Qodana is a code quality monitoring tool that identifies and suggests fixes for bugs, security vulnerabilities, duplications, and imperfections. Using this GitHub Action, run Qodana with your GitHub workflow to scan your Java, Kotlin, PHP, Python, JavaScript, TypeScript projects (and other supported technologies by Qodana).

Table of Contents

• Qodana Scan
  • Usage
  • Configuration
  • Issue Tracker
  • License

You can run Qodana with GitHub Actions using Qodana Scan. To do it, add .github/workflows/code_scanning.yml to your repository with the following contents:

name: Qodana
on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
      - 'releases/*'
jobs:
  qodana:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v4.2.2
        with:
          linter: jetbrains/qodana-jvm  # pick the needed linter – https://www.jetbrains.com/help/qodana/docker-images.html

We recommend that you have a separate workflow file for Qodana because different jobs run in parallel.

Using this workflow, Qodana will run on the main branch, release branches, and on the pull requests coming to your repository. Inspection results will be available in the GitHub UI.

You can set up a Qodana workflow badge in your repository:

To do it, follow these steps:

1. Navigate to the workflow run that you previously configured.
2. On the workflow page, select Create status badge.
3. Copy the Markdown text to your repository README file.

You can set up GitHub code scanning for your project using Qodana and manage problems found by Qodana on GitHub. To do it, add .github/workflows/code_scanning.yml to your repository with the following contents:

name: Qodana
on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
      - 'releases/*'
jobs:
  qodana:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v4.2.2
        with:
          linter: jetbrains/qodana-jvm  # pick the needed linter – https://www.jetbrains.com/help/qodana/docker-images.html
          use-annotations: false  # disabled to make sure the found problems are not duplicated on GitHub
      - uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: ${{ runner.temp }}/qodana/results/qodana.sarif.json

If you want to study Qodana reports directly on GitHub, you can host it on your repository GitHub Pages using this example workflow:

      - name: Deploy to GitHub Pages
        uses: peaceiris/actions-gh-pages@v3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ${{ runner.temp }}/qodana/results/report
          destination_dir: ./

Hosting of multiple Qodana reports in a single GitHub Pages repository is not supported.

You can enforce GitHub to block the merge of pull requests if the Qodana quality gate has failed. To do it, create a branch protection rule as described below:

1. Create new or open an existing GitHub workflow with the Qodana Action specified.
2. Set the workflow to run on pull_request events that target the main branch.

on:
  pull_request:
    branches:
    - main

Instead of main, you can specify your branch here.

3. Set 1 for the Qodana Action fail-threshold option.
4. Under your repository name, click Settings.
5. On the left menu, click Branches.
6. In the branch protection rules section, click Add rule.
7. Add main to Branch name pattern.
8. Select Require status checks to pass before merging.
9. Search for the Qodana status check, then check it.
10. Click Create.

For more information about branch protection rules, refer to the original GitHub Documentation.

All the issues, feature requests, and support related to the Qodana GitHub Action are handled on YouTrack.

If you'd like to file a new issue, please use the link YouTrack | New Issue.

This repository contains source code for Qodana GitHub Action and is licensed under Apache-2.0.

View license information for the Qodana Community images.

Qodana Docker images may contain other software which is subject to other licenses, for example, Bash relating to the base distribution or with any direct or indirect dependencies of the primary software.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

Using the Qodana EAP Docker images, you agree to JetBrains EAP user agreement and JetBrains privacy policy. The docker image includes an evaluation license which will expire in 30-day. Please ensure you pull a new image on time.