Get started
+Install, configure, and ship with confidence.
+ Start here +diff --git a/.github/workflows/docusaurus.yml b/.github/workflows/docusaurus.yml new file mode 100644 index 0000000000..d22ca42da1 --- /dev/null +++ b/.github/workflows/docusaurus.yml @@ -0,0 +1,46 @@ +name: Deploy Docusaurus to GitHub Pages + +on: + push: + branches: [ master ] + paths: + - docusaurus/** + workflow_dispatch: + +permissions: + contents: write + +concurrency: + group: pages + cancel-in-progress: true + +jobs: + deploy: + runs-on: ubuntu-latest + defaults: + run: + working-directory: docusaurus + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Setup Node + uses: actions/setup-node@v4 + with: + node-version: 20 + cache: npm + cache-dependency-path: docusaurus/package-lock.json + + - name: Install + run: npm ci + + - name: Build + run: npm run build + + - name: Deploy to gh-pages + uses: peaceiris/actions-gh-pages@v4 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + publish_dir: docusaurus/build + publish_branch: gh-pages-docusaurus diff --git a/.github/workflows/mkdocs.yml b/.github/workflows/mkdocs.yml.disabled similarity index 100% rename from .github/workflows/mkdocs.yml rename to .github/workflows/mkdocs.yml.disabled diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml.disabled similarity index 100% rename from .github/workflows/scheduled.yml rename to .github/workflows/scheduled.yml.disabled diff --git a/.github/workflows/vale.yml b/.github/workflows/vale.yml.disabled similarity index 100% rename from .github/workflows/vale.yml rename to .github/workflows/vale.yml.disabled diff --git a/docusaurus/.gitignore b/docusaurus/.gitignore new file mode 100644 index 0000000000..b2d6de3062 --- /dev/null +++ b/docusaurus/.gitignore @@ -0,0 +1,20 @@ +# Dependencies +/node_modules + +# Production +/build + +# Generated files +.docusaurus +.cache-loader + +# Misc +.DS_Store +.env.local +.env.development.local +.env.test.local +.env.production.local + +npm-debug.log* +yarn-debug.log* +yarn-error.log* diff --git a/docusaurus/README.md b/docusaurus/README.md new file mode 100644 index 0000000000..fe9dbfba06 --- /dev/null +++ b/docusaurus/README.md @@ -0,0 +1,32 @@ +# Website + +This website is built using [Docusaurus](https://docusaurus.io/), a modern static website generator. + +## Installation + +```bash +yarn +or npm install +``` + +## Local Development + +```bash +yarn start +or npm start +``` + +This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server. + +## Build + +```bash +yarn build +or npm run build +``` + +This command generates static content into the `build` directory and can be served using any static contents hosting service. + +## Deployment + +Handled by GitHub actions into Github Pages. \ No newline at end of file diff --git a/docusaurus/TODO b/docusaurus/TODO new file mode 100644 index 0000000000..53cb89fdcf --- /dev/null +++ b/docusaurus/TODO @@ -0,0 +1,101 @@ +MkDocs ➜ Docusaurus migration checklist + +Goal: ship `docusaurus/` as the new production site for https://docs.codacy.com/ + +--- +MVP + +## 0) Make it beautiful +- [x] Colors, fonts and sizes +- [x] Better footer +- [x] Beautiful navigation +- [x] Nav links + +## 0) Apply new theme! +- [ ] Homepage +- [ ] Sidebar +- [x] Navbar +- [ ] Search +- [ ] Footer +- [ ] Nav buttons +- [ ] Reading time? + +## 1) Content parity (docs rendering) +- [ ] Confirm all pages exist in `docusaurus/docs` (count + spot-check key sections) +- [x] Confirm MkDocs-only templating is fully removed from Docusaurus content: + - [x] No Jinja tags (`{% ... %}` / `{{ ... }}`) remain in `docusaurus/docs` + - [x] Replace MkDocs `extra.*` variables with Docusaurus equivalents (MDX constants / front matter / config) +- [x] Confirm MkDocs `include-markdown` usage is fully replaced with `_includes/*.mdx` imports/usages +- [x] Confirm admonitions render as expected (MkDocs `!!! note|tip|warning` ➜ Docusaurus admonitions / MDX syntax) +- [ ] Confirm heading IDs/anchors are stable (MkDocs `toc` permalink + custom `{:#id}` usage) +- [ ] Fix all the links + +## 2) Navigation & information architecture +- [ ] Review `docusaurus/sidebars.ts` vs MkDocs `nav:` in `mkdocs.yml` for: + - [ ] Missing/extra categories + - [ ] Ordering (including release notes yearly grouping) + - [ ] Any pages that should be hidden from sidebar but still routable +- [x] Replace placeholder site metadata in `docusaurus/docusaurus.config.ts` (title/tagline/footer links/GitHub links) +- [x] Decide canonical doc routes (Docusaurus uses `/` as `routeBasePath`): ensure this matches production expectations +--- + +Releseable + +## 3) Redirects (must-have before cutover) +- [ ] Port MkDocs `redirect_maps` from `mkdocs.yml` to Docusaurus redirects + - Recommended: add `@docusaurus/plugin-client-redirects` and generate redirects from `mkdocs.yml` + - Include legacy Zendesk (`hc/...`) redirects and internal moved-page redirects +- [ ] Validate redirects with a link/redirect checker against the built site + +## 5) Release notes specifics +- [ ] RSS feed parity (MkDocs uses `mkdocs-rss-plugin` for `release-notes/*`) + - [ ] Decide feed generation approach (Docusaurus plugin/custom script during build) + - [ ] Ensure `/feed_rss_created.xml` exists (many pages link to it) +- [ ] Confirm release notes sidebar + navigation matches expectations (tabs already added) + +## 8) SEO & meta descriptions (replaces `mkdocs-meta-descriptions`) +- [ ] Decide how to generate meta descriptions (front matter `description` / plugin / build-time extraction) +- [ ] Preserve sitemap + robots behavior (MkDocs workflow wrote `robots.txt` with sitemap link) +- [ ] Validate canonical URLs and avoid indexing preview builds (MkDocs used preview banner + env toggles) + +## 9) CI/CD parity (replaces `.github/workflows/mkdocs.yml`) +- [ ] Add a Docusaurus workflow that covers: + - [ ] Build + - [ ] HTML/link validation equivalent to `htmltest` + `lychee` expectations + - [ ] Branch previews (Netlify or equivalent) + - [ ] Deploy latest to `gh-pages` with `CNAME=docs.codacy.com` + - [ ] Deploy versioned Self-hosted docs from `release/v*` + +--- + +NEXT + +## 4) Versioning strategy (replaces `mike` + `MKDOCS_SELF_HOSTED`) +MkDocs currently publishes: +- Latest docs on `master` to `gh-pages/` +- Self-hosted versions from `release/v*` using `mike deploy ...` (and `MKDOCS_SELF_HOSTED=true`) + +- [ ] Decide Docusaurus versioning model: + - [ ] Use Docusaurus docs versions for Self-hosted (`release/v*` ➜ versioned docs) + - [ ] Decide URL shape for versions (must preserve/redirect existing production URLs) +- [ ] Implement the model in CI (build + deploy) and document how to cut a new Self-hosted version +- [ ] Re-implement any “version selector” behavior (MkDocs `assets/javascripts/version-select.js` + CSS) + +## 6) “Last updated” (replaces `git-revision-date-localized`) +- [ ] Enable/verify “Last updated” on doc pages (date + author if desired) +- [ ] Ensure CI checkout uses full git history (`fetch-depth: 0`) so last update data is correct + +## 7) Tracking, scripts, and UX widgets +MkDocs uses `extra.segment_key`, `extra.user_feedback`, and custom JS/CSS. +- [ ] Add tracking (Segment or chosen tool) to Docusaurus +- [ ] Add Zendesk +- [ ] Re-implement “user feedback” if it was a widget on MkDocs + +## 10) Cleanup & documentation for contributors +- [ ] Update root `README.md` and `CONTRIBUTING.md` for Docusaurus (build/preview instructions) +- [ ] Decide what to do with MkDocs artifacts once cutover is complete: + - [ ] `mkdocs.yml`, `requirements.txt`, MkDocs workflows + - [ ] MkDocs theme submodule `submodules/codacy-mkdocs-material` + +## 11) Update release script +- [ ] Update release script diff --git a/docusaurus/docs/_includes/AdminAccessControlInfo.mdx b/docusaurus/docs/_includes/AdminAccessControlInfo.mdx new file mode 100644 index 0000000000..7d9034565c --- /dev/null +++ b/docusaurus/docs/_includes/AdminAccessControlInfo.mdx @@ -0,0 +1,3 @@ +:::note +Organization admins can [manage access to this feature](/organizations/roles-and-permissions-for-organizations#change-analysis-configuration) +::: \ No newline at end of file diff --git a/docusaurus/docs/_includes/AdminAccessInfo.mdx b/docusaurus/docs/_includes/AdminAccessInfo.mdx new file mode 100644 index 0000000000..779b848428 --- /dev/null +++ b/docusaurus/docs/_includes/AdminAccessInfo.mdx @@ -0,0 +1,3 @@ +:::note +Only organization admins can update this setting. +::: \ No newline at end of file diff --git a/docusaurus/docs/_includes/AiInfo.mdx b/docusaurus/docs/_includes/AiInfo.mdx new file mode 100644 index 0000000000..37a228c48e --- /dev/null +++ b/docusaurus/docs/_includes/AiInfo.mdx @@ -0,0 +1,5 @@ +:::note +- This feature is compatible with most programming languages and requires no additional setup. +- Comments are generated using the description of the static analysis issue, information about the tool that detected the issue, and a few lines of surrounding code to provide the AI with extra context and improve its accuracy. +- This feature leverages the OpenAI API. No information is shared with other third parties or used to train AI models. Refer to the [OpenAI API data usage policies](https://openai.com/policies/api-data-usage-policies) for more information. +::: diff --git a/docusaurus/docs/_includes/ApiExamplePaginationImportant.mdx b/docusaurus/docs/_includes/ApiExamplePaginationImportant.mdx new file mode 100644 index 0000000000..71abd02404 --- /dev/null +++ b/docusaurus/docs/_includes/ApiExamplePaginationImportant.mdx @@ -0,0 +1,3 @@ +:::caution +[Learn how to use pagination](/codacy-api/using-the-codacy-api#using-pagination) to ensure that you process all results returned by the API. +::: \ No newline at end of file diff --git a/docusaurus/docs/_includes/ApiTokenWarning.mdx b/docusaurus/docs/_includes/ApiTokenWarning.mdx new file mode 100644 index 0000000000..fe7052deb8 --- /dev/null +++ b/docusaurus/docs/_includes/ApiTokenWarning.mdx @@ -0,0 +1,5 @@ +:::caution +**Never write API tokens to your configuration files** and keep your API tokens well protected, as they grant owner permissions to your projects on Codacy. + +It's a best practice to store API tokens as environment variables. Check the documentation of your CI/CD platform on how to do this. +::: \ No newline at end of file diff --git a/docusaurus/docs/_includes/ClientSideToolAdvanced.mdx b/docusaurus/docs/_includes/ClientSideToolAdvanced.mdx new file mode 100644 index 0000000000..e6d823eb72 --- /dev/null +++ b/docusaurus/docs/_includes/ClientSideToolAdvanced.mdx @@ -0,0 +1,14 @@ +export default function ClientSideToolAdvanced({ toolName }) { + return ( + <> +
+ See the available{' '} + + Codacy Analysis CLI configuration flags + {' '} + to configure running {toolName} in more advanced scenarios. +
+ > + ); +} diff --git a/docusaurus/docs/_includes/ClientSideToolInstructionsItems.mdx b/docusaurus/docs/_includes/ClientSideToolInstructionsItems.mdx new file mode 100644 index 0000000000..c46f688ff9 --- /dev/null +++ b/docusaurus/docs/_includes/ClientSideToolInstructionsItems.mdx @@ -0,0 +1,74 @@ +import ApiTokenWarning from './ApiTokenWarning.mdx'; + +export default function ClientSideToolInstructionsItems({ toolName }) { + return ( + <> ++ This setting enables Codacy to wait for the results of the local + analysis before resuming the analysis of your commits. +
+
+
+
+
+ export CODACY_PROJECT_TOKEN=<your repository API token>
+
+
+
+
+ export CODACY_API_TOKEN=<your account API token>
+
+
+
+
+ export CODACY_API_BASE_URL=<your Codacy instance URL>
+
+
+ + You can{' '} + + apply the default Git provider integration settings to all + repositories + {' '} + to ensure that your repositories all share the same settings. +
++ Configure the{' '} + + default Git provider integration settings + {' '} + that Codacy applies to new repositories to help ensure that all new + repositories have the same settings. +
+| + | API v3 (recommended) | +API v2 | +
|---|---|---|
| Endpoint documentation | +https://api.codacy.com/api/api-docs | +https://api.codacy.com/api-docs | +
| OpenAPI 2.0 definition | +https://api.codacy.com/api/api-docs/swagger.yaml | +- | + {/**/} + +
| Base URL | +https://api.codacy.com/api/v3 |
+ https://api.codacy.com/ |
+
| Overview | +
+ Use the new endpoints to access and manipulate the following resources, among others: +
|
+
+ Use the legacy endpoints to access and manipulate the following resources: + + |
+
| Scanner name | +Languages | +Files detected | +Other info | +
|---|---|---|---|
| dartanalyzer | +Dart | +analysis_options.yaml |
+ Customizing static analysis | +
| ESLint v8 | +JavaScript, TypeScript | +.eslintrc.js, .eslintrc.cjs, .eslintrc.yaml, .eslintrc.yml, .eslintrc.json |
+ + |
| PMD | +Apex, Java, JavaScript, JSP, PL/SQL, XML, Velocity and Visualforce | +ruleset.xml, apex-ruleset.xml |
+ Supports configuration file in directories other than root and can search up to 5 directories into the repository. | +
| Pylint | +Python | +pylintrc, .pylintrc |
+ Plugins | +
| Semgrep | +Apex, C++, C#, Dockerfile, Elixir, GitHub Actions, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Scala, Shell, Swift, Terraform, TypeScript | +.semgrep.yaml |
+ + |
| IDE | +Recommended LLM | +
|---|---|
| Visual Studio Code | +Claude 3.x Sonnet | +
| Visual Studio Code Insiders | +Claude 4.x Sonnet | +
| Cursor | +Claude 4.x Sonnet | +
| Windsurf | +Claude 3.x Sonnet | +
| Language | +Example coverage tools | +Report files | +
|---|---|---|
| C# | +OpenCover | +opencover.xml (OpenCover) |
+
| dotCover CLI | +dotcover.xml (dotCover detailedXML) |
+|
| Coverlet | +Make sure that you output the report files in a supported format using one of the following file names:opencover.xml (OpenCover)cobertura.xml (Cobertura)lcov.info, lcov.dat, *.lcov (LCOV) |
+|
| Go | +Golang Code Coverage | +Golang report files don't have a specific name. Because of this, later in the setup process you must follow specific instructions while submitting coverage to Codacy. | +
| Java | +JaCoCo | +jacoco*.xml (JaCoCo) |
+
| Cobertura | +cobertura.xml (Cobertura) |
+|
| JavaScript | +Istanbul + Mocha + Blanket.js |
+ lcov.info, lcov.dat, *.lcov (LCOV) |
+
| PHP | +PHPUnit | +coverage-xml/index.xml (PHPUnit XML version <= 4)+ clover.xml (Clover) |
+
| Python | +Coverage.py | +cobertura.xml (Cobertura) |
+
| Ruby | +SimpleCov | +cobertura.xml (Cobertura)+ lcov.info, lcov.dat, *.lcov (LCOV) |
+
| Scala | +sbt-jacoco | +jacoco*.xml (JaCoCo) |
+
| scoverage | +cobertura.xml (Cobertura) |
+|
| Swift/Objective-C | +Xcode Code Coverage | +See below how to generate coverage reports with Xcode | +
| What causes the error? | +How to fix the error? | +
|---|---|
| + Codacy didn't receive the webhook for that commit from the Git provider. + | +
+ Wait a few more minutes until Codacy detects the commit and the status will update automatically. +If it takes more than 5 to 10 minutes for Codacy to detect the commit, the webhook call from the Git provider may have been lost. You can wait until you push a new commit or contact support@codacy.com asking us to sync the commits on Codacy with your Git provider. + |
+
| + The commit SHA-1 hash sent while uploading coverage is wrong. + | ++ Make sure that the Codacy Coverage Reporter detects the correct commit SHA-1 hash for the uploaded coverage data. + | +
| What causes the error? | +How to fix the error? | +
|---|---|
| + Coverage was uploaded for a commit that belongs to a branch that isn't analyzed by Codacy. + | +
+ Make sure that the branch is enabled on Codacy. Alternatively, ensure that the target branch is enabled and open a pull request for Codacy to start analyzing the branch automatically. +If Codacy is already analyzing the branch, make sure that the Codacy Coverage Reporter detects the correct commit SHA-1 hash for the uploaded coverage data. + |
+
| + Coverage was uploaded for a commit that no longer belongs to any branch on the Git repository, for example after a rebase or squash merge. + | ++ The error status is expected in this scenario and you can ignore it. + | +
| What causes the error? | +How to fix the error? | +
|---|---|
| + Codacy hasn't finished analyzing the commit yet. + | ++ Wait a few more minutes until Codacy completes the static code analysis for the commit and the status will update automatically. + | +
| + Codacy didn't analyze the commit on a private repository because the committer doesn't belong to the Codacy organization. + | ++ Make sure that you add all committers to your Codacy organization. + | +
| + Codacy skipped analyzing the commit because there are more recent commits in the branch. + | ++ Upload coverage data for the most recent commit in the branch. + | +
| + The setting Run analysis on your build server is on, but your client-side tools didn't upload results to Codacy. + | ++ Make sure that your client-side tools run successfully and upload the results to Codacy to complete the analysis. + | +
| + Codacy ran into an error while analyzing the commit. + | ++ Solve the issue that caused the analysis to fail (such as Codacy losing access to the repository), or contact us at support@codacy.com asking for help. + | +
| What causes the error? | +How to fix the error? | +
|---|---|
+ Coverage was uploaded with the --partial flag but Codacy didn't receive the final notification.
+ |
+
+ Make sure that after uploading all partial reports you send the final notification.
+ |
+
| What causes the error? | +How to fix the error? | +
|---|---|
| + The file paths in the coverage report don't match the ones on the repository Files page on Codacy. + | +
+ Make sure that the file paths included in your coverage report are relative to the root directory of your repository. For example, src/index.js.
+ |
+
| + The uploaded coverage data only includes information for files that are ignored on Codacy. + | ++ Check which files are ignored on Codacy and make sure that you're generating coverage reports for the correct files in your repository. + | +
| + The uploaded coverage data is incorrectly associated, using the `-l` option, to a language that's not present in your repository. + | ++ Verify that you are associating the correct language, or don't specify a language to let Codacy detect the contents of the coverage reports automatically. See how to upload coverage in advanced scenarios for more information. + | +
| Limit | +Value | +Rationale | +
|---|---|---|
| File size | +150 KB | +
+Large source code files are typically generated by or dependent on a third-party, and could significantly delay the analysis. +See Why is my file over 150 KB missing? + |
+
| File size for coverage reports | +10 MB | +
+Codacy doesn't parse code coverage reports that are over the file size limit. +See JsonParseException while uploading coverage data + |
+
| Number of files for duplication | +5000 | +
+Some tools fail to calculate duplication or time out when analyzing a number of files above this number. +See Why aren't duplication metrics being calculated? + |
+
| Number of issues per file and per tool | +50 | ++Codacy limits the number of issues returned on each file by individual tools as a safeguard against degradation of performance on large or unexpected use cases. This means that in some situations Codacy could report more issues after a push that includes fixes for the currently reported issues. + | +
| Number of comments on the Git provider | +25 | ++Codacy limits the number of comments for reporting found issues on pull requests to avoid triggering too many notification emails and to guard against hitting API rate limits. + | +
| Showing issues on duplicated lines | +- | ++For now, Codacy only reports the first code issue when there are issues on duplicated lines on the same file. + | +
| Highest grade | +![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ ![]() |
+ Lowest grade | +
| File | +Line number | +Covered by tests? | +
|---|---|---|
| ClassA.java | +2 | +Yes | +
| 4 | +Yes | +|
| ClassB.java | +1 | +Yes | +
| 3 | +No | +|
| 11 | +No | +
| + | Common ancestor commit | +Head commit | +||
|---|---|---|---|---|
| File | +Line number | +Covered by tests? | +Line number | +Covered by tests? | +
| ClassA.java | +2 | +Yes | +2 | +Yes | +
| 4 | +Yes | +4 | +Yes | +|
| ClassB.java | +1 | +Yes | +1 | +No | +
| 3 | +No | +3 | +No | +|
| 11 | +No | +11 | +No | +|
| + | Common ancestor commit | +Head commit | +Pull request results | +|||||
|---|---|---|---|---|---|---|---|---|
| File | +Coverable lines |
+ Covered lines |
+ Coverage | +Coverable lines |
+ Covered lines |
+ Coverage | +Coverage variation | +Diff coverage | +
| ClassA.java | +2 | +2 | +100% | +2 | +2 | +100% | +0% | ++ |
| ClassB.java | +3 | +1 | +33.33% | +3 | +0 | +0% | +-33.33% | ++ |
| Total | +5 | +3 | +60% | +5 | +2 | +40% | +-20% | +100% | +
| + | Common ancestor commit | +Head commit | +||
|---|---|---|---|---|
| File | +Line number | +Covered by tests? | +Line number | +Covered by tests? | +
| ClassA.java | +2 | +Yes | +2 | +Yes | +
| 4 | +Yes | +4 | +Yes | +5 | +Yes | ++ | + |
| 6 | +Yes | ++ | + | |
| ClassB.java | +1 | +Yes | +1 | +Yes | +
| 3 | +No | +3 | +No | +|
| 11 | +No | +11 | +No | +|
| + | Common ancestor commit | +Head commit | +Pull request results | +||||
|---|---|---|---|---|---|---|---|
| File | +Coverable lines |
+ Covered lines |
+ Coverage | +Coverable lines |
+ Covered lines |
+ Coverage | +Coverage variation | +
| ClassA.java | +4 | +4 | +100% | +2 | +2 | +100% | +0% | +
| ClassB.java | +3 | +1 | +33.33% | +3 | +1 | +33.33% | +0% | +
| Total | +7 | +5 | +62.5% | +5 | +3 | +60% | +-2.5% | +
| + | Hosting model | +Name used on Codacy | +Required Codacy version | +
|---|---|---|---|
| + GitHub + | +GitHub.com |
+ GitHub Cloud |
+ Codacy Cloud or |
+
GitHub Enterprise Server |
+ GitHub Enterprise |
+ Codacy Self-hosted |
+ |
| + GitLab + | +GitLab SaaS |
+ GitLab Cloud |
+ Codacy Cloud or |
+
GitLab Self-managed |
+ GitLab Enterprise |
+ Codacy Self-hosted |
+ |
| + Bitbucket + | +Bitbucket Cloud |
+ Bitbucket Cloud |
+ Codacy Cloud or |
+
Bitbucket Data Center |
+ Bitbucket Server |
+ Codacy Self-hosted |
+ |
| Language | +File extensions | +Static analysis | +Suggested fixes | +Secret detection | +Dependency vulnerability scanning | +Malicious packages detection 11 | +Duplication | +Complexity | +License scanning | +|
|---|---|---|---|---|---|---|---|---|---|---|
| Apex | +.cls, .trigger | +PMD, + Semgrep 1 | +- | +Semgrep | +- | +- | +PMD CPD 10 | +- | +- | +|
| AsyncAPI | +- | +Spectral | +- | +- | +- | +- | +- | +- | +- | +|
| AWS CloudFormation | +- | +Checkov | +- | +Checkov, + Semgrep 2, + Trivy 2 | +- | +- | +- | +- | +- | +|
| Azure Resource Manager Templates | +- | +Checkov | +- | +- | +- | +- | +- | +- | +- | +|
| C | +.c, .h | +Clang-Tidy 3, + Cppcheck, + Flawfinder, + Semgrep 1 | +Semgrep 🔧 | +Semgrep, + Trivy | +Trivy, scans conan.lock (Conan) |
+ - | +PMD CPD 10 | +Lizard | +- | +|
| C++ | +.cpp, .hpp, .cc, .cxx, .ino | +Clang-Tidy 3, + Cppcheck 4, + Flawfinder, + Semgrep 1 | +- | +Semgrep, + Trivy | +Trivy, scans conan.lock (Conan) |
+ - | +PMD CPD 10 | +Lizard | +- | +|
| C# | +.cs | +Semgrep 1, + SonarC# | +Semgrep 🔧 | +Semgrep, + Trivy | +Trivy, scans .deps.json (.Net), packages.lock.json (NuGet) |
+ Trivy, scans packages.lock.json for malicious packages published in NuGet |
+ PMD CPD 10 | +Lizard | +- | +|
| CoffeeScript | +.coffee | +CoffeeLint | +- | +- | +- | +- | +jscpd | +- | +- | +|
| Crystal | +.cr | +Ameba | +- | +- | +- | +- | +- | +- | +- | +|
| CSS | +.css | +Stylelint | +- | +- | +- | +- | +- | +- | +- | +|
| Dart | +.dart | +dartanalyzer 5 | +- | +Trivy | +Trivy, scans pubspec.lock |
+ - | +jscpd | +- | +- | +|
| Dockerfile | +.dockerfile | +Hadolint, + Semgrep 1 | +Semgrep 🔧 | +Semgrep, + Trivy | +- | +- | +- | +- | +- | +|
| Elixir | +.ex, .exs | +Credo, + Semgrep 1 | +- | +Trivy | +Trivy, scans mix.lock (Mix) |
+ - | +jscpd | +- | +- | +|
| GitHub Actions | +- | +Semgrep 1 | +- | +Semgrep, + Trivy | +- | +- | +- | +- | +- | +|
| Go | +.go | +aligncheck 3, + deadcode 3, + Gosec 3, + Revive, + Semgrep 1, + Staticcheck 3 | +Semgrep 🔧 | +Semgrep, + Trivy | +Trivy, scans go.mod |
+ Trivy, scans go.mod for malicious packages published in github.com |
+ PMD CPD 10 | +Lizard | +- | +|
| Groovy | +.groovy | +CodeNarc | +- | +- | +- | +- | +jscpd | +- | +- | +|
| Helm | +- | +- | +- | +Semgrep 2, Trivy 2 | +- | +- | +- | +- | +- | +- | +
| Java | +.java | +Checkstyle, + PMD, + Semgrep 1, + SpotBugs 3 | +Semgrep 🔧 | +PMD, + Semgrep, + Trivy | +Trivy, scans pom.xml and gradle.lockfile |
+ Trivy, scans pom.xml and gradle.lockfile for malicious packages published in maven |
+ jscpd | +Lizard | +- | +|
| JavaScript | +.js, .jsx, .jsm, .vue, .mjs | +ESLint, + PMD, + Semgrep 1 | +ESLint 🔧 | +Semgrep, + Trivy | +Trivy, scans package.json and package-lock.json (npm), yarn.lock (Yarn) |
+ Trivy, scans package.json and package-lock.json for malicious packages published in npm |
+ PMD CPD 10 | +Lizard | +Trivy, scans package-lock.json (npm) |
+ |
| JSON | +.json | +Jackson Linter | +- | +Checkov, + Trivy | +- | +- | +- | +- | +- | +|
| JSP | +.jsp | +PMD | +- | +- | +- | +- | +PMD CPD 10 | +- | +- | +|
| Kotlin | +.kt, .kts | ++ detekt, + Semgrep 1, + PMD + | +- | +Semgrep | +Trivy, scans pom.xml and gradle.lockfile |
+ Trivy, scans pom.xml and gradle.lockfile for malicious packages published in maven |
+ jscpd | +detekt 10 | +- | +|
| Kubernetes | +- | +Checkov, + Semgrep 2 | +Semgrep 🔧 | +Checkov, + Semgrep 2, + Trivy 2 | +- | +- | +- | +Lizard | +- | +|
| Less | +.less | +Stylelint | +- | +- | +- | +- | +- | +- | +- | +|
| Markdown | +.md, .markdown, .mdown, .mkdn, .mkd, .mdwn, .mkdown, .ron | +remark-lint, markdownlint | +markdownlint 🔧 | +- | +- | +- | +- | +- | +- | +|
| Objective-C | +.m | +Clang-Tidy 3 | +- | +- | +- | +- | +jscpd | +Lizard | +- | +|
| OpenAPI | +- | +Spectral | +- | +- | +- | +- | +- | +- | +- | +|
| PHP | +.php | +PHP_CodeSniffer, + PHP Mess Detector, + Semgrep 1 | +- | +Semgrep, + Trivy | +Trivy, scans composer.lock (Composer) |
+ - | +PHPCPD | +Lizard | +Trivy, scans composer.lock (Composer) |
+ |
| PL/SQL | +.trg, .prc, .fnc, .pld, .pls, .plh, .plb, .pck, .pks, .pkh, .pkb, .typ, .tyb, .tps, .tpb | +PMD | +- | +- | +- | +- | +- | +- | +- | +|
| PostgreSQL | +- | +SQLint | +- | +- | +- | +- | +- | +- | +- | +|
| PowerShell | +.ps1, .psc1, .psd1, .psm1, .ps1xml, .pssc, .cdxml, .clixml | +PSScriptAnalyser | +- | +- | +- | +- | +- | +- | +- | +|
| Python | +.py | ++ Bandit, + Prospector, + Pylint, + Ruff, + Semgrep 1 + | ++ Semgrep 🔧 + | ++ Bandit, + Prospector, + Semgrep, + Trivy + | +
+ Trivy, scans requirements.txt (pip), Pipfile.lock (pipenv), poetry.lock (Poetry), uv.lock (UV)
+ |
+
+ Trivy, scans requirements.txt (pip), Pipfile.lock (pipenv) for malicious packages published in PyPI + |
+ + PMD CPD + 10 + | +Lizard | +Trivy, scans requirements.txt (pip), Pipfile.lock (pipenv), poetry.lock (Poetry), uv.lock (UV) |
+ |
| Ruby | +.rb, .gemspec, .podspec, .jbuilder, .rake, .opal | +Reek, Brakeman 7, RuboCop, Semgrep 1 | +Semgrep 🔧 | +Semgrep, + Trivy | +Trivy, scans Gemfile.lock (Bundler) |
+ Trivy, scans Gemfile.lock for malicious packages published in rubygems.org |
+ Flay | +Lizard | +- | +|
| Rust | +.rs, .rlib | +Semgrep 1 | +- | +Semgrep, + Trivy | +Trivy, scans Cargo.lock (Cargo) |
+ Trivy, scans Cargo.lock for malicious packages published in crates.io |
+ jscpd | +Lizard | +- | +|
| Sass | +.scss | +Stylelint | +- | +- | +- | +- | +- | +- | +- | +|
| Scala | +.scala | +Codacy Scalameta Pro, + Scalastyle, + Semgrep 1, + SpotBugs 3 | +- | +Semgrep, + Trivy | +Trivy, scans build.sbt.lock (sbt) 9 |
+ Trivy, scans build.sbt.lock for malicious packages published in maven 9 |
+ PMD CPD 10 | +Lizard | +- | +|
| Serverless Framework | +- | +Checkov | +- | +- | +- | +- | +- | +- | +- | +|
| Shell | +.sh, .bash | +ShellCheck, + Semgrep 1 | +- | +Semgrep | +- | +- | +- | +- | +- | +|
| Swift | +.swift | ++ Semgrep 1, + SwiftLint, + PMD + | +- | +Semgrep, + Trivy | +Trivy, scans Package.resolved (SwiftPM) |
+ - | +PMD CPD 10 | +Lizard | +- | +|
| SQL | +.sql | ++ PMD, + SQLint, + TSQLLint, + SQLFluff, + Semgrep 1 + | +- | +- | +- | +- | +- | +- | +- | +|
| Terraform | +.tf | +Checkov, + Semgrep 1 | +- | +Checkov, + Semgrep, + Trivy | +- | +- | +- | +- | +- | +|
| Transact-SQL | +.tsql | +TSQLLint | +- | +- | +- | +- | +- | +- | +- | +|
| TypeScript | +.ts, .tsx | +ESLint, + Semgrep 1 | +ESLint 🔧 | +Semgrep, + Trivy | +Trivy, scans package.json and package-lock.json (npm), yarn.lock (Yarn) |
+ Trivy, scans package.json and package-lock.json for malicious packages published in npm |
+ jscpd | +Lizard | +Trivy, scans package-lock.json (npm) |
+ |
| Unity | +- | +Unity Roslyn Analyzers 3 | +- | +- | +- | +- | +- | +- | +- | +|
| Velocity | +.vm | +PMD | +- | +- | +- | +- | +- | +- | +- | +|
| Visual Basic | +.vb | +SonarVB | +- | +- | +- | +- | +jscpd | +- | +- | +|
| Visualforce | +.component, .page | +PMD | +- | +- | +- | +- | +PMD CPD 10 | +- | +- | +|
| XML | +.xml, .xsl, .wsdl, .pom | +PMD | +- | +Trivy | +- | +- | +- | +- | +- | +|
| XSL | +.xsl | +PMD | +- | +- | +- | +- | +- | +- | +- | +|
| YAML | +.yaml, .yml, .env, .env.production, .env.prod, .env.staging, .env.dev, .env.development | +- | +- | +Trivy | +- | +- | +- | +- | +- | +
| Scope | +Permissions | +Description | +
|---|---|---|
| Repository permissions: | +||
| Checks | +Read & Write | +Codacy creates and updates check runs with the results of code analysis. | +
| Issues | +Read & Write | +Codacy can create GitHub issues from issues found during code analysis. | +
| Metadata | +Read-Only | +Codacy retrieves repository metadata, such as name, languages, collaborators and commit information. | +
| Pull requests | +Read & Write | +Codacy retrieves pull request information to display on its side. Codacy might also create comments and suggestions on the pull request, according to the results of code analysis. | +
| Webhooks | +Read & Write | +Codacy creates webhooks for code pushes and pull request events (created, merged, etc.). These events might trigger code analysis. | +
| Commit statuses | +Read & Write | +Codacy sets the status of commits according to the result of code analysis. | +
| Contents | +Read-Only | +Codacy retrieves repository contents to get installation access tokens when integrating with your repositories and clone them, and for code coverage analysis. Codacy requests this permission since September 2023. Make sure an organization owner approves Codacy GitHub App updated permissions on your GitHub organization. |
+
| Organization permissions: | +||
| Webhooks | +Read & Write | +Codacy creates webhooks for organization and repository events (creation, deletion, member added, etc.). | +
| Members | +Read-Only | +Codacy retrieves information about organization members and teams to enforce permissions and user management. | +
User permissions: +These permissions are granted on an individual user basis as part of the user authorization flow. They will be also be displayed during account installation for transparency. |
+ ||
| Email addresses | +Read-Only | +Codacy retrieves the user's email addresses to enforce which commits are eligible for analysis. | +
| Scope | +Description | +
|---|---|
api |
+ Codacy uses GitLab's API to read and update pull requests, create webhooks for code push events, list commits, repositories, groups, members and permissions. | +
read_user |
+ Codacy retrieves the user's email addresses to enforce which commits are eligible for analysis. | +
read_repository |
+ Codacy retrieves repository metadata, such as name, languages and collaborators. | +
openid |
+ Codacy uses this permission for authentication using OpenID Connect. | +
| Scope and permissions | +Description | +
|---|---|
account:write |
+ Codacy retrieves the user's email addresses to enforce which commits are eligible for analysis. | +
repository:admin |
+ Codacy retrieves repository metadata, such as name, languages and collaborators, and commit information. Codacy creates an SSH key on the repository to allow cloning and integrating with your repository. | +
pullrequest:write |
+ Codacy retrieves pull request information to display on its side. Codacy might also create comments on the pull request, according to the results of code analysis. | +
issue:write |
+ Codacy can create Bitbucket issues from issues found during code analysis. | +
webhook |
+ Codacy creates webhooks for code pushes and pull request events (created, merged, etc.). These events might trigger code analysis. | +
team |
+ Codacy uses your group/team membership information to enforce permissions. | +
| + | Read your workspace's project settings and read repositories contained within your workspace's projects. | +
| Status category | +Finding status | +Deadline | +
|---|---|---|
| Open | +Overdue | +The deadline has been missed | +
| Due soon | +Fewer than 15 days to the deadline | +|
| On track | +15 days or more to the deadline | +|
| Closed | +Closed late | +Closed after the deadline | +
| Closed on time | +Closed before the deadline | +
| Language | +Tools that report security issues | +
|---|---|
| Apex | +PMD, + Semgrep 1 | +
| AWS CloudFormation | +Checkov, + Trivy 2 | +
| C | +Clang-Tidy 3, + Cppcheck, + Flawfinder, + Semgrep 1, + Trivy | +
| C# | +SonarC#, + Semgrep 1, + Trivy | +
| C++ | +Clang-Tidy 3, + Cppcheck, + Flawfinder, + Semgrep 1, + Trivy | +
| Dart | +Trivy | +
| Dockerfile | +Hadolint, + Semgrep 1, + Trivy | +
| Elixir | +Credo, + Trivy | +
| GitHub Actions | +Semgrep 1 | +
| Go | +Gosec 3, + Semgrep 1, + Trivy | +
| Groovy | +CodeNarc | +
| Helm | +Trivy 2 | +
| Java | +Semgrep 1, + SpotBugs 3 4, + Trivy | +
| JavaScript | +ESLint 5, + Semgrep 1, + Trivy | +
| JSON | +Trivy | +
| Kotlin | +Semgrep 1 | +
| Kubernetes | +Trivy 2 | +
| Objective-C | +Clang-Tidy 3 | +
| PHP | +PHP_CodeSniffer, + PHP Mess Detector, + Semgrep 1, + Trivy | +
| PowerShell | +PSScriptAnalyser | +
| Python | +Bandit, + Prospector, + Pylint, + Ruff, + Semgrep 1, + Trivy | +
| Ruby | +Brakeman, + RuboCop, + Semgrep 1, + Trivy | +
| Rust | +Semgrep 1, + Trivy | +
| Scala | +Codacy Scalameta Pro, + Semgrep 1, + SpotBugs 3 4 | +
| Swift | +Semgrep 1 | +
| Shell | +ShellCheck + Semgrep 1 | +
| Terraform | +Semgrep 1, + Trivy | +
| Transact-SQL | +TSQLLint | +
| TypeScript | +ESLint 5, + Semgrep 1, + Trivy | +
| Visual Basic | +SonarVB | +
| GitHub role | +Outside collaborator1 |
+ Repository read |
+ Repository triage |
+ Repository write |
+ Repository maintain |
+ Repository admin |
+ - | +Organization Owner |
+
|---|---|---|---|---|---|---|---|---|
| Codacy role | +- | +Repository read |
+ Repository write |
+ Repository admin |
+ Organization manager |
+ Organization admin |
+ ||
| Join organization | +No | +Yes2 | +Yes2 | +Yes2 | +Yes | +Yes2 | +||
| View and follow private repository | +No | +Yes | +Yes | +Yes | +Yes | +Yes | +||
| Access Security and risk management | +No | +Yes3 | +Yes3 | +Yes3 | +Yes | +Yes | +||
| Ignore issues and files, configure code patterns and languages, manage branches, reanalyze branches and pull requests |
+ No | +Configurable | +Configurable | +Yes | +Inherits original permission | +Yes | +||
| Upload coverage using an account API token, see the coverage report logs |
+ No | +No | +Yes | +Yes | +Inherits original permission | +Yes | +||
| Configure repository Git provider integration settings | +No | +No | +No | +Yes | +Inherits original permission | +Yes | +||
| Configure repository quality gates and goals | +No | +No | +No | +Yes | +Inherits original permission | +Yes | +||
| Enable repository analysis to run on a local build server, manage repository API tokens | +No | +No | +No | +Yes | +Inherits original permission | +Yes | +||
| Add and remove repository | +No | +No | +No | +Yes4 | +Inherits original permission | +Yes | +||
| Manage organization gate policies and coding standards | +No | +No | +No | +No | +Yes | +Yes | +||
| Configure organization default settings for Git provider integration | +No | +No | +No | +No | +Yes | +Yes | +||
| Obtain audit logs for organization events5 | +No | +No | +No | +No | +Yes | +Yes | +||
| Invite and accept members, modify billing |
+ No | +No | +No | +No | +No | +Yes | +||
| Assign and revoke the organization manager role | +No | +No | +No | +No | +No | +Yes | +||
| GitLab role | +External user1 |
+ Project guest |
+ Project reporter |
+ Project developer |
+ Project maintainer |
+ Project owner |
+ - | +Group owner |
+ Administrator | +
|---|---|---|---|---|---|---|---|---|---|
| Codacy role | +- | +Repository read |
+ Repository write |
+ Repository admin |
+ Organization manager |
+ Organization admin |
+ |||
| Join organization | +No | +Yes2 | +Yes2 | +Yes2 | +Yes | +Yes2 | +|||
| View and follow private repository | +No | +Yes | +Yes | +Yes | +Yes | +Yes | +|||
| Access Security and risk management | +No | +Yes3 | +Yes3 | +Yes3 | +Yes | +Yes | +|||
| Ignore issues and files, configure code patterns and languages, manage branches, reanalyze branches and pull requests |
+ No | +Configurable | +Configurable | +Yes | +Inherits original permission | +Yes | +|||
| Upload coverage using an account API token, see the coverage report logs |
+ No | +No | +Yes | +Yes | +Inherits original permission | +Yes | +|||
| Configure repository Git provider integration settings | +No | +No | +No | +Yes | +Inherits original permission | +Yes | +|||
| Configure repository quality gates and goals | +No | +No | +No | +Yes | +Inherits original permission | +Yes | +|||
| Configure repository to run analysis on local build server, manage repository API tokens | +No | +No | +No | +Yes | +Inherits original permission | +Yes | +|||
| Add and remove repository | +No | +No | +No | +Yes | +Inherits original permission | +Yes | +|||
| Manage organization gate policies and coding standards | +No | +No | +No | +No | +Yes | +Yes | +|||
| Configure organization default settings for Git provider integration | +No | +No | +No | +No | +Yes | +Yes | +|||
| Obtain audit logs for organization events4 | +No | +No | +No | +No | +Yes | +Yes | +|||
| Invite and accept members, modify billing |
+ No | +No | +No | +No | +No | +Yes | +|||
| Assign and revoke the organization manager role | +No | +No | +No | +No | +No | +Yes | +|||
| Bitbucket role | +Read | +Write1 | +- | +Admin | +
|---|---|---|---|---|
| Codacy role | +Repository read |
+ Organization manager |
+ Organization admin |
+ |
| Join organization | +Yes2 | +Yes | +Yes2 | +|
| View and follow private repository | +Yes | +Yes | +Yes | +|
| Access Security and risk management | +Yes3 | +Yes | +Yes | +|
| Ignore issues and files, configure code patterns and languages, manage branches, reanalyze branches and pull requests |
+ Configurable | +Inherits original permission | +Yes | +|
| Upload coverage using an account API token, see the coverage report logs |
+ No | +Inherits original permission | +Yes | +|
| Configure repository Git provider integration settings | +No | +Inherits original permission | +Yes | +|
| Configure repository quality gates and goals | +No | +Inherits original permission | +Yes | +|
| Configure repository to run analysis on local build server, manage repository API tokens | +No | +Inherits original permission | +Yes | +|
| Add and remove repository | +No | +Inherits original permission | +Yes | +|
| Manage organization gate policies and coding standards | +No | +Yes | +Yes | +|
| Configure organization default settings for Git provider integration | +No | +Yes | +Yes | +|
| Obtain audit logs for organization events4 | +No | +Yes | +Yes | +|
| Invite and accept members, modify billing |
+ No | +No | +Yes | +|
| Assign and revoke the organization manager role | +No | +No | +Yes | +|
| Feature set | +Feature | +Status | +Notes | + + +
|---|---|---|---|
| Git providers | +Git provider status checks | +Live | +The new Coverage engine now sends coverage data to your Git provider. Codacy stopped sending coverage checks from the old Coverage engine on June 5th, 2024. |
+
| GitHub coverage summaries | +Live | +The new Coverage engine now sends coverage summaries to GitHub. If you haven't done so yet, please review and update your app permissions as mentioned above. | +|
| Other pages and components | +Planned | +- | +
| Date | +Event | +What to expect | + + +
|---|---|---|
| February 14th, 2024 | +Deprecation of the old Coverage status check | +
+ From this day on, the new checks will be the official status checks for Codacy Coverage and will no longer be marked beta. The old check will be marked deprecated but will keep working. +If on this date you are still using the old check to block merging pull requests on GitHub, please update your Git provider settings. + |
+
| April 18th, 2024 | +Brownout of the old Coverage status check | +
+ Codacy will not send the old status check on this day. +This will help you confirm that your setup has been updated correctly and lower the risk of disruptions when the old status check is removed. |
+
| June 5th, 2024 | +Removal of the old Coverage status check | +
+ Codacy will stop sending the old status check. +If on this date you are still using the old check to block merging pull requests on GitHub, you will no longer be able to merge them. To fix this, follow the instructions below. + |
+
| Date | +Event | +What to expect | + + +
|---|---|---|
| January 15, 2024 | +Codacy started using installation access tokens to clone and integrate with your repositories | +
+ From this day on, repository SSH keys are used exclusively as a fallback mechanism when the Contents permission is missing. +If not done yet, make sure an organization owner approves Codacy GitHub App updated permissions on your GitHub organization. + |
+
| February 12, 2024 | +Brownout of repository permissions for Administration | +
+ On this day, Codacy won't use any fallback mechanism if the Contents permission is missing. +This will help you confirm that the updated permissions for the Codacy GitHub App were already approved for your organization. |
+
| February 19, 2024 | +Codacy will remove repository permissions for Administration from the Codacy GitHub App and stop using repository SSH keys | +
+ Codacy will start using installation access tokens to clone and integrate with your repositories, with no fallback mechanisms. Also, repository permissions for Administration will be removed from the Codacy GitHub App. +If on this day the Codacy GitHub App updated permissions haven't been approved on your GitHub organization yet, your Codacy quality analysis will fail and you'll not be able to add new repositories to Codacy until an organization owner approves the updated permissions. + |
+
| To define | +Codacy will no longer store repository SSH keys | +
+ On this day, Codacy will delete all the repository SSH keys stored in our systems. +For increased security, you can revoke the keys created by Codacy on your GitHub repository. + |
+
| Tool name | +Languages | +Files detected | +Other info | +
|---|---|---|---|
| Ameba | +Crystal | +.ameba.yml |
+ + |
| Bandit | +Python | +bandit.yml, bandit.yaml, .bandit, bandit.toml, bandit.ini |
+ To solve flagged valid Python "assert" statements, create a bandit.yml on the root of the repository containing: skips: \['B101'\] |
+
| Brakeman | +Ruby | +config/brakeman.yml |
+ + |
| Checkstyle | +Java | +checkstyle.xml |
+ Supports configuration file in directories other than root and can search up to 5 directories into the repository. | +
| CodeNarc | +Groovy | +.codenarcrc |
+ + |
| Credo | +Elixir | +.credo.exs, config/.credo.exs |
+ + |
| dartanalyzer | +Dart | +analysis_options.yml |
+ Customizing static analysis | +
| detekt | +Kotlin | +default-detekt-config.yml, detekt.yml |
+ Supports configuration file in directories other than root and can search up to 5 directories into the repository. | +
| ESLint v8 | +JavaScript, TypeScript | +.eslintrc.js, .eslintrc.cjs, .eslintrc.yaml, .eslintrc.yml, .eslintrc.json |
+ + |
| ESLint v9 | +JavaScript, TypeScript | +eslint.config.js, eslint.config.mjs, eslint.config.cjs |
+ + |
| Hadolint | +Dockerfile | +.hadolint.yaml |
+ + |
| markdownlint | +Markdown | +.markdownlint.yml, .markdownlint.yaml, .markdownlint.jsonc, .markdownlint.json |
+ + |
| PHP_CodeSniffer | +PHP | +phpcs.xml, phpcs.xml.dist |
+ + |
| PHP Mess Detector | +PHP | +codesize.xml, phpmd.xml, phpmd.xml.dist |
+ + |
| PMD | +Apex, Java, JavaScript, JSP, PL/SQL, XML, Velocity and Visualforce | +ruleset.xml, apex-ruleset.xml |
+ Supports configuration file in directories other than root and can search up to 5 directories into the repository. | +
| Prospector | +Python | +.prospector.yml, .prospector.yaml, prospector.yml, prospector.yaml, .landscape.yml, .landscape.yaml, landscape.yml, landscape.yaml |
+ + |
| Pylint | +Python | +pylintrc, .pylintrc |
+ Plugins | +
| remark-lint | +Markdown | +.remarkrc, .remarkrc.json, .remarkrc.yaml, .remarkrc.yml, .remarkrc.js |
+ + |
| Revive | +Go | +revive.toml |
+ + |
| RuboCop | +Ruby | +.rubocop.yml, .rubocop-codacy.yml |
+ Supports alternative configuration file .rubocop-codacy.yml for Codacy analysis, allowing exclusion of private gems. This prevents analysis issues caused by private gem references, ensuring proper validation by Codacy. |
+
| Ruff | +Python | +pyproject.toml, ruff.toml, .ruff.toml |
+ + |
| Scalastyle | +Scala | +scalastyle-config.xml, scalastyle_config.xml |
+ + |
| Semgrep | +Apex, C++, C#, Dockerfile, Elixir, GitHub Actions, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Scala, Shell, Swift, Terraform, TypeScript | +.semgrep.yaml |
+ + |
| SonarC# | +C# | +SonarLint.xml |
+ + |
| SonarVB | +Visual Basic | +SonarLint.xml |
+ + |
| Spectral | +AsyncAPI, OpenAPI | +.spectral.yaml, .spectral.yml, .spectral.json |
+ + |
| SpotBugs | +Java, Scala | +findbugs.xml, findbugs-includes.xml, findbugs-excludes.xml, spotbugs.xml, spotbugs-includes.xml, spotbugs-excludes.xml |
+ Supports configuration file in directories other than root and can search up to 5 directories into the repository. | +
| SQLFluff | +SQL | +setup.cfg, tox.ini, pep8.ini, .sqlfluff, pyproject.toml |
+ Supports configuration file in directories other than root | +
| Stylelint | +CSS, LESS, SASS | +.stylelintrc, stylelint.config.js, .stylelintrc.json, .stylelintrc.yaml, .stylelintrc.yml, .stylelintrc.js |
+ Supports configuration file in directories other than root and can search up to 5 directories into the repository. | +
| SwiftLint | +Swift | +.swiftlint.yml |
+ + |
| TSQLLint | +Transact-SQL | +.tsqllintrc |
+ + |
| Language | +Client-side tool | +Description | +Usage instructions | +
|---|---|---|---|
| C, C++ | +Clang-Tidy | +Clang-tidy is a clang-based C++ “linter” tool. Its purpose is to provide an extensible framework for diagnosing and fixing typical programming errors, like style violations, interface misuse, or bugs that can be deduced via static analysis. Clang-tidy is modular and provides a convenient interface for writing new checks. | +Running Clang-Tidy (standalone) | +
| Go | +aligncheck | +aligncheck is a utility for finding unused struct fields in Go source files. | +Running aligncheck (containerized) | +
| deadcode | +deadcode is a very simple utility which detects unused declarations in Go packages. | +Running deadcode (containerized) | +|
| Gosec | +Gosec inspects source code for security problems by scanning the Go AST. | +Running Gosec (standalone) | +|
| Staticcheck | +Staticcheck is a state of the art linter for the Go programming language. Using static analysis, it finds bugs and performance issues, offers simplifications, and enforces style rules. | +Running Staticcheck (standalone) | +|
| Java, Scala | +SpotBugs | +SpotBugs is a program which uses static analysis to look for bugs in Java code. Together with the Find Security Bugs plugin it provides security audits. It has support for Maven, sbt, and Gradle in Java projects. | +Running SpotBugs (containerized) | +
| Objective-C | +Clang-Tidy | +Clang-tidy is a clang-based C++ "linter" tool. Its purpose is to provide an extensible framework for diagnosing and fixing typical programming errors, like style violations, interface misuse, or bugs that can be deduced via static analysis. Clang-tidy is modular and provides a convenient interface for writing new checks. | +Running Clang-Tidy (standalone) | +
| Unity | +Unity Roslyn Analyzers | +Unity-specific diagnostics for CSharp Unity projects. | +Running Unity Roslyn Analyzers (standalone) | +
+ If you're using an account API token, you must also
+ provide the flags --provider, --username,
+ and --project. You can obtain the values for these
+ flags from the URL of your repository dashboard on Codacy:
+
+ If you're using an account API token, you must also
+ provide the flags --provider, --username,
+ and --project. You can obtain the values for these
+ flags from the URL of your repository dashboard on Codacy:
+
+ If you're using an account API token, you must also
+ provide the flags --provider, --username,
+ and --project. You can obtain the values for these
+ flags from the URL of your repository dashboard on Codacy:
+
![]() |
+ ![]() |
+
| + + | +
+
|
+
+
|
+
+
|
+
| Language | +Who made it possible | +
|---|---|
| +CoffeeScript + | ++Ryan Delaney + | +
| +Elixir + | ++Grant McLendon + | +
| +PowerShell + | ++Aditya Patwardhan + | +
| +Crystal + | ++Vitalii Elenhaupt + | +
| + + | ++ + | ++ + | +
Codacy Docs
++ Practical guides, API references, and release notes for Codacy. +
+Install, configure, and ship with confidence.
+ Start here +Automate workflows with Codacy APIs.
+ Browse API docs +Connect Codacy with your CI and SCM tools.
+ See integrations +