ci: add coverity workflow

Signed-off-by: Sam Friedman <sam@golioth.io>

Author: sam-golioth

.github/workflows/coverity.yml

@@ -0,0 +1,52 @@
+name: "Coverity"
+
+on:
+  schedule:
+    # Run workflow every Sunday
+    - cron: "00 0 * * 0"
+  workflow_dispatch:
+  push:
+
+jobs:
+  coverity:
+    runs-on: ubuntu-24.04
+    container: golioth/golioth-coverity-base:89df175
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: bluetooth-gateway
+      - name: Init and update west
+        run: |
+          west init -l bluetooth-gateway --mf west-ncs.yml
+          west update --narrow -o=--depth=1
+      - name: Install pip packages
+        run: |
+          uv pip install \
+            -r zephyr/scripts/requirements-base.txt
+
+          uv pip install          \
+            cryptography==41.0.7  \
+            pyasn1                \
+            pyyaml                \
+            cbor>=1.0.0           \
+            imgtool>=1.9.0        \
+            jinja2                \
+            click
+      - run: |
+          /opt/toolchains/coverity/bin/cov-configure --comptype gcc \
+            --compiler /opt/toolchains/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
+          /opt/toolchains/coverity/bin/cov-build --dir cov-int \
+            west build -p -b nrf9160dk/nrf9160/ns bluetooth-gateway/gateway \
+            -- -DCONFIG_NET_LOG=n -DCONFIG_LOG=n
+          tar czvf gateway.tgz cov-int
+          curl --form token=${{ secrets.BLUETOOTH_GATEWAY_COVERITY_TOKEN }} \
+            --form email=sam@golioth.io \
+            --form file=@gateway.tgz \
+            --form version="0" \
+            --form description="Description" \
+            https://scan.coverity.com/builds?project=golioth%2Fbluetooth-gateway
+      - uses: actions/upload-artifact@v4
+        with:
+          name: coverity_output
+          path: gateway.tgz