Document Coverity Scan triage and pin Cython for stable scans

Backport of IntelPython/mkl_umath#266, adapted to mkl_fft.

- Pin cython==3.3.0 in the Coverity workflow (only there, not in
  pyproject.toml) so the generated _pydfti.c stays byte-stable between
  scans and Coverity CIDs plus their triage survive. Works because the
  scan build uses --no-build-isolation.
- Add coverity/README.md: where findings come from across mkl_fft's two
  translation units (template-generated mklfft.c, which is our DFTI
  logic and stays in scope, and Cython-generated _pydfti.c), the
  Cython-pin rationale, an opt-in Project Component, a review checklist,
  and the one verified Cython-boilerplate false positive that applies to
  mkl_fft (a DEADCODE in the tp_traverse slot of Cython genexpr scope
  structs).

mkl_umath's other documented false positives (the __umath_generated.c
InitOperators DEADCODE, the with-statement and __Pyx__Import DEADCODE,
and the _patch_impl FORWARD_NULL) do not occur in mkl_fft and are
deliberately omitted.

Author: antonwolfy

.github/workflows/coverity.yml

@@ -32,7 +32,9 @@ jobs:
           architecture: x64
 
       - name: Install mkl_fft dependencies
-        run: pip install meson-python ninja cmake cython "numpy>=2" mkl-devel
+        # Cython is pinned here only (not in pyproject.toml) to keep the generated
+        # code stable between scans, so Coverity CIDs and their triage survive
+        run: pip install meson-python ninja cmake "cython==3.3.0" "numpy>=2" mkl-devel
 
       - name: Download Coverity Build Tool
         timeout-minutes: 15

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 * Multi-iterator constructors now return a status corresponding to allocation success or failure, and raise `MemoryError` instead of `ValueError` [gh-373](https://github.com/IntelPython/mkl_fft/pull/373)
 * `_direct_fftnd` now also checks the status returned by the backend instead of discarding it [gh-373](https://github.com/IntelPython/mkl_fft/pull/373)
+* Pinned Cython in the Coverity Scan workflow so generated code stays stable between scans, and added `coverity/README.md` documenting the known Cython-boilerplate false positive and the scan review checklist [gh-365](https://github.com/IntelPython/mkl_fft/pull/365)
 
 ### Fixed
 * Declared `f_ndim` as a C `int` in `_allocate_result` so the buffer size is computed in C rather than through a Python object, resolving a Coverity out-of-bounds (OVERRUN) false positive [gh-364](https://github.com/IntelPython/mkl_fft/pull/364)

coverity/README.md

@@ -0,0 +1,86 @@
+# Triaging Coverity Scan findings
+
+Static analysis runs on [Coverity Scan](https://scan.coverity.com) via
+[`.github/workflows/coverity.yml`](../.github/workflows/coverity.yml) (weekly + on
+demand). Analysis runs on Black Duck's servers; triage is done in the Scan web UI.
+
+Every finding to date is a false positive in **generated** code — the
+Cython-generated `_pydfti.c` — not in code we maintain. This guide records the
+verified findings and how to keep triage from resetting.
+
+## Where findings come from
+
+`cov-build` captures two C translation units (the `.h` files under
+`mkl_fft/src/` are `#include`d into them, not compiled on their own):
+
+- **Template-generated** `mklfft.c` (from `mkl_fft/src/mklfft.c.src` via
+  `_vendored/process_src_template.py`, wired up in `meson.build`). This is *not*
+  Cython — it is our oneMKL DFTI descriptor/compute logic, just type-specialized
+  for float32/float64/complex64/complex128. It pulls in the hand-written helpers
+  in `mkl_fft/src/multi_iter.h` and `mkl_fft/src/mklfft.h`. A real bug can surface
+  here, so treat it like hand-written code, **not** boilerplate — review every
+  finding.
+- **Cython-generated** `_pydfti.c` (from `mkl_fft/_pydfti.pyx`): `__Pyx_*` /
+  `__pyx_pw_*` / `__pyx_tp_*` helpers and wrappers are boilerplate — findings here
+  are ~always false positives. `__pyx_pf_*` functions are the C translation of our
+  `.pyx` bodies; a real `.pyx` bug could surface there, so keep them in scope
+  (Coverity can't see Python-level invariants — see the `_allocate_result`
+  OVERRUN fixed in [gh-364](https://github.com/IntelPython/mkl_fft/pull/364)).
+
+## Keeping triage durable: the Cython pin
+
+A Cython *version* bump regenerates `_pydfti.c` wholesale, which churns the
+Coverity CIDs and silently drops their triage — the same boilerplate then returns
+under new CIDs. So **Cython is pinned in `coverity.yml`** (not `pyproject.toml`,
+so shipped wheels are unaffected). The pin works only because the build runs with
+`--no-build-isolation`; bumping it means re-triaging the boilerplate.
+
+## Reducing the noise: a Project Component
+
+**Project Settings → Components** buckets defects by a path regex. Define one to
+group (not hide) the Cython unit so it can be filtered out of view — path-based,
+so it survives regeneration:
+
+- **Name:** `Generated-code`  **Path regex:** `.*_pydfti\.c`
+
+Do **not** group `mklfft.c` (or the `mkl_fft/src/*.h` helpers) — that is our DFTI
+logic, not boilerplate. Group only — do **not** mark it *ignored*, as that also
+drops the `__pyx_pf_*` bodies (see [declined](#evaluated-and-declined)).
+
+## Review checklist
+
+Don't blanket-ignore the generated file — prioritise instead:
+
+1. **Findings in `mklfft.c` and `mkl_fft/src/*.h`** — review every one; this is
+   our type-specialized oneMKL DFTI code and its inlined iterator/cache helpers,
+   not boilerplate.
+2. **High/Medium findings in `__pyx_pf_*`** — verify against `_pydfti.pyx`; if it's
+   a Python-level invariant Coverity can't see, mark `False Positive` with a
+   reason. If it's a genuine defect, fix the `.pyx` (as with the `_allocate_result`
+   OVERRUN).
+3. **Known false-positive families below** — carry the recorded disposition;
+   match on **checker + mechanism**, not CID (CIDs reset on a Cython bump or an
+   engine upgrade).
+
+## Known false-positive families
+
+Match on **checker + mechanism**, not CID (CIDs reset on a Cython bump or engine
+upgrade). Helper names below are from Cython 3.3.0 and vary between versions.
+All Minor severity, no runtime or security impact.
+
+| Family | Checker | Why it's a false positive |
+| --- | --- | --- |
+| `__pyx_tp_traverse_..._scope_struct_...` (Cython `tp_traverse` slot for a genexpr/closure scope, e.g. from `_get_element_strides`) | DEADCODE | Cython emits a uniform base-type traversal preamble `e = __Pyx_call_type_traverse(o, 1, v, a); if (e) return e;`. The synthesized scope object derives from `object`, whose traverse contributes nothing, so the helper returns 0 and the early-return is dead. The preamble *is* needed for scopes that derive from a GC type. |
+
+The DEADCODE family marks **Intentional**, with disposition **Ignore**.
+
+## Evaluated and declined
+
+- **Modeling files** correct the behavior of *called* functions; our FPs are
+  intraprocedural (dead branches, compile-time-constant guards, `#if`), which
+  models can't reach.
+- **Dropping the generated unit** (hard exclude), e.g. after `cov-build`:
+  ```bash
+  cov-manage-emit --dir cov-int --tu-pattern "file('.*_pydfti\\.c')" delete
+  ```
+  Also drops the `__pyx_pf_*` bodies, so it's disabled in favour of the checklist.