codacy.yml

name: Codacy
permissions: read-all
on: [ push, pull_request ]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      actions: read
      contents: read
      security-events: write
    if: github.event.repository.fork == false
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.codacy.com:443
            api.github.com:443
            auth.docker.io:443
            github.com:443
            golang.org:443
            objects.githubusercontent.com:443
            production.cloudflare.docker.com:443
            raw.githubusercontent.com:443
            registry-1.docker.io:443
            *.blob.core.windows.net:443
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run Codacy Analysis
        uses: codacy/codacy-analysis-cli-action@97bf5df3c09e75f5bcd72695998f96ebd701846e # v4.4.5
        continue-on-error: true
        with:
          format: sarif
          output: results.sarif
          gh-code-scanning-compat: true
          max-allowed-issues: 2147483647
      - name: Check file existence
        id: check_files
        uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0
        with:
          files: results.sarif
      - name: Remove duplicate runs
        if: steps.check_files.outputs.files_exists == 'true'
        run: jq -c '.runs |= unique_by({tool, invocations, results})' < results.sarif > codacy.sarif
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
        if: steps.check_files.outputs.files_exists == 'true'
        continue-on-error: true
        with:
          sarif_file: codacy.sarif