Convert to Coverity and Dependabot (#82)

* Switch from snyk to dependabot for composition analysis

* Migrate to Coverity

* Install packages for static-analysis

* Test updates to coverity for oidn checkout

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "monthly"

.github/workflows/ci.yml

@@ -788,17 +788,19 @@ jobs:
       artifact-path: test.log
       cmd: python scripts/test.py --device cpu --minimal --log test.log
 
-  kw-build-scan-report:
+  static-analysis:
     secrets: inherit
-    uses: intel-innersource/libraries.devops.renderkit.workflows/.github/workflows/static_analysis.yml@main
+    uses: intel-innersource/libraries.devops.renderkit.workflows/.github/workflows/static_analysis.yml@tgt/oidn-coverity
     with:
-      project: oidn
-      image: oidn/ubuntu:22.04
+      coverity: true
+      project: Open Image Denoise
+      prebuild: >
+        apt install -y ninja-build
       build: scripts/build.py
 
-  snyk-scan:
+  composition-analysis:
     secrets: inherit
-    uses: intel-innersource/libraries.devops.renderkit.workflows/.github/workflows/snyk.yml@main
+    uses: intel-innersource/libraries.devops.renderkit.workflows/.github/workflows/composition_analysis.yml@main
     with:
       project: oidn
 

.gitignore

@@ -1,6 +1,7 @@
 .*
 !.gitignore
 !.github
+venv/
 
 *~
 *.autosave

requirements.txt

@@ -1,2 +1,9 @@
-numpy
-torch
+filelock==3.12.4
+Jinja2==3.1.2
+MarkupSafe==2.1.3
+mpmath==1.3.0
+networkx==3.1
+numpy==1.26.0
+sympy==1.12
+torch==2.0.1
+typing_extensions==4.8.0