Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions .codacy/codacy.yaml
Original file line number Diff line number Diff line change
@@ -1,10 +1,4 @@
runtimes:
- node@22.2.0
- python@3.11.11
- dart@3.7.2
tools:
- eslint@9.3.0
- trivy@0.59.1
- pylint@3.3.6
- pmd@6.55.0
- dartanalyzer@3.7.2
- eslint@9.3.0
22 changes: 11 additions & 11 deletions .github/workflows/codacy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,17 +20,17 @@
with:
node-version: '18' # Choose your Node.js version

- name: Run Codacy Analysis CLI with Docker (optional)
run: |
export CODACY_CODE=$GITHUB_WORKSPACE
docker run \
--rm=true \
--env CODACY_CODE="$CODACY_CODE" \
--volume /var/run/docker.sock:/var/run/docker.sock \
--volume "$CODACY_CODE":"$CODACY_CODE" \
--volume /tmp:/tmp \
codacy/codacy-analysis-cli \
analyze --tool eslint --upload --project-token ${{ secrets.CODACY_PROJECT_TOKEN }} --max-allowed-issues 99999 --commit-uuid $GITHUB_SHA
- name: Run Codacy CLI
uses: codacy/codacy-cli-v2-action@main

Check warning on line 24 in .github/workflows/codacy.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/codacy.yml#L24

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 Codacy found a high Security issue: An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

The issue identified by the Semgrep linter is that the GitHub Action codacy/codacy-cli-v2-action@main is being referenced using a branch name (main). This practice can lead to unpredictability, as the action may change if new commits are pushed to the branch. Instead, it's recommended to pin the action to a specific commit SHA to ensure that the action remains immutable and consistent across builds.

To fix this issue, you should replace main with the full-length commit SHA of the specific version of the action you want to use. You can find the commit SHA from the repository's commit history on GitHub.

Here’s the code suggestion to implement this change:

Suggested change
uses: codacy/codacy-cli-v2-action@main
uses: codacy/codacy-cli-v2-action@<full-length-commit-SHA>

Make sure to replace <full-length-commit-SHA> with the actual SHA you want to pin to.


This comment was generated by an experimental AI tool.

env:
GH_TOKEN: ${{ secrets.GH_TOKEN}}
with:
api_token: ${{ secrets.CODACY_API_TOKEN }}
tool: eslint9
upload_report: true
provider: gh
owner: codacy-acme
repository: sample-javascript-project

- name: Install dependencies
run: |
Expand Down
6 changes: 6 additions & 0 deletions eslint.config.mjs
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
export default [
{
rules: {
}
}
];
8 changes: 8 additions & 0 deletions main.js
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,17 @@ const { add, subtract } = require('./util');

// Function to add two numbers
function addNumbers(a, b) {
console.log('Adding numbers:', a, b);
return add(a, b);
}


// Function to multiply two numbers
function multiplyNumbers(a, b) {
console.log('Multiplying numbers:', a, b);
return a * b;
}

// Function to subtract two numbers
function subtractNumbers(a, b) {
return subtract(a, b);
Expand Down
Loading