of the CI hosts).

Refs: https://scan.coverity.com/projects/node-js

Code changes since Node.js 13 have resulted in the existing filters we have on the Coverity Node.js project being out of date:

e.g.

• deps/http_parser no longer exists
• Other deps such as deps/brotli, deps/googletest, deps/histogram, deps/llhttp, deps/ngtcp2, deps/uv, deps/uvwasi aren't filtered.

I'm looking at updating the filtering, but I'm seeking feedback on what, if anything, we want to be scanning from deps. For example, deps/llhttp and deps/uvwasi are projects in the nodejs org, and deps/uv wasn't previously filtered either.

[mhdawson]

In the filters above would the /deps/libuv entry have indicated that at one but we had filtered out uv but we cahnged the name?

I'd be ok if we filtered out all the deps to start. If we do include deps in our org I think including llhttp, corepack, uvwasi make sense. Also uv if the libuv team wanted us to,

[richardlau]

I hadn't spotted the /deps/libuv entry... not sure if it ever matched anything -- as far as I know libuv has always been under deps/uv (nodejs/node-v0.x-archive@efca334).

[richardlau]

I've added the following filters:

[RedYetiDev]

(Hey, I'm closing this discussion, and I don't think it is still relevent to users in discussions. If you disagree, feel free to reopen. If you still need this discussion, it's still available at #40165)