Jeppe B
6566027746
## Summary - configure advisory Qodana PHP 2026.1 analysis for trusted pull requests and master, beta, canary, and internal branch scans - install both Composer projects and the edge-agent/edge-broker Node dependencies before analysis - exclude generated, vendor, build, cache, legacy-test, and local-agent trees - keep Quick Fixes, SARIF artifacts, baselines, thresholds, and required-check enforcement disabled during calibration ## Safety - fails closed when QODANA_TOKEN is absent - skips draft, fork, and Dependabot pull requests - uses least-privilege GitHub permissions and immutable action SHAs - uploads findings to the dedicated api Qodana Cloud project ## Validation - actionlint 1.7.12 - SchemaStore qodana-1.0 validation - bootstrap shell syntax and lockfile structure checks - immutable action tag verification - git diff --check - independent review completed with no findings ## Live verification - [PR-mode scan](https://github.com/copenhagentruckwash/api/actions/runs/29494056175) completed successfully with 0 changed-file problems, 439 inspections, and a passed license audit ([Qodana report](https://qodana.cloud/projects/P2nXd/reports/LJv98e)) - [full branch scan](https://github.com/copenhagentruckwash/api/actions/runs/29495399119) completed successfully and uploaded 8,248 current findings across 725 files, 439 inspections, and a passed license audit to the dedicated api project ([Qodana report](https://qodana.cloud/projects/P2nXd/reports/qJMOxX)) - the initial debt remains advisory; baseline and required-check enforcement are intentionally deferred until findings are triaged
75 lines
1.9 KiB
YAML
75 lines
1.9 KiB
YAML
name: Qodana
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
- beta
|
|
- canary
|
|
- internal
|
|
types:
|
|
- opened
|
|
- reopened
|
|
- synchronize
|
|
- ready_for_review
|
|
push:
|
|
branches:
|
|
- master
|
|
- beta
|
|
- canary
|
|
- internal
|
|
|
|
concurrency:
|
|
group: qodana-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
qodana:
|
|
name: Qodana
|
|
if: >-
|
|
github.event_name != 'pull_request' ||
|
|
(
|
|
github.event.pull_request.draft == false &&
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
github.event.pull_request.user.login != 'dependabot[bot]'
|
|
)
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
checks: write
|
|
pull-requests: write
|
|
steps:
|
|
- name: Require Qodana Cloud token
|
|
env:
|
|
QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -z "${QODANA_TOKEN}" ]]; then
|
|
echo "::error::QODANA_TOKEN is not configured for this repository."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Check out the analyzed commit
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Run Qodana
|
|
uses: JetBrains/qodana-action@4861e015da555e86a72b862892aba6c2b93e6891 # v2026.1.3
|
|
with:
|
|
pr-mode: ${{ github.event_name == 'pull_request' }}
|
|
use-caches: true
|
|
cache-default-branch-only: true
|
|
use-annotations: true
|
|
post-pr-comment: true
|
|
github-token: ${{ github.token }}
|
|
push-fixes: none
|
|
upload-result: false
|
|
env:
|
|
QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
|