tomasbjerre/violation-comments-to-gitea-command-line

By tomasbjerre

•Updated 9 days ago

Report static code analysis to Gitea.

Image

Overview Tags

tomasbjerre/violation-comments-to-gitea-command-line repository overview

⁠Violation Comments To Gitea Command Line

Report static code analysis to Gitea. It uses the Violations Lib⁠.

Reports can be as single comments for each violation:

Gitea Single Comment

Or one comment with a summary of all violations:

Gitea Summary Comment

The runnable jar can be found in Maven Central⁠ and used like java -jar violation-comments-to-gitea-command-line-*.jar .....
The runnable can be found in NPM⁠.
The Docker image can be found in Dockerhub⁠ and used like docker run --mount src="$(pwd)",target=/usr/src/violation-comments-to-gitea-command-line,type=bind tomasbjerre/violation-comments-to-gitea-command-line:X.

Run it with:

npx violation-comments-to-gitea-command-line \
 -pat TOKENHERE \
 -url https://gitea.example.com \
 -owner OWNER \
 -rs REPO_SLUG \
 -prid 1234 \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
 -v "JSHINT" "." ".*jshint/report\.xml$" "JSHint"

You must perform the merge before build. If you don't perform the merge, the reported violations will refer to other lines then those in the pull request. The merge can be done with a shell script like this.

echo ---
echo --- Merging from $FROM in $FROMREPO to $TO in $TOREPO
echo ---
git clone $TOREPO
cd *
git reset --hard $TO
git status
git remote add from $FROMREPO
git fetch from
git merge $FROM
git --no-pager log --max-count=10 --graph --abbrev-commit

Your build command here!

Example of supported reports are available here⁠.

A number of parsers have been implemented. Some parsers can parse output from several reporters.

Reporter	Parser	Notes
ARM-GCC⁠	`CLANG`
AndroidLint⁠	`ANDROIDLINT`
Ansible-Later⁠	`ANSIBLELATER`	With `json` format
AnsibleLint⁠	`FLAKE8`	With `-p`
Bandit⁠	`CLANG`	With `bandit -r examples/ -f custom -o bandit.out --msg-template "{abspath}:{line}: {severity}: {test_id}: {msg}"`
CLang⁠	`CLANG`
CPD⁠	`CPD`
CPPCheck⁠	`CPPCHECK`	With `cppcheck test.cpp --output-file=cppcheck.xml --xml`
CPPLint⁠	`CPPLINT`
CSSLint⁠	`CSSLINT`
Checkstyle⁠	`CHECKSTYLE`
CloudFormation Linter⁠	`JUNIT`	`cfn-lint . -f junit --output-file report-junit.xml`
CodeClimate⁠	`CODECLIMATE`
CodeNarc⁠	`CODENARC`
Coverity⁠	`COVERITY`
Dart⁠	`MACHINE`	With `dart analyze --format=machine`
Dependency Check⁠	`SARIF`	Using `--format SARIF`
Detekt⁠	`CHECKSTYLE`	With `--output-format xml`.
DocFX⁠	`DOCFX`
Doxygen⁠	`CLANG`
ERB⁠	`CLANG`	With `erb -P -x -T '-' "${it}" \| ruby -c 2>&1 >/dev/null \| grep '^-' \| sed -E 's/^-([a-zA-Z0-9:]+)/${filename}\1 ERROR:/p' > erbfiles.out`.
ESLint⁠	`CHECKSTYLE`	With `format: 'checkstyle'`.
Findbugs⁠	`FINDBUGS`
Flake8⁠	`FLAKE8`
FxCop⁠	`FXCOP`
GCC⁠	`CLANG`
GHS⁠	`GHS`
Gendarme⁠	`GENDARME`
Generic reporter⁠	`GENERIC`	Will create one single violation with all the content as message.
GoLint⁠	`GOLINT`
GoVet⁠	`GOLINT`	Same format as GoLint.
GolangCI-Lint⁠	`CHECKSTYLE`	With `--out-format=checkstyle`.
HadoLint⁠	`CHECKSTYLE`	With `-f checkstyle`
IAR⁠	`IAR`	With `--no_wrap_diagnostics`
Infer⁠	`PMD`	Facebook Infer. With `--pmd-xml`.
JACOCO⁠	`JACOCO`
JCReport⁠	`JCREPORT`
JSHint⁠	`JSLINT`	With `--reporter=jslint` or the CHECKSTYLE parser with `--reporter=checkstyle`
JUnit⁠	`JUNIT`	It only contains the failures.
KTLint⁠	`CHECKSTYLE`
Klocwork⁠	`KLOCWORK`
KotlinGradle⁠	`KOTLINGRADLE`	Output from Kotlin Gradle Plugin.
KotlinMaven⁠	`KOTLINMAVEN`	Output from Kotlin Maven Plugin.
Lint⁠	`LINT`	A common XML format, used by different linters.
MSBuildLog⁠	`MSBULDLOG`	With `-fileLogger` use `.*msbuild\\.log$` as pattern or `-fl -flp:logfile=MyProjectOutput.log;verbosity=diagnostic` for a custom output filename
MSCpp⁠	`MSCPP`
Mccabe⁠	`FLAKE8`
MyPy⁠	`MYPY`
PCLint⁠	`PCLINT`	PC-Lint using the same output format as the Jenkins warnings plugin, details here⁠
PHPCS⁠	`CHECKSTYLE`	With `phpcs api.php --report=checkstyle`.
PHPPMD⁠	`PMD`	With `phpmd api.php xml ruleset.xml`.
PMD⁠	`PMD`
Pep8⁠	`FLAKE8`
PerlCritic⁠	`PERLCRITIC`
PiTest⁠	`PITEST`
ProtoLint⁠	`PROTOLINT`
Puppet-Lint⁠	`CLANG`	With `-log-format %{fullpath}:%{line}:%{column}: %{kind}: %{message}`
PyDocStyle⁠	`PYDOCSTYLE`
PyFlakes⁠	`FLAKE8`
PyLint⁠	`PYLINT`	With `pylint --output-format=parseable`.
ReSharper⁠	`RESHARPER`
RubyCop⁠	`CLANG`	With `rubycop -f clang file.rb`
SARIF⁠	`SARIF`	v2.x. Microsoft Visual C# can generate it with `ErrorLog="BuildErrors.sarif,version=2"`.
SbtScalac⁠	`SBTSCALAC`
Scalastyle⁠	`CHECKSTYLE`
Semgrep⁠	`SEMGREP`	With `--json`.
Simian⁠	`SIMIAN`
Sonar⁠	`SONAR`	With `mvn sonar:sonar -Dsonar.analysis.mode=preview -Dsonar.report.export.path=sonar-report.json`. Removed in 7.7, see SONAR-11670⁠ but can be retrieved with: `curl --silent 'http://sonar-server/api/issues/search?componentKeys=unique-key&resolved=false' \| jq -f sonar-report-builder.jq > sonar-report.json`.
Spotbugs⁠	`FINDBUGS`
StyleCop⁠	`STYLECOP`
SwiftLint⁠	`CHECKSTYLE`	With `--reporter checkstyle`.
TSLint⁠	`CHECKSTYLE`	With `-t checkstyle`
Valgrind⁠	`VALGRIND`	With `--xml=yes`.
XMLLint⁠	`XMLLINT`
XUnit⁠	`XUNIT`	It only contains the failures.
YAMLLint⁠	`YAMLLINT`	With `-f parsable`
ZPTLint⁠	`ZPTLINT`

51 parsers and 77 reporters.

Missing a format? Open an issue here⁠!

⁠Usage

Usage: violation-comments-to-gitea-command-line [-h] [-show-debug-info]
       [-ccwasfc=<createCommentWithAllSingleFileComments>]
       [-cocc=<commentOnlyChangedContent>]
       [-coccc=<commentOnlyChangedContentContext>]
       [-cocf=<commentOnlyChangedFiles>] [-comment-template=<commentTemplate>]
       [-csfc=<createSingleFileComments>]
       [-keep-old-comments=<keepOldComments>] [-max=<maxNumberOfViolations>]
       -o=<owner> [-password=<password>] [-pat=<personalAccessToken>]
       -prid=<pullRequestId> [-proxy-host=<proxyHost>]
       [-proxy-password=<proxyPass>] [-proxy-port=<proxyPort>]
       [-proxy-user=<proxyUser>] -rs=<repoSlug> [-s=<minSeverity>]
       -url=<giteaUrl> [-username=<username>] [-i=<ignorePaths>]...
       [-v=<violations> <violations> <violations> <violations>]...
      -ccwasfc, -create-comment-with-all-single-file-comments=<createCommentWith
        AllSingleFileComments>

      -cocc, -comment-only-changed-content=<commentOnlyChangedContent>

      -coccc, -comment-only-changed-content-context=<commentOnlyChangedContentCo
        ntext>

      -cocf, -comment-only-changed-files=<commentOnlyChangedFiles>
                             True if only changed files should be commented.
                               False if all findings should be commented.
      -comment-template=<commentTemplate>
                             https://github.
                               com/tomasbjerre/violation-comments-lib
      -csfc, -create-single-file-comments=<createSingleFileComments>

  -h, --help                 Show this help message and exit.
  -i, --ignorePaths=<ignorePaths>
                             Ignore given paths
                             Example: -i node_modules
      -keep-old-comments=<keepOldComments>

      -max, -max-number-of-violations=<maxNumberOfViolations>

  -o, -owner=<owner>         The repository owner, i.e. the user or
                               organisation it belongs to.
      -password=<password>
      -pat, -personal-access-token=<personalAccessToken>

      -prid, -pull-request-id=<pullRequestId>
                             The pull request's number/index.
      -proxy-host=<proxyHost>

      -proxy-password=<proxyPass>

      -proxy-port=<proxyPort>

      -proxy-user=<proxyUser>

      -rs, -repo-slug=<repoSlug>

  -s, -severity=<minSeverity>
                             Minimum severity level to report.
      -show-debug-info       Please run your command with this parameter and
                               supply output when reporting bugs.
      -url, -server-url=<giteaUrl>
                             Base URL of the Gitea instance, e.g. https://gitea.
                               example.com
      -username=<username>
  -v, --violations=<violations> <violations> <violations> <violations>
                             The violations to look for. <PARSER> <FOLDER>
                               <REGEXP PATTERN> <NAME> where PARSER is one of
                               the values of se.bjurr.violations.lib.reports.
                               Parser (see supported formats table in README
                               for the full list).
                             Example: -v "JSHINT" "." ".*/jshint.xml$" "JSHint"

Checkout the Violations Lib⁠ for more documentation.

Tag summary

Recent tags

Content type

Image

Digest

sha256:7a51ad2f5…

Size

77.7 MB

Last updated

9 days ago

docker pull tomasbjerre/violation-comments-to-gitea-command-line:1.0.0