codacy.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow checks out code, performs a Codacy security scan
# and integrates the results with the
# GitHub Advanced Security code scanning feature.
# For more information on the Codacy security scan action usage and
# parameters, see https://github.com/codacy/codacy-analysis-cli-action.
# For more information on Codacy Analysis CLI in general, see
# https://github.com/codacy/codacy-analysis-cli.

name: Codacy Security Scan

concurrency:
  # This concurrency group ensures that only one Codacy analysis runs at a time
  group: codacy-${{ github.ref_name }}
  cancel-in-progress: true

on:
  push:
    branches: ["main"]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: ["main"]
  schedule:
    - cron: "42 0 * * 1"

permissions:
  contents: read

jobs:
  codacy-security-scan:
    permissions:
      # for actions/checkout to fetch code
      contents: read
      # for github/codeql-action/upload-sarif to upload SARIF results
      security-events: write
      # only required for a private repository by
      # github/codeql-action/upload-sarif to get the Action run status
      actions: read
    name: Codacy Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set Codacy paths
        run: |
          set -euo pipefail
          echo "CODACY_WORKDIR=$RUNNER_TEMP/codacy-src" >> "$GITHUB_ENV"
          echo "CODACY_SARIF=$RUNNER_TEMP/results.sarif" >> "$GITHUB_ENV"

      - name: Prepare workspace copy without .git
        run: |
          set -euo pipefail
          mkdir -p "$CODACY_WORKDIR"
          rsync -a --delete --exclude '.git' ./ "$CODACY_WORKDIR/"

      # Execute Codacy Analysis CLI and generate a SARIF output with
      # the security issues identified during the analysis
      - name: Run Codacy Analysis CLI
        # Cap Codacy runtime so a hung analyzer does not consume the full job timeout.
        timeout-minutes: 20
        # Codacy's opengrep/semgrep engine can fail intermittently;
        # allow the workflow to continue so we can still upload a fallback SARIF.
        continue-on-error: true
        uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08
        with:
          # Check https://github.com/codacy/codacy-analysis-cli#project-token
          # to get your project token from your Codacy repository.
          # You can also omit the token and run the tools that support
          # default configurations
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          verbose: true
          directory: ${{ env.CODACY_WORKDIR }}
          output: ${{ env.CODACY_SARIF }}
          format: sarif
          skip-uncommitted-files-check: true
          # Adjust severity of non-security issues
          gh-code-scanning-compat: true
          # Force 0 exit code to allow SARIF file generation
          # This will handover control about PR rejection to the GitHub side
          max-allowed-issues: 2147483647

      # Process SARIF file to split by tool
      - name: Split SARIF by tool
        run: |
          # Fail fast and surface errors clearly
          set -euo pipefail
          if [ -f "$CODACY_SARIF" ] && [ -s "$CODACY_SARIF" ]; then
            echo "$CODACY_SARIF present; preselecting for upload and skipping split."
            echo "SARIF_FILE=$CODACY_SARIF" >> "$GITHUB_ENV"
            exit 0
          else
            echo "No SARIF file found or file is empty: $CODACY_SARIF"
            echo "Creating empty SARIF file to prevent workflow failure"
            # Create empty SARIF file with proper schema
            schema_url="https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
            empty_sarif="$RUNNER_TEMP/sarif_empty.sarif"
            {
              echo '{'
              echo "  \"\$schema\": \"$schema_url\","
              echo '  "version": "2.1.0",'
              echo '  "runs": []'
              echo '}'
            } > "$empty_sarif"
            # Mark the empty SARIF for upload
            echo "SARIF_FILE=$empty_sarif" >> "$GITHUB_ENV"
            exit 0
          fi

      # Select SARIF file for upload
      - name: Select SARIF file for upload
        run: |
          set -euo pipefail
          # Honor preselected SARIF_FILE from earlier steps (e.g., empty SARIF case)
          if [ -n "${SARIF_FILE:-}" ]; then
            echo "Preselected SARIF_FILE=$SARIF_FILE; not overriding."
            exit 0
          fi
          # First, try to upload the original SARIF file if it exists
          if [ -f "$CODACY_SARIF" ] && [ -s "$CODACY_SARIF" ]; then
            echo "Found $CODACY_SARIF, attempting upload..."
            echo "SARIF_FILE=$CODACY_SARIF" >> "$GITHUB_ENV"
          else
            echo "No valid SARIF files found"
            echo "SARIF_FILE=" >> "$GITHUB_ENV"
          fi
        continue-on-error: true

      # Upload the identified SARIF file
      - name: Upload identified SARIF file
        if: always() && env.SARIF_FILE != ''
        uses: github/codeql-action/upload-sarif@b36bf259c813715f76eafece573914b94412cd13 # v3
        with:
          sarif_file: ${{ env.SARIF_FILE }}
        continue-on-error: true