Report static code analysis to GitHub.
39
Report static code analysis to GitHub. It uses the Violations Lib.

| Version | Java Version |
|---|---|
| version < 1.26.0 | 11 |
| 1.26.0 <= version | 17 |
jar can be found in Maven Central and used like java -jar violation-comments-to-github-command-line-*.jar .....Docker image can be found in Dockerhub and used like docker run --mount src="$(pwd)",target=/usr/src/violation-comments-to-github-command-line,type=bind tomasbjerre/violation-comments-to-github-command-line:X.Run it with:
npx violation-comments-to-github-command-line \
-ot TOKENHERE \
-ro tomasbjerre \
-rn violations-test \
-prid 3 \
-v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
-v "JSHINT" "." ".*jshint/report\.xml$" "JSHint"
You may also want to explore Sarif as an alternative to this, se README.md in violation-comments-to-github-lib.
You must perform the merge before build. If you don't perform the merge, the reported violations will refer to other lines then those in the pull request. The merge can be done with a shell script like this.
echo ---
echo --- Merging from $FROM in $FROMREPO to $TO in $TOREPO
echo ---
git clone $TOREPO
cd *
git reset --hard $TO
git status
git remote add from $FROMREPO
git fetch from
git merge $FROM
git --no-pager log --max-count=10 --graph --abbrev-commit
Your build command here!
Example of supported reports are available here.
A number of parsers have been implemented. Some parsers can parse output from several reporters.
| Reporter | Parser | Notes |
|---|---|---|
| ARM-GCC | CLANG | |
| AndroidLint | ANDROIDLINT | |
| Ansible-Later | ANSIBLELATER | With json format |
| AnsibleLint | FLAKE8 | With -p |
| Bandit | CLANG | With bandit -r examples/ -f custom -o bandit.out --msg-template "{abspath}:{line}: {severity}: {test_id}: {msg}" |
| CLang | CLANG | |
| CPD | CPD | |
| CPPCheck | CPPCHECK | With cppcheck test.cpp --output-file=cppcheck.xml --xml |
| CPPLint | CPPLINT | |
| CSSLint | CSSLINT | |
| Checkstyle | CHECKSTYLE | |
| CloudFormation Linter | JUNIT | cfn-lint . -f junit --output-file report-junit.xml |
| CodeClimate | CODECLIMATE | |
| CodeNarc | CODENARC | |
| Coverity | COVERITY | |
| Dart | MACHINE | With dart analyze --format=machine |
| Dependency Check | SARIF | Using --format SARIF |
| Detekt | CHECKSTYLE | With --output-format xml. |
| DocFX | DOCFX | |
| Doxygen | CLANG | |
| ERB | CLANG | With erb -P -x -T '-' "${it}" | ruby -c 2>&1 >/dev/null | grep '^-' | sed -E 's/^-([a-zA-Z0-9:]+)/${filename}\1 ERROR:/p' > erbfiles.out. |
| ESLint | CHECKSTYLE | With format: 'checkstyle'. |
| Findbugs | FINDBUGS | |
| Flake8 | FLAKE8 | |
| FxCop | FXCOP | |
| GCC | CLANG | |
| GHS | GHS | |
| Gendarme | GENDARME | |
| Generic reporter | GENERIC | Will create one single violation with all the content as message. |
| GoLint | GOLINT | |
| GoVet | GOLINT | Same format as GoLint. |
| GolangCI-Lint | CHECKSTYLE | With --out-format=checkstyle. |
| HadoLint | CHECKSTYLE | With -f checkstyle |
| IAR | IAR | With --no_wrap_diagnostics |
| Infer | PMD | Facebook Infer. With --pmd-xml. |
| JACOCO | JACOCO | |
| JCReport | JCREPORT | |
| JSHint | JSLINT | With --reporter=jslint or the CHECKSTYLE parser with --reporter=checkstyle |
| JUnit | JUNIT | It only contains the failures. |
| KTLint | CHECKSTYLE | |
| Klocwork | KLOCWORK | |
| KotlinGradle | KOTLINGRADLE | Output from Kotlin Gradle Plugin. |
| KotlinMaven | KOTLINMAVEN | Output from Kotlin Maven Plugin. |
| Lint | LINT | A common XML format, used by different linters. |
| MSBuildLog | MSBULDLOG | With -fileLogger use .*msbuild\\.log$ as pattern or -fl -flp:logfile=MyProjectOutput.log;verbosity=diagnostic for a custom output filename |
| MSCpp | MSCPP | |
| Mccabe | FLAKE8 | |
| MyPy | MYPY | |
| PCLint | PCLINT | PC-Lint using the same output format as the Jenkins warnings plugin, details here |
| PHPCS | CHECKSTYLE | With phpcs api.php --report=checkstyle. |
| PHPPMD | PMD | With phpmd api.php xml ruleset.xml. |
| PMD | PMD | |
| Pep8 | FLAKE8 | |
| PerlCritic | PERLCRITIC | |
| PiTest | PITEST | |
| ProtoLint | PROTOLINT | |
| Puppet-Lint | CLANG | With -log-format %{fullpath}:%{line}:%{column}: %{kind}: %{message} |
| PyDocStyle | PYDOCSTYLE | |
| PyFlakes | FLAKE8 | |
| PyLint | PYLINT | With pylint --output-format=parseable. |
| ReSharper | RESHARPER | |
| RubyCop | CLANG | With rubycop -f clang file.rb |
| SARIF | SARIF | v2.x. Microsoft Visual C# can generate it with ErrorLog="BuildErrors.sarif,version=2". |
| SbtScalac | SBTSCALAC | |
| Scalastyle | CHECKSTYLE | |
| Semgrep | SEMGREP | With --json. |
| Simian | SIMIAN | |
| Sonar | SONAR | With mvn sonar:sonar -Dsonar.analysis.mode=preview -Dsonar.report.export.path=sonar-report.json. Removed in 7.7, see SONAR-11670 but can be retrieved with: curl --silent 'http://sonar-server/api/issues/search?componentKeys=unique-key&resolved=false' | jq -f sonar-report-builder.jq > sonar-report.json. |
| Spotbugs | FINDBUGS | |
| StyleCop | STYLECOP | |
| SwiftLint | CHECKSTYLE | With --reporter checkstyle. |
| TSLint | CHECKSTYLE | With -t checkstyle |
| Valgrind | VALGRIND | With --xml=yes. |
| XMLLint | XMLLINT | |
| XUnit | XUNIT | It only contains the failures. |
| YAMLLint | YAMLLINT | With -f parsable |
| ZPTLint | ZPTLINT |
51 parsers and 77 reporters.
Missing a format? Open an issue here!
Usage: violation-comments-to-github-command-line [-h] [-show-debug-info]
[-ccwasfc=<createCommentWithAllSingleFileComments>]
[-cocc=<commentOnlyChangedContent>] [-cocf=<commentOnlyChangedFiles>]
[-comment-template=<commentTemplate>] [-csfc=<createSingleFileComments>]
[-ghu=<gitHubUrl>] [-keep-old-comments=<keepOldComments>]
[-max=<maxNumberOfViolations>] [-ot=<oAuth2Token>] [-p=<password>]
-prid=<pullRequestId> -rn=<repositoryName> -ro=<repositoryOwner>
[-s=<minSeverity>] [-u=<username>] [-urc=<useReviewComments>]
[-v=<violations> <violations> <violations> <violations>]...
-ccwasfc, -create-comment-with-all-single-file-comments=<createCommentWith
AllSingleFileComments>
-cocc, -comment-only-changed-content=<commentOnlyChangedContent>
-cocf, -comment-only-changed-files=<commentOnlyChangedFiles>
True if only changed files should be commented.
False if all findings should be commented.
-comment-template=<commentTemplate>
See https://github.
com/tomasbjerre/violation-comments-lib
-csfc, -create-single-file-comments=<createSingleFileComments>
-ghu, -github-url=<gitHubUrl>
-h, --help Show this help message and exit.
-keep-old-comments=<keepOldComments>
-max, -max-number-of-violations=<maxNumberOfViolations>
-ot, -oauth2-token=<oAuth2Token>
-p, -password=<password>
-prid, -pull-request-id=<pullRequestId>
-rn, -repository-name=<repositoryName>
Example: 'violations-test'
-ro, -repository-owner=<repositoryOwner>
Example: 'tomasbjerre'
-s, -severity=<minSeverity>
Minimum severity level to report.
-show-debug-info Please run your command with this parameter and
supply output when reporting bugs.
-u, -username=<username>
-urc, -use-review-comments=<useReviewComments>
True if single file comments should be batched
into one pull request review instead of one HTTP
request per comment. GitHub applies this
atomically: if any comment in the batch has an
invalid diff position, none of them are created.
-v, --violations=<violations> <violations> <violations> <violations>
The violations to look for. <PARSER> <FOLDER>
<REGEXP PATTERN> <NAME> where PARSER is one of
the values of se.bjurr.violations.lib.reports.
Parser (see supported formats table in README
for the full list).
Example: -v "JSHINT" "." ".*/jshint.xml$" "JSHint"
Checkout the Violations Lib for more documentation.
Content type
Image
Digest
sha256:3054d3113…
Size
77.7 MB
Last updated
9 days ago
docker pull tomasbjerre/violation-comments-to-github-command-line:1.26.0