Create codacy.yml#101
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Review Summary by QodoAdd Codacy security scanning GitHub Actions workflow
WalkthroughsDescription• Add Codacy security scanning workflow to GitHub Actions • Scan code on push, pull requests, and weekly schedule • Generate SARIF reports for GitHub Advanced Security integration • Upload security analysis results automatically Diagramflowchart LR
A["Code Push/PR/Schedule"] --> B["Checkout Code"]
B --> C["Run Codacy Analysis"]
C --> D["Generate SARIF Report"]
D --> E["Upload to GitHub Security"]
File Changes1. .github/workflows/codacy.yml
|
Code Review by Qodo
1. Fork PR scan will fail
|
Contributor
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
tools | c214f17 | Apr 18 2026, 12:50 AM |
Contributor
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Scala |  |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Swift | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| JavaScript | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Ruby | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| C & C++ | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| C# | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Rust | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Shell | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Terraform | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Code coverage |  |
Apr 18, 2026 12:50a.m. | Review ↗ |
| SQL | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Secrets | |
Apr 18, 2026 12:50a.m. | Review ↗ |
| Ansible | |
Apr 18, 2026 12:50a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![codethreat-appsec[bot]](https://avatars.githubusercontent.com/in/1631929?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
Adds an automated Codacy security scanning workflow to the repository, integrating Codacy’s SARIF output with GitHub Advanced Security code scanning.
Features
- Codacy Security Scan workflow: Introduces
.github/workflows/codacy.ymlto run Codacy Analysis CLI onpushandpull_requestevents targetingmain, as well as on a weekly cron schedule. - SARIF integration: Generates
results.sariffrom Codacy Analysis CLI and uploads it usinggithub/codeql-action/upload-sarif@v3so findings appear in GitHub’s code scanning UI. - Scoped permissions: Configures job-level permissions for
contents,security-events, andactionsto support checkout and SARIF upload.
Bug Fixes
[None]
Breaking Changes
[None]
Architecture Diagram
sequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions
participant Repo as Repository
participant Codacy as Codacy Analysis CLI
participant GHSec as GitHub Code Scanning
Dev->>GH: Push/PR to main or scheduled run
GH->>Repo: actions/checkout@v4
GH->>Codacy: Run codacy-analysis-cli-action (analyze code)
Codacy-->>GH: results.sarif
GH->>GHSec: github/codeql-action/upload-sarif@v3 (upload SARIF)
GHSec-->>Dev: Code scanning alerts in GitHub UI
Up to standards ✅🟢 Issues
|
❌ 1 blocking issue (1 total)
|
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
| # Checkout the repository to the GitHub Actions runner | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+16
to
+61
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| # The branches below must be a subset of the branches above | ||
| branches: [ "main" ] | ||
| schedule: | ||
| - cron: '22 19 * * 5' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| codacy-security-scan: | ||
| permissions: | ||
| contents: read # for actions/checkout to fetch code | ||
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | ||
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||
| name: Codacy Security Scan | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| # Checkout the repository to the GitHub Actions runner | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis | ||
| - name: Run Codacy Analysis CLI | ||
| uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b | ||
| with: | ||
| # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository | ||
| # You can also omit the token and run the tools that support default configurations | ||
| project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} | ||
| verbose: true | ||
| output: results.sarif | ||
| format: sarif | ||
| # Adjust severity of non-security issues | ||
| gh-code-scanning-compat: true | ||
| # Force 0 exit code to allow SARIF file generation | ||
| # This will handover control about PR rejection to the GitHub side | ||
| max-allowed-issues: 2147483647 | ||
|
|
||
| # Upload the SARIF file generated in the previous step | ||
| - name: Upload SARIF results file | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: results.sarif |
There was a problem hiding this comment.
1. Fork pr scan will fail 🐞 Bug ☼ Reliability
The workflow runs on pull_request but relies on secrets.CODACY_PROJECT_TOKEN and uploads SARIF with security-events: write; on fork-based PRs, secrets are not provided and the token permissions are restricted, so the job will fail and/or never upload results.
Agent Prompt
## Issue description
The workflow runs on `pull_request` but depends on repository secrets and SARIF upload permissions that are not available for fork PRs.
## Issue Context
Fork PRs do not receive repository secrets and typically cannot write `security-events`, so the Codacy step and/or SARIF upload will fail, breaking PR checks and preventing results from appearing in Code Scanning.
## Fix Focus Areas
- Add job/step `if:` conditions to skip secret-dependent and `security-events` upload steps when the PR is from a fork (or when the secret is missing), and optionally upload SARIF as an artifact instead.
- Example gating condition: `if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository`
- .github/workflows/codacy.yml[16-61]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
LCSOGthb
added a commit
that referenced
this pull request
Apr 18, 2026
* Create bearer.yml * Create codacy.yml (#101)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.