action.yml

# action.yml
name: "Codacy Analysis CLI"
author: "Codacy"
description: "Execute Codacy code analysis using your remote Codacy configuration"
branding:
  icon: "check"
  color: "gray-dark"
inputs:
  verbose:
    required: false
    description: "Run with verbose output"
  project-token:
    required: false
    description: "API project token to retrieve your remote Codacy configuration for the project being analyzed"
  api-token:
    required: false
    description: "API account token to retrieve your remote Codacy configuration for the project being analyzed"
  codacy-api-base-url:
    required: false
    description: "Codacy's API URL, to retrieve your remote Codacy configuration"
  format:
    required: false
    description: "Format of the output file"
  output:
    required: false
    description: "Send analysis results to an output file"
  directory:
    required: false
    description: "The directory to be analyzed"
  parallel:
    required: false
    description: "Number of tools to run in parallel"
  max-allowed-issues:
    required: false
    default: "2147483647"
    description: "Maximum number of issues allowed for the analysis to succeed"
  tool:
    required: false
    description: "The name of the tool to analyze the code"
  tool-timeout:
    required: false
    description: "Maximum time each tool has to execute"
  upload:
    required: false
    description: "Upload analysis results to Codacy"
  upload-batch-size:
    required: false
    description: "Maximum number of results in each batch to upload to Codacy"
  fail-if-incomplete:
    required: false
    description: "Fail the analysis if any tool fails to run"
  allow-network:
    required: false
    description: "Allow network access for tools"
  force-file-permissions:
    required: false
    description: "Force files to be readable by changing the permissions before running the analysis"
  gh-code-scanning-compat:
    required: false
    description: >-
      Reduce issue severity by one level, for non-security issues, for compatibility with GitHub's code scanning feature.
      This option will only have an effect when used in conjunction with '--format sarif'.
  run-docker-tools:
    required: false
    default: "true"
    description: >-
      Run dockerized tools. Possible values (true|false)
      Check the full list in https://docs.codacy.com/repositories-configure/codacy-configuration-file/#which-tools-can-be-configured-and-which-name-should-i-use
  run-gosec:
    required: false
    description: >-
      Run GoSec. Possible values (true|false)
  run-staticcheck:
    required: false
    description: >-
      Run StaticCheck. Possible values (true|false)
  clang-tidy-output:
    required: false
    description: >-
      Path to a file containing the output of Clang Tidy.
  faux-pas-output:
    required: false
    description: >-
      Path to a file containing the output of Faux Pas.
  skip-uncommitted-files-check:
    required: false
    description: >-
      Skip validation on uncommitted changes
runs:
  using: "composite"
  steps:
    - name: "Set Global Variables"
      shell: bash
      run: |
        echo "CODACY_BASE_URL_OR_DEFAULT=$(if [ ${{ inputs.codacy-api-base-url }} ]; then echo "${{ inputs.codacy-api-base-url }}"; else echo "https://api.codacy.com"; fi)" >> $GITHUB_ENV
        echo "OWNER_NAME=$(echo $GITHUB_REPOSITORY | cut -d '/' -f 1)" >> $GITHUB_ENV
        echo "REPOSITORY_NAME=$(echo $GITHUB_REPOSITORY | cut -d '/' -f 2)" >> $GITHUB_ENV
        echo "ORGANIZATION_PROVIDER=$(if [ "$GITHUB_SERVER_URL" == "https://github.com" ]; then echo "gh"; else echo "ghe"; fi)" >> $GITHUB_ENV
        echo "COMMIT_SHA=$(if [ ${{ github.event_name }} == "pull_request" ]; then echo "${{ github.event.pull_request.head.sha }}"; else echo "${{ github.sha }}"; fi)" >> $GITHUB_ENV

    - name: "Prepare curl authentication header"
      shell: bash
      run: |
        if [ -n "${{ inputs.api-token }}" ]; then
          echo "CURL_CODACY_AUTH_AUTHENTICATION=api-token: ${{ inputs.api-token }}" >> $GITHUB_ENV
        elif [ -n "${{ inputs.project-token }}" ]; then
          echo "CURL_CODACY_AUTH_AUTHENTICATION=project-token: ${{ inputs.project-token }}" >> $GITHUB_ENV
        elif [ ${{ inputs.upload }} = true ]; then
          echo "At least one authentication method is required to upload results."
          exit 1
        fi

    - name: "Run GoSec"
      shell: bash
      run: |
        set -eux

        if [ "${{ inputs.run-gosec }}" == "true" ]; then
          cd /tmp
          curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s v2.7.0
          chmod +x ./bin/gosec
          curl -fsSL https://api.github.com/repos/codacy/codacy-gosec/releases/latest \
            | grep "browser_download_url" | grep -v "browser_download_url.*jar" \
            | cut -d '"' -f 4 \
            | xargs -L 1 curl -fsSL -o /tmp/codacy-gosec
          chmod +x /tmp/codacy-gosec
          cd -

          /tmp/bin/gosec -no-fail -fmt json -log /tmp/log.txt ./... > /tmp/gosec-out.json
          /tmp/codacy-gosec < /tmp/gosec-out.json > /tmp/codacy-out.json
          if [ ${{ inputs.upload }} = true ]; then
            curl -XPOST -L -H "$CURL_CODACY_AUTH_AUTHENTICATION" \
              -H "Content-type: application/json" --data-binary @/tmp/codacy-out.json \
              "${CODACY_BASE_URL_OR_DEFAULT}/2.0/$ORGANIZATION_PROVIDER/$OWNER_NAME/$REPOSITORY_NAME/commit/$COMMIT_SHA/issuesRemoteResults"
          else
            cat /tmp/codacy-out.json
          fi
        else
          echo "Skipping GoSec"
        fi

    - name: "Run StaticCheck"
      shell: bash
      run: |
        set -eux

        if [ "${{ inputs.run-staticcheck }}" == "true" ]; then
          cd /tmp
          curl -fsSL https://api.github.com/repos/dominikh/go-tools/releases/latest \
            | grep -E "browser_download_url.*staticcheck_linux_amd64.tar.gz\"$" \
            | cut -d '"' -f 4 \
            | xargs -L 1 curl -fsSL -o /tmp/staticcheck_linux_amd64.tar.gz
          tar -xvf /tmp/staticcheck_linux_amd64.tar.gz staticcheck/staticcheck
          chmod +x ./staticcheck/staticcheck
          curl -fsSL https://api.github.com/repos/codacy/codacy-staticcheck/releases/latest \
            | grep "browser_download_url" | grep -v "browser_download_url.*jar" \
            | cut -d '"' -f 4 \
            | xargs -L 1 curl -fsSL -o /tmp/codacy-staticcheck
          chmod +x /tmp/codacy-staticcheck
          cd -

          find . -type f -name go.mod -exec bash -c 'cd $(dirname $1); cp $1 $1.codacy.bak; PKGS=$(go list ./...); /tmp/staticcheck/staticcheck -f json $PKGS; mv $1.codacy.bak $1' _ {} \; > /tmp/staticcheck-out.json
          /tmp/codacy-staticcheck < /tmp/staticcheck-out.json > /tmp/codacy-out.json
          if [ ${{ inputs.upload }} = true ]; then
            curl -XPOST -L -H "$CURL_CODACY_AUTH_AUTHENTICATION" \
              -H "Content-type: application/json" --data-binary @/tmp/codacy-out.json \
              "${CODACY_BASE_URL_OR_DEFAULT}/2.0/$ORGANIZATION_PROVIDER/$OWNER_NAME/$REPOSITORY_NAME/commit/$COMMIT_SHA/issuesRemoteResults"
          else
            cat /tmp/codacy-out.json
          fi
        else
          echo "Skipping StaticCheck"
        fi

    - name: "Parse and Push Clang Tidy results"
      shell: bash
      run: |
        set -eux

        if [ -n "${{ inputs.clang-tidy-output }}" ]; then
          cd /tmp
          curl -fsSL https://api.github.com/repos/codacy/codacy-clang-tidy/releases/latest \
            | grep "browser_download_url" | grep -v "browser_download_url.*jar" \
            | cut -d '"' -f 4 \
            | xargs -L 1 curl -fsSL -o /tmp/codacy-clang-tidy
          chmod +x /tmp/codacy-clang-tidy
          cd -

          /tmp/codacy-clang-tidy < "${{ inputs.clang-tidy-output }}" > /tmp/codacy-out.json
          if [ ${{ inputs.upload }} = true ]; then
            curl -XPOST -L -H "$CURL_CODACY_AUTH_AUTHENTICATION" \
              -H "Content-type: application/json" --data-binary @/tmp/codacy-out.json \
              "${CODACY_BASE_URL_OR_DEFAULT}/2.0/$ORGANIZATION_PROVIDER/$OWNER_NAME/$REPOSITORY_NAME/commit/$COMMIT_SHA/issuesRemoteResults"
          else
            cat /tmp/codacy-out.json
          fi
        else
          echo "Skipping Clang Tidy"
        fi

    - name: "Parse and Push Faux Pas results"
      shell: bash
      run: |
        set -eux

        if [ -n "${{ inputs.faux-pas-output }}" ]; then
          cd /tmp
          curl -fsSL https://api.github.com/repos/codacy/codacy-faux-pas/releases/latest \
            | grep "browser_download_url" | grep -v "browser_download_url.*jar" \
            | cut -d '"' -f 4 \
            | xargs -L 1 curl -fsSL -o /tmp/codacy-faux-pas
          chmod +x /tmp/codacy-faux-pas
          cd -

          /tmp/codacy-faux-pas < "${{ inputs.faux-pas-output }}" > /tmp/codacy-out.json
          if [ ${{ inputs.upload }} = true ]; then
            curl -XPOST -L -H "$CURL_CODACY_AUTH_AUTHENTICATION" \
              -H "Content-type: application/json" --data-binary @/tmp/codacy-out.json \
              "${CODACY_BASE_URL_OR_DEFAULT}/2.0/$ORGANIZATION_PROVIDER/$OWNER_NAME/$REPOSITORY_NAME/commit/$COMMIT_SHA/issuesRemoteResults"
          else
            cat /tmp/codacy-out.json
          fi
        else
          echo "Skipping Faux Pas"
        fi

    - name: "Set Codacy CLI version"
      shell: bash
      run: echo "CODACY_ANALYSIS_CLI_VERSION=7.6.4" >> $GITHUB_ENV
    - name: "Set script path environment variable"
      shell: bash
      run: echo "CLI_SCRIPT_PATH=${{ github.action_path }}/codacy-analysis-cli.sh" >> $GITHUB_ENV
    - name: "Download Codacy CLI script"
      shell: bash
      run: wget -O - https://raw.githubusercontent.com/codacy/codacy-analysis-cli/${{ env.CODACY_ANALYSIS_CLI_VERSION }}/bin/codacy-analysis-cli.sh > ${{ env.CLI_SCRIPT_PATH }}
    - name: "Change Codacy CLI script permissions"
      shell: bash
      run: chmod +x ${{ env.CLI_SCRIPT_PATH }}
    - name: "Run Codacy CLI"
      shell: bash
      run: |
        if [ "${{ inputs.run-docker-tools }}" == "true" ]; then
          ${{ env.CLI_SCRIPT_PATH }} \
            analyze \
            --skip-commit-uuid-validation \
            --commit-uuid $COMMIT_SHA \
            $(if [ "${{ inputs.verbose }}" = "true" ]; then echo "--verbose"; fi) \
            $(if [ -n "${{ inputs.project-token }}" ]; then echo "--project-token ${{ inputs.project-token }}"; fi) \
            $(if [ -n "${{ inputs.api-token }}" ]; then echo "--api-token ${{ inputs.api-token }} --username $OWNER_NAME --project $REPOSITORY_NAME --provider $ORGANIZATION_PROVIDER"; fi) \
            $(if [ -n "${{ inputs.codacy-api-base-url }}" ]; then echo "--codacy-api-base-url ${{ inputs.codacy-api-base-url }}"; fi) \
            $(if [ -n "${{ inputs.format }}" ]; then echo "--format ${{ inputs.format }}"; fi) \
            $(if [ -n "${{ inputs.output }}" ]; then echo "--output ${{ inputs.output }}"; fi) \
            $(if [ -n "${{ inputs.directory }}" ]; then echo "--directory ${{ inputs.directory }}"; fi) \
            $(if [ -n "${{ inputs.parallel }}" ]; then echo "--parallel ${{ inputs.parallel }}"; fi) \
            $(if [ -n "${{ inputs.max-allowed-issues }}" ]; then echo "--max-allowed-issues ${{ inputs.max-allowed-issues }}"; fi) \
            $(if [ -n "${{ inputs.tool }}" ]; then echo "--tool ${{ inputs.tool }}"; fi) \
            $(if [ -n "${{ inputs.tool-timeout }}" ]; then echo "--tool-timeout ${{ inputs.tool-timeout }}"; fi) \
            $(if [ "${{ inputs.skip-uncommitted-files-check }}" = "true" ]; then echo "--skip-uncommitted-files-check"; fi) \
            $(if [ "${{ inputs.upload }}" = "true" ]; then echo "--upload"; fi) \
            $(if [ -n "${{ inputs.upload-batch-size }}" ]; then echo "--upload-batch-size ${{ inputs.upload-batch-size }}"; fi) \
            $(if [ "${{ inputs.fail-if-incomplete }}" = "true" ]; then echo "--fail-if-incomplete"; fi) \
            $(if [ "${{ inputs.allow-network }}" = "true" ]; then echo "--allow-network"; fi) \
            $(if [ "${{ inputs.force-file-permissions }}" = "true" ]; then echo "--force-file-permissions"; fi) \
            $(if [ "${{ inputs.gh-code-scanning-compat }}" = "true" ]; then echo "--gh-code-scanning-compat"; fi)
        else
          echo "Skipping docker tools"
        fi

    - name: "Let Codacy know it can start processing the analysis results"
      shell: bash
      run: |
        if [ ${{ inputs.upload }} = true ]; then
          echo "Uploading results for $ORGANIZATION_PROVIDER/$OWNER_NAME/$REPOSITORY_NAME commit $COMMIT_SHA"
          curl -XPOST -L -H "$CURL_CODACY_AUTH_AUTHENTICATION" \
            -H "Content-type: application/json" \
            "${CODACY_BASE_URL_OR_DEFAULT}/2.0/$ORGANIZATION_PROVIDER/$OWNER_NAME/$REPOSITORY_NAME/commit/$COMMIT_SHA/resultsFinal"
        else
          echo "Skipping results upload"
        fi