ci: add qodana analyzer - #1
Merged
Merged
Conversation
Member
Author
|
@sourcery-ai review |
Reviewer's GuideAdds a new GitHub Actions workflow to run JetBrains Qodana static analysis on main, release, and develop branches as well as on pull requests, including checkout of the exact PR commit and configuration for Qodana Cloud integration. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 4 issues, and left some high level feedback:
- The
ref: ${{ github.event.pull_request.head.sha }}in the checkout step will fail forpushandworkflow_dispatchevents wheregithub.event.pull_requestis not defined; consider conditioning this step or usinggithub.shafor non-PR triggers. - The workflow currently runs on both
pull_requestandpushtomain,develop, andreleases/*, which may duplicate analysis for the same changes; consider narrowing triggers or differentiating behavior between PR and push events. - You might be able to scope down the job permissions (e.g.,
contents: readinstead ofwriteif artifacts or commits are not modified) to follow least-privilege principles while still allowing Qodana to report results.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `ref: ${{ github.event.pull_request.head.sha }}` in the checkout step will fail for `push` and `workflow_dispatch` events where `github.event.pull_request` is not defined; consider conditioning this step or using `github.sha` for non-PR triggers.
- The workflow currently runs on both `pull_request` and `push` to `main`, `develop`, and `releases/*`, which may duplicate analysis for the same changes; consider narrowing triggers or differentiating behavior between PR and push events.
- You might be able to scope down the job permissions (e.g., `contents: read` instead of `write` if artifacts or commits are not modified) to follow least-privilege principles while still allowing Qodana to report results.
## Individual Comments
### Comment 1
<location path=".github/workflows/qodana.yml" line_range="21" />
<code_context>
+ steps:
+ - uses: actions/checkout@v3
+ with:
+ ref: ${{ github.event.pull_request.head.sha }} # to check out the actual pull request commit, not the merge commit
+ fetch-depth: 0 # a full history is required for pull request analysis
+ - name: 'Qodana Scan'
</code_context>
<issue_to_address>
**issue (bug_risk):** Using `github.event.pull_request` will fail on `push` and `workflow_dispatch` events.
This field only exists on `pull_request` events; on `push`/`workflow_dispatch` it’s undefined and the job will fail. Please gate this `ref` assignment behind a condition (e.g., only for `pull_request`), or otherwise use the default `actions/checkout` behavior / branch on `github.event_name` so the workflow works for all triggers.
</issue_to_address>
### Comment 2
<location path=".github/workflows/qodana.yml" line_range="12-17" />
<code_context>
+jobs:
+ qodana:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ pull-requests: write
+ checks: write
+ steps:
+ - uses: actions/checkout@v3
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Permissions look broader than needed and could be tightened.
For a static analysis workflow, `contents: write`, `pull-requests: write`, and `checks: write` are quite elevated. If Qodana only needs to create/update checks and comment on PRs, consider dropping `contents: write` and reducing other scopes to `read` where possible. Minimizing permissions reduces impact if the workflow token is ever misused or compromised.
```suggestion
qodana:
runs-on: ubuntu-latest
permissions:
pull-requests: write
checks: write
```
</issue_to_address>
### Comment 3
<location path=".github/workflows/qodana.yml" line_range="19" />
<code_context>
+ pull-requests: write
+ checks: write
+ steps:
+ - uses: actions/checkout@v3
+ with:
+ ref: ${{ github.event.pull_request.head.sha }} # to check out the actual pull request commit, not the merge commit
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Consider pinning GitHub Actions to a specific commit for better supply-chain security.
Tag references like `@v3` are mutable and can change over time. Please pin this and the `JetBrains/qodana-action` below to specific commit SHAs (with an inline comment noting the tag) to reduce supply-chain risk.
Suggested implementation:
```
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3.6.0
```
```
- name: 'Qodana Scan'
uses: JetBrains/qodana-action@<PINNED_COMMIT_SHA> # JetBrains/qodana-action@v2026.1
```
To fully implement the supply-chain hardening:
1. Replace `<PINNED_COMMIT_SHA>` with the actual commit SHA corresponding to `JetBrains/qodana-action@v2026.1`.
- You can find this by:
- Visiting https://github.com/JetBrains/qodana-action
- Checking the commit pointed to by the `v2026.1` tag
- Copying that full SHA into the workflow.
2. If you later upgrade to a new tag (e.g., `v2026.2`), repeat the process: update the SHA and adjust the inline comment to reflect the new tag.
</issue_to_address>
### Comment 4
<location path=".github/workflows/qodana.yml" line_range="26" />
<code_context>
+ - name: 'Qodana Scan'
+ uses: JetBrains/qodana-action@v2026.1
+ with:
+ pr-mode: true
+ env:
+ QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
</code_context>
<issue_to_address>
**question:** `pr-mode: true` might not be appropriate for non-PR triggers.
Because this workflow also runs on `push` and `workflow_dispatch`, always enabling `pr-mode` may not be ideal for those events. Consider restricting it with `if: github.event_name == 'pull_request'` or separating PR and non-PR runs so each uses the appropriate mode.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| steps: | ||
| - uses: actions/checkout@v3 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} # to check out the actual pull request commit, not the merge commit |
There was a problem hiding this comment.
issue (bug_risk): Using github.event.pull_request will fail on push and workflow_dispatch events.
This field only exists on pull_request events; on push/workflow_dispatch it’s undefined and the job will fail. Please gate this ref assignment behind a condition (e.g., only for pull_request), or otherwise use the default actions/checkout behavior / branch on github.event_name so the workflow works for all triggers.
Comment on lines
+12
to
+17
| qodana: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| checks: write |
There was a problem hiding this comment.
🚨 suggestion (security): Permissions look broader than needed and could be tightened.
For a static analysis workflow, contents: write, pull-requests: write, and checks: write are quite elevated. If Qodana only needs to create/update checks and comment on PRs, consider dropping contents: write and reducing other scopes to read where possible. Minimizing permissions reduces impact if the workflow token is ever misused or compromised.
Suggested change
| qodana: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| checks: write | |
| qodana: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write | |
| checks: write |
| pull-requests: write | ||
| checks: write | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
🚨 suggestion (security): Consider pinning GitHub Actions to a specific commit for better supply-chain security.
Tag references like @v3 are mutable and can change over time. Please pin this and the JetBrains/qodana-action below to specific commit SHAs (with an inline comment noting the tag) to reduce supply-chain risk.
Suggested implementation:
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3.6.0
- name: 'Qodana Scan'
uses: JetBrains/qodana-action@<PINNED_COMMIT_SHA> # JetBrains/qodana-action@v2026.1
To fully implement the supply-chain hardening:
- Replace
<PINNED_COMMIT_SHA>with the actual commit SHA corresponding toJetBrains/qodana-action@v2026.1.- You can find this by:
- Visiting https://github.com/JetBrains/qodana-action
- Checking the commit pointed to by the
v2026.1tag - Copying that full SHA into the workflow.
- You can find this by:
- If you later upgrade to a new tag (e.g.,
v2026.2), repeat the process: update the SHA and adjust the inline comment to reflect the new tag.
| - name: 'Qodana Scan' | ||
| uses: JetBrains/qodana-action@v2026.1 | ||
| with: | ||
| pr-mode: true |
There was a problem hiding this comment.
question: pr-mode: true might not be appropriate for non-PR triggers.
Because this workflow also runs on push and workflow_dispatch, always enabling pr-mode may not be ideal for those events. Consider restricting it with if: github.event_name == 'pull_request' or separating PR and non-PR runs so each uses the appropriate mode.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
CI: