ci: Add a coverity workflow

Trigger the coverity scan workflow when pushing to coverity_scan branch.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

.github/workflows/coverity.yml

diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
new file mode 100644
index 0000000..39b12e6
--- /dev/null
+++ b/.github/workflows/coverity.yml
@@ -0,0 +1,29 @@
+name: Coverity Scan
+
+on:
+  push:
+    branches: ["coverity_scan"]
+
+jobs:
+  coverity:
+    runs-on: ubuntu-latest
+    env:
+      LIBTPMS_CONFIG: "--without-tpm1"
+      PREFIX:         "/usr"
+      CONFIG:         "--with-openssl --prefix=/usr"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build libtpms and swtpm
+        uses: ./.github/actions/test-swtpm
+
+      - name: Clean swtpm build to build it again
+        run: make clean
+
+      - uses: vapier/coverity-scan-action@v1
+        with:
+          command: make -j$(nproc)
+          project: swtpm
+          email: ${{ secrets.COVERITY_SCAN_EMAIL }}
+          token: ${{ secrets.COVERITY_SCAN_TOKEN }}