Create annotations from sarif report

[adangel]

• Fixes Create inline annotations for found violations #7

[adangel]

The simple way doesn't seem to work correctly:

• Java sample:
  

• Apex sample:
  

The annotations are created, but there is no link to the actual file and position.

[adangel]

Maybe we need to create a check, as described in https://tgrall.github.io/blog/2021/11/07/how-to-write-a-github-action-annotation-api

API Docs: https://docs.github.com/en/rest/reference/checks

We could create a check with status "in_progress" and after PMD finished, we can update the check and add the annotations.

[rody]

@adangel I've created recently a few github actions for PMD:

• pmd-annotations-github-action This one creates annotations from a PMD report in JSON format (it should be quite easy to adapt it for the SARIF format). The annotations are visible in the source code and in the PR files.
• pmd-review-github-action This one creates a PR review from the PMD report. The interesting thing is that it reports only the violations on the lines of code which have changed in the PR (it's quite useful on a big project where PMD was introduced late).

I've created a demo app to demonstrate those actions: pmd-github-action-demo, feel free to raise PRs and play with it.
You can also see my action to run PMD itself: pmd-github-action.

Feel free to pick up anything you want and make it part of the PMD project.

[adangel]

@rody Thanks for the tipps and suggestions.

The annotations are visible in the source code and in the PR files.

now I know where to look. I always looked at the build summary page - and there the annotations are listed but without telling on which file they are.
So it seems to be working already:

(Note: there are two annotations, one from the push workflow and the other from the pull request workflow)

pmd-review-github-action This one creates a PR review from the PMD report.

That's an interesting approach to create PR review comments automatically. I'll have to think about this, whether this should be an optional feature.
Note: In order to create comments, you need a github token with write access. If the PR is created on a forked repository, the default token only ever has read access and can't create comments as far as I know. Maybe there is a "real" github app needed.

it reports only the violations on the lines of code which have changed in the PR

Yeah, that's basically #6 .