Skip to content

ci: add qodana analyzer #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RyogiMutsuki merged 1 commit into from
Jun 12, 2026
Merged

ci: add qodana analyzer #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/qodana.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: Qodana
on:
workflow_dispatch:
pull_request:
push:
branches: # Specify your branches here
- main # The 'main' branch
- 'releases/*' # The release branches
- develop

jobs:
qodana:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
checks: write
Comment on lines +12 to +17

@sourcery-ai sourcery-ai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 suggestion (security): Permissions look broader than needed and could be tightened.

For a static analysis workflow, contents: write, pull-requests: write, and checks: write are quite elevated. If Qodana only needs to create/update checks and comment on PRs, consider dropping contents: write and reducing other scopes to read where possible. Minimizing permissions reduces impact if the workflow token is ever misused or compromised.

Suggested change
qodana:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
checks: write
qodana:
runs-on: ubuntu-latest
permissions:
pull-requests: write
checks: write

steps:
- uses: actions/checkout@v3

@sourcery-ai sourcery-ai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 suggestion (security): Consider pinning GitHub Actions to a specific commit for better supply-chain security.

Tag references like @v3 are mutable and can change over time. Please pin this and the JetBrains/qodana-action below to specific commit SHAs (with an inline comment noting the tag) to reduce supply-chain risk.

Suggested implementation:

      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3.6.0


      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@<PINNED_COMMIT_SHA> # JetBrains/qodana-action@v2026.1

To fully implement the supply-chain hardening:

  1. Replace <PINNED_COMMIT_SHA> with the actual commit SHA corresponding to JetBrains/qodana-action@v2026.1.
  2. If you later upgrade to a new tag (e.g., v2026.2), repeat the process: update the SHA and adjust the inline comment to reflect the new tag.

with:
ref: ${{ github.event.pull_request.head.sha }} # to check out the actual pull request commit, not the merge commit

@sourcery-ai sourcery-ai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): Using github.event.pull_request will fail on push and workflow_dispatch events.

This field only exists on pull_request events; on push/workflow_dispatch it’s undefined and the job will fail. Please gate this ref assignment behind a condition (e.g., only for pull_request), or otherwise use the default actions/checkout behavior / branch on github.event_name so the workflow works for all triggers.

fetch-depth: 0 # a full history is required for pull request analysis
- name: 'Qodana Scan'
uses: JetBrains/qodana-action@v2026.1
with:
pr-mode: true

@sourcery-ai sourcery-ai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: pr-mode: true might not be appropriate for non-PR triggers.

Because this workflow also runs on push and workflow_dispatch, always enabling pr-mode may not be ideal for those events. Consider restricting it with if: github.event_name == 'pull_request' or separating PR and non-PR runs so each uses the appropriate mode.

env:
QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
QODANA_ENDPOINT: 'https://qodana.cloud'
Loading