Sign inSign up

tomasbjerre/violation-comments-to-github-command-line

By tomasbjerre

•Updated 9 days ago

Report static code analysis to GitHub.

Image
0

39

tomasbjerre/violation-comments-to-github-command-line repository overview

⁠Violation Comments To GitHub Command Line

NPM Maven Central NPM Downloads Docker Pulls

Report static code analysis to GitHub. It uses the Violations Lib⁠.

GitHub Comment

VersionJava Version
version < 1.26.011
1.26.0 <= version17
  • The runnable jar can be found in Maven Central⁠ and used like java -jar violation-comments-to-github-command-line-*.jar .....
  • The runnable can be found in NPM⁠.
  • The Docker image can be found in Dockerhub⁠ and used like docker run --mount src="$(pwd)",target=/usr/src/violation-comments-to-github-command-line,type=bind tomasbjerre/violation-comments-to-github-command-line:X.

Run it with:

npx violation-comments-to-github-command-line \
 -ot TOKENHERE \
 -ro tomasbjerre \
 -rn violations-test \
 -prid 3 \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
 -v "JSHINT" "." ".*jshint/report\.xml$" "JSHint"

You may also want to explore Sarif as an alternative to this, se README.md in violation-comments-to-github-lib⁠.

You must perform the merge before build. If you don't perform the merge, the reported violations will refer to other lines then those in the pull request. The merge can be done with a shell script like this.

echo ---
echo --- Merging from $FROM in $FROMREPO to $TO in $TOREPO
echo ---
git clone $TOREPO
cd *
git reset --hard $TO
git status
git remote add from $FROMREPO
git fetch from
git merge $FROM
git --no-pager log --max-count=10 --graph --abbrev-commit

Your build command here!

Example of supported reports are available here⁠.

A number of parsers have been implemented. Some parsers can parse output from several reporters.

ReporterParserNotes
ARM-GCC⁠CLANG
AndroidLint⁠ANDROIDLINT
Ansible-Later⁠ANSIBLELATERWith json format
AnsibleLint⁠FLAKE8With -p
Bandit⁠CLANGWith bandit -r examples/ -f custom -o bandit.out --msg-template "{abspath}:{line}: {severity}: {test_id}: {msg}"
CLang⁠CLANG
CPD⁠CPD
CPPCheck⁠CPPCHECKWith cppcheck test.cpp --output-file=cppcheck.xml --xml
CPPLint⁠CPPLINT
CSSLint⁠CSSLINT
Checkstyle⁠CHECKSTYLE
CloudFormation Linter⁠JUNITcfn-lint . -f junit --output-file report-junit.xml
CodeClimate⁠CODECLIMATE
CodeNarc⁠CODENARC
Coverity⁠COVERITY
Dart⁠MACHINEWith dart analyze --format=machine
Dependency Check⁠SARIFUsing --format SARIF
Detekt⁠CHECKSTYLEWith --output-format xml.
DocFX⁠DOCFX
Doxygen⁠CLANG
ERB⁠CLANGWith erb -P -x -T '-' "${it}" | ruby -c 2>&1 >/dev/null | grep '^-' | sed -E 's/^-([a-zA-Z0-9:]+)/${filename}\1 ERROR:/p' > erbfiles.out.
ESLint⁠CHECKSTYLEWith format: 'checkstyle'.
Findbugs⁠FINDBUGS
Flake8⁠FLAKE8
FxCop⁠FXCOP
GCC⁠CLANG
GHS⁠GHS
Gendarme⁠GENDARME
Generic reporter⁠GENERICWill create one single violation with all the content as message.
GoLint⁠GOLINT
GoVet⁠GOLINTSame format as GoLint.
GolangCI-Lint⁠CHECKSTYLEWith --out-format=checkstyle.
HadoLint⁠CHECKSTYLEWith -f checkstyle
IAR⁠IARWith --no_wrap_diagnostics
Infer⁠PMDFacebook Infer. With --pmd-xml.
JACOCO⁠JACOCO
JCReport⁠JCREPORT
JSHint⁠JSLINTWith --reporter=jslint or the CHECKSTYLE parser with --reporter=checkstyle
JUnit⁠JUNITIt only contains the failures.
KTLint⁠CHECKSTYLE
Klocwork⁠KLOCWORK
KotlinGradle⁠KOTLINGRADLEOutput from Kotlin Gradle Plugin.
KotlinMaven⁠KOTLINMAVENOutput from Kotlin Maven Plugin.
Lint⁠LINTA common XML format, used by different linters.
MSBuildLog⁠MSBULDLOGWith -fileLogger use .*msbuild\\.log$ as pattern or -fl -flp:logfile=MyProjectOutput.log;verbosity=diagnostic for a custom output filename
MSCpp⁠MSCPP
Mccabe⁠FLAKE8
MyPy⁠MYPY
PCLint⁠PCLINTPC-Lint using the same output format as the Jenkins warnings plugin, details here⁠
PHPCS⁠CHECKSTYLEWith phpcs api.php --report=checkstyle.
PHPPMD⁠PMDWith phpmd api.php xml ruleset.xml.
PMD⁠PMD
Pep8⁠FLAKE8
PerlCritic⁠PERLCRITIC
PiTest⁠PITEST
ProtoLint⁠PROTOLINT
Puppet-Lint⁠CLANGWith -log-format %{fullpath}:%{line}:%{column}: %{kind}: %{message}
PyDocStyle⁠PYDOCSTYLE
PyFlakes⁠FLAKE8
PyLint⁠PYLINTWith pylint --output-format=parseable.
ReSharper⁠RESHARPER
RubyCop⁠CLANGWith rubycop -f clang file.rb
SARIF⁠SARIFv2.x. Microsoft Visual C# can generate it with ErrorLog="BuildErrors.sarif,version=2".
SbtScalac⁠SBTSCALAC
Scalastyle⁠CHECKSTYLE
Semgrep⁠SEMGREPWith --json.
Simian⁠SIMIAN
Sonar⁠SONARWith mvn sonar:sonar -Dsonar.analysis.mode=preview -Dsonar.report.export.path=sonar-report.json. Removed in 7.7, see SONAR-11670⁠ but can be retrieved with: curl --silent 'http://sonar-server/api/issues/search?componentKeys=unique-key&resolved=false' | jq -f sonar-report-builder.jq > sonar-report.json.
Spotbugs⁠FINDBUGS
StyleCop⁠STYLECOP
SwiftLint⁠CHECKSTYLEWith --reporter checkstyle.
TSLint⁠CHECKSTYLEWith -t checkstyle
Valgrind⁠VALGRINDWith --xml=yes.
XMLLint⁠XMLLINT
XUnit⁠XUNITIt only contains the failures.
YAMLLint⁠YAMLLINTWith -f parsable
ZPTLint⁠ZPTLINT

51 parsers and 77 reporters.

Missing a format? Open an issue here⁠!

⁠Usage

Usage: violation-comments-to-github-command-line [-h] [-show-debug-info]
       [-ccwasfc=<createCommentWithAllSingleFileComments>]
       [-cocc=<commentOnlyChangedContent>] [-cocf=<commentOnlyChangedFiles>]
       [-comment-template=<commentTemplate>] [-csfc=<createSingleFileComments>]
       [-ghu=<gitHubUrl>] [-keep-old-comments=<keepOldComments>]
       [-max=<maxNumberOfViolations>] [-ot=<oAuth2Token>] [-p=<password>]
       -prid=<pullRequestId> -rn=<repositoryName> -ro=<repositoryOwner>
       [-s=<minSeverity>] [-u=<username>] [-urc=<useReviewComments>]
       [-v=<violations> <violations> <violations> <violations>]...
      -ccwasfc, -create-comment-with-all-single-file-comments=<createCommentWith
        AllSingleFileComments>

      -cocc, -comment-only-changed-content=<commentOnlyChangedContent>

      -cocf, -comment-only-changed-files=<commentOnlyChangedFiles>
                             True if only changed files should be commented.
                               False if all findings should be commented.
      -comment-template=<commentTemplate>
                             See https://github.
                               com/tomasbjerre/violation-comments-lib
      -csfc, -create-single-file-comments=<createSingleFileComments>

      -ghu, -github-url=<gitHubUrl>

  -h, --help                 Show this help message and exit.
      -keep-old-comments=<keepOldComments>

      -max, -max-number-of-violations=<maxNumberOfViolations>

      -ot, -oauth2-token=<oAuth2Token>

  -p, -password=<password>
      -prid, -pull-request-id=<pullRequestId>

      -rn, -repository-name=<repositoryName>
                             Example: 'violations-test'
      -ro, -repository-owner=<repositoryOwner>
                             Example: 'tomasbjerre'
  -s, -severity=<minSeverity>
                             Minimum severity level to report.
      -show-debug-info       Please run your command with this parameter and
                               supply output when reporting bugs.
  -u, -username=<username>
      -urc, -use-review-comments=<useReviewComments>
                             True if single file comments should be batched
                               into one pull request review instead of one HTTP
                               request per comment. GitHub applies this
                               atomically: if any comment in the batch has an
                               invalid diff position, none of them are created.
  -v, --violations=<violations> <violations> <violations> <violations>
                             The violations to look for. <PARSER> <FOLDER>
                               <REGEXP PATTERN> <NAME> where PARSER is one of
                               the values of se.bjurr.violations.lib.reports.
                               Parser (see supported formats table in README
                               for the full list).
                             Example: -v "JSHINT" "." ".*/jshint.xml$" "JSHint"

Checkout the Violations Lib⁠ for more documentation.

Tag summary

Content type

Image

Digest

sha256:3054d3113…

Size

77.7 MB

Last updated

9 days ago

docker pull tomasbjerre/violation-comments-to-github-command-line:1.26.0