Skip to content

Commit e2198bb

Browse files
yacosta738yacosta738
authored
ci: Add Detekt static analysis workflow (#29)
* Add Detekt static analysis workflow This workflow performs static analysis of Kotlin code using Detekt, triggered on pushes, pull requests, and scheduled runs. * fix: update Detekt workflow with fixes and v1.23.8 upgrade - Quote YAML keys (on) and fix branch array spacing - Fix schedule cron indentation - Update DETEKT_RELEASE_TAG from v1.15.0 to v1.23.8 - Fix jq path for DETEKT_RELEASE_SHA extraction (tagCommit.oid) - Quote all shell variables in run scripts for safety - Quote github.workspace in jq --arg for relative URI step * fix: update expected commit SHA for Detekt v1.23.8 * fix: update Detekt workflow for v1.23.8 asset changes - Fetch all assets and filter by name containing 'detekt-cli' and 'zip' - Use zip instead of jar for the CLI distribution - Update setup to unzip the downloaded file - Update run command to use the correct detekt binary path * fix: add permissions block and update SARIF relativization comment - Add job-level permissions with security-events: write for upload-sarif - Update comment to note Detekt v1.23.8 still needs jq URI transformation * fix: correct Detekt binary path and update CodeQL action to v4 - Fix Setup Detekt to add correct bin directory to PATH (detekt-cli-VERSION/bin) - Use detekt-cli command instead of direct binary path - Update CodeQL action from v3 to v4 (v3 deprecated)
1 parent f0053a6 commit e2198bb

1 file changed

Lines changed: 129 additions & 0 deletions

File tree

‎.github/workflows/detekt.yml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow performs a static analysis of your Kotlin source code using
7+
# Detekt.
8+
#
9+
# Scans are triggered:
10+
# 1. On every push to default and protected branches
11+
# 2. On every Pull Request targeting the default branch
12+
# 3. On a weekly schedule
13+
# 4. Manually, on demand, via the "workflow_dispatch" event
14+
#
15+
# The workflow should work with no modifications, but you might like to use a
16+
# later version of the Detekt CLI by modifying the $DETEKT_RELEASE_TAG
17+
# environment variable.
18+
name: Scan with Detekt
19+
20+
"on":
21+
# Triggers the workflow on push or pull request events but only for default and protected branches
22+
push:
23+
branches: ["main"]
24+
pull_request:
25+
branches: ["main"]
26+
schedule:
27+
- cron: "38 13 * * 3"
28+
29+
# Allows you to run this workflow manually from the Actions tab
30+
workflow_dispatch:
31+
32+
env:
33+
# Release tag associated with version of Detekt to be installed
34+
# SARIF support (required for this workflow) was introduced in Detekt v1.15.0
35+
DETEKT_RELEASE_TAG: v1.23.8
36+
37+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
38+
jobs:
39+
# This workflow contains a single job called "scan"
40+
scan:
41+
name: Scan
42+
# The type of runner that the job will run on
43+
runs-on: ubuntu-latest
44+
45+
# Required for upload-sarif to push security events
46+
permissions:
47+
security-events: write
48+
49+
# Steps represent a sequence of tasks that will be executed as part of the job
50+
steps:
51+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
52+
- uses: actions/checkout@v4
53+
54+
# Gets the download URL associated with the $DETEKT_RELEASE_TAG
55+
- name: Get Detekt download URL
56+
id: detekt_info
57+
env:
58+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
59+
run: |
60+
gh api graphql --field tagName=$DETEKT_RELEASE_TAG --raw-field query='
61+
query getReleaseAssetDownloadUrl($tagName: String!) {
62+
repository(name: "detekt", owner: "detekt") {
63+
release(tagName: $tagName) {
64+
releaseAssets(first: 10) {
65+
nodes {
66+
name
67+
downloadUrl
68+
}
69+
}
70+
tagCommit {
71+
oid
72+
}
73+
}
74+
}
75+
}
76+
' 1> gh_response.json
77+
78+
DETEKT_RELEASE_SHA=$(jq --raw-output '.data.repository.release.tagCommit.oid' gh_response.json)
79+
if [ "$DETEKT_RELEASE_SHA" != "046263730eb5368cb344489ac36543294e8e87bd" ]; then
80+
echo "Release tag doesn't match expected commit SHA"
81+
exit 1
82+
fi
83+
84+
DETEKT_DOWNLOAD_URL=$(jq --raw-output '.data.repository.release.releaseAssets.nodes[] | select(.name | contains("detekt-cli")) | select(.name | contains("zip")) | .downloadUrl' gh_response.json)
85+
echo "download_url=$DETEKT_DOWNLOAD_URL" >> "$GITHUB_OUTPUT"
86+
87+
# Sets up the detekt cli
88+
- name: Setup Detekt
89+
run: |
90+
dest="$(mktemp -d)"
91+
curl --request GET \
92+
--url "${{ steps.detekt_info.outputs.download_url }}" \
93+
--silent \
94+
--location \
95+
--output "$dest/detekt.zip"
96+
unzip -q "$dest/detekt.zip" -d "$dest"
97+
# The zip extracts to detekt-cli-VERSION/bin/detekt-cli
98+
# Convert v1.23.8 to 1.23.8 for the directory name
99+
version="${DETEKT_RELEASE_TAG#v}"
100+
echo "$dest/detekt-cli-$version/bin" >> "$GITHUB_PATH"
101+
102+
# Performs static analysis using Detekt
103+
- name: Run Detekt
104+
continue-on-error: true
105+
run: |
106+
detekt-cli --input "${{ github.workspace }}" --report sarif:"${{ github.workspace }}/detekt.sarif.json"
107+
108+
# Modifies the SARIF output produced by Detekt so that absolute URIs are relative
109+
# This is so we can easily map results onto their source files
110+
# NOTE: Detekt v1.23.8 still outputs absolute URIs in SARIF (no native --base-path support)
111+
# The jq transformation strips the absolute workspace path to produce relative paths
112+
# This can be removed if Detekt adds native relative URI support in a future release
113+
# See: https://git.io/JLBbA
114+
- name: Make artifact location URIs relative
115+
continue-on-error: true
116+
run: |
117+
echo "$(
118+
jq \
119+
--arg github_workspace "${{ github.workspace }}" \
120+
'. | ( .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= if test($github_workspace) then .[($github_workspace | length | . + 1):] else . end )' \
121+
"${{ github.workspace }}/detekt.sarif.json"
122+
)" > "${{ github.workspace }}/detekt.sarif.json"
123+
124+
# Uploads results to GitHub repository using the upload-sarif action
125+
- uses: github/codeql-action/upload-sarif@v4
126+
with:
127+
# Path to SARIF file relative to the root of the repository
128+
sarif_file: ${{ github.workspace }}/detekt.sarif.json
129+
checkout_path: ${{ github.workspace }}

0 commit comments

Comments
 (0)