codacy.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow checks out code, performs a Codacy security scan
# and integrates the results with the
# GitHub Advanced Security code scanning feature.
# For more information on the Codacy security scan action usage and
# parameters, see https://github.com/codacy/codacy-analysis-cli-action.
# For more information on Codacy Analysis CLI in general, see
# https://github.com/codacy/codacy-analysis-cli.

name: Codacy Security Scan

concurrency:
  # This concurrency group ensures that only one Codacy analysis runs at a time
  group: codacy-${{ github.ref_name }}
  cancel-in-progress: true

on:
  push:
    branches: ["main"]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: ["main"]
  schedule:
    - cron: "42 0 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  codacy-security-scan:
    permissions:
      # for actions/checkout to fetch code
      contents: read
      # for github/codeql-action/upload-sarif to upload SARIF results
      security-events: write
      # only required for a private repository by
      # github/codeql-action/upload-sarif to get the Action run status
      actions: read
    env:
      CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
    name: Codacy Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set Codacy paths
        run: |
          set -euo pipefail
          echo "CODACY_WORKDIR=$RUNNER_TEMP/codacy-src" >> "$GITHUB_ENV"
          echo "CODACY_SARIF=$RUNNER_TEMP/results.sarif" >> "$GITHUB_ENV"

      - name: Prepare workspace copy without .git
        run: |
          set -euo pipefail
          mkdir -p "$CODACY_WORKDIR"
          rsync -a --delete --exclude '.git' ./ "$CODACY_WORKDIR/"

      - name: Verify Codacy config includes Python security tooling
        run: |
          set -euo pipefail
          config="$CODACY_WORKDIR/.codacy.yml"
          if [ ! -f "$config" ]; then
            echo "::error::.codacy.yml not found in workspace copy ($config)"
            exit 1
          fi
          if ! grep -qE '^[[:space:]]*bandit:' "$config"; then
            echo "::error::Bandit engine not configured in .codacy.yml; Python security scanning will be skipped."
            exit 1
          fi

      # Execute Codacy Analysis CLI and generate a SARIF output with
      # the security issues identified during the analysis
      - name: Run Codacy Analysis CLI
        if: ${{ env.CODACY_PROJECT_TOKEN != '' }}
        id: codacy_analysis
        uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08
        with:
          # Check https://github.com/codacy/codacy-analysis-cli#project-token
          # to get your project token from your Codacy repository.
          project-token: ${{ env.CODACY_PROJECT_TOKEN }}
          verbose: true
          directory: ${{ env.CODACY_WORKDIR }}
          output: ${{ env.CODACY_SARIF }}
          format: sarif
          skip-uncommitted-files-check: true
          # Adjust severity of non-security issues
          gh-code-scanning-compat: true
          # Force 0 exit code to allow SARIF file generation
          # This will handover control about PR rejection to the GitHub side
          max-allowed-issues: 2147483647
        # Codacy can fail transiently on PRs (e.g. remote config/tools service outages).
        # Keep PR checks non-blocking and continue to SARIF fallback/upload.
        continue-on-error: ${{ github.event_name == 'pull_request' }}

      - name: Warn when Codacy token is unavailable on PR
        if: ${{ github.event_name == 'pull_request' && env.CODACY_PROJECT_TOKEN == '' }}
        run: |
          echo "::warning::CODACY_PROJECT_TOKEN is unavailable for this pull_request."
          echo "::warning::Skipping Codacy Analysis CLI and using SARIF fallback."

      - name: Warn when Codacy analysis fails on PR
        if: ${{ always() && github.event_name == 'pull_request' && steps.codacy_analysis.outcome == 'failure' }}
        run: |
          echo "::warning::Codacy Analysis CLI failed on this pull_request run; continuing with SARIF fallback."

      # Validate SARIF output or create an empty fallback for upload
      - name: Validate or create SARIF
        if: always()
        run: |
          # Fail fast and surface errors clearly
          set -euo pipefail
          if [ -f "$CODACY_SARIF" ] && [ -s "$CODACY_SARIF" ]; then
            echo "$CODACY_SARIF present; preselecting for upload and skipping split."
            echo "SARIF_FILE=$CODACY_SARIF" >> "$GITHUB_ENV"
            exit 0
          else
            echo "No SARIF file found or file is empty: $CODACY_SARIF"
            echo "Creating empty SARIF file to prevent workflow failure"
            # Create empty SARIF file with proper schema
            schema_url="https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
            empty_sarif="$RUNNER_TEMP/sarif_empty.sarif"
            {
              echo '{'
              echo "  \"\$schema\": \"$schema_url\","
              echo '  "version": "2.1.0",'
              echo '  "runs": []'
              echo '}'
            } > "$empty_sarif"
            # Mark the empty SARIF for upload
            echo "SARIF_FILE=$empty_sarif" >> "$GITHUB_ENV"
            exit 0
          fi

      # Select SARIF file for upload
      - name: Select SARIF file for upload
        if: always()
        run: |
          set -euo pipefail
          # Honor preselected SARIF_FILE from earlier steps (e.g., empty SARIF case)
          if [ -n "${SARIF_FILE:-}" ]; then
            echo "Preselected SARIF_FILE=$SARIF_FILE; not overriding."
            exit 0
          fi
          # First, try to upload the original SARIF file if it exists
          if [ -f "$CODACY_SARIF" ] && [ -s "$CODACY_SARIF" ]; then
            echo "Found $CODACY_SARIF, attempting upload..."
            echo "SARIF_FILE=$CODACY_SARIF" >> "$GITHUB_ENV"
          else
            echo "No valid SARIF files found"
            echo "SARIF_FILE=" >> "$GITHUB_ENV"
          fi
        continue-on-error: true

      # Upload the identified SARIF file
      - name: Upload identified SARIF file
        if: always() && env.SARIF_FILE != ''
        uses: github/codeql-action/upload-sarif@b36bf259c813715f76eafece573914b94412cd13 # v3
        with:
          sarif_file: ${{ env.SARIF_FILE }}
        continue-on-error: true