chore(deps): bump codecov/codecov-action from 6 to 7 #181
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codacy Analysis | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - '**' | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| codacy-analysis: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Check for Codacy token | |
| env: | |
| CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} | |
| run: | | |
| if [ -z "${CODACY_PROJECT_TOKEN:-}" ]; then | |
| echo "CODACY_PROJECT_TOKEN not set; skipping Codacy analysis" | |
| exit 0 | |
| fi | |
| - name: Download Codacy CLI (bootstrap) | |
| run: | | |
| chmod +x ./.codacy/cli.sh || true | |
| bash ./.codacy/cli.sh download | |
| echo "--- DIAG: post-download (cwd=$(pwd)) ---" > codacy-diag.txt | |
| echo "pwd: $(pwd)" >> codacy-diag.txt | |
| echo "ls -la .codacy-cli-v2:" >> codacy-diag.txt | |
| ls -la .codacy-cli-v2 >> codacy-diag.txt 2>&1 || true | |
| echo "ls -la .codacy:" >> codacy-diag.txt | |
| ls -la .codacy >> codacy-diag.txt 2>&1 || true | |
| echo "ls -la ~/.cache/codacy (if present):" >> codacy-diag.txt | |
| ls -la ~/.cache/codacy >> codacy-diag.txt 2>&1 || true | |
| - name: Capture Codacy CLI version | |
| run: | | |
| # Locate the extracted Codacy CLI in the runner cache and capture its version | |
| cache="$HOME/.cache/codacy/codacy-cli-v2" | |
| version="$(awk -F'"' '/version:/ {print $2; exit}' "$cache/version.yaml" 2>/dev/null || true)" | |
| BIN="" | |
| if [ -n "$version" ] && [ -f "$cache/$version/codacy-cli-v2" ]; then | |
| BIN="$cache/$version/codacy-cli-v2" | |
| else | |
| BIN="$(find "$cache" -maxdepth 3 -type f -name codacy-cli-v2 | head -n1 || true)" | |
| fi | |
| echo "Binary candidate: $BIN" | |
| if [ -z "$BIN" ] || [ ! -f "$BIN" ]; then | |
| echo "Binary not found; listing cache:" >&2 | |
| ls -la "$cache" || true | |
| exit 1 | |
| fi | |
| chmod +x "$BIN" || true | |
| "$BIN" version > codacy-version.txt 2>&1 || true | |
| echo "WROTE codacy-version.txt" | |
| - name: Install Python dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| - name: Run Codacy analysis (local bootstrap) | |
| env: | |
| CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} | |
| run: | | |
| echo "--- DIAG: before analyze (cwd=$(pwd)) ---" >> codacy-diag.txt | |
| echo "whoami: $(whoami)" >> codacy-diag.txt | |
| echo "pwd: $(pwd)" >> codacy-diag.txt | |
| echo "ls -la (repo root):" >> codacy-diag.txt | |
| ls -la >> codacy-diag.txt 2>&1 || true | |
| # Ensure the bootstrap is executable and download the CLI into the cache | |
| chmod +x ./.codacy/cli.sh || true | |
| echo "--- running bootstrap download ---" >> codacy-diag.txt | |
| bash ./.codacy/cli.sh download >> codacy-diag.txt 2>&1 || true | |
| # Locate the extracted binary in the cache | |
| cache="$HOME/.cache/codacy/codacy-cli-v2" | |
| version="$(awk -F'"' '/version:/ {print $2; exit}' "$cache/version.yaml" 2>/dev/null || true)" | |
| BIN="" | |
| if [ -n "$version" ] && [ -f "$cache/$version/codacy-cli-v2" ]; then | |
| BIN="$cache/$version/codacy-cli-v2" | |
| else | |
| BIN="$(find "$cache" -maxdepth 3 -type f -name codacy-cli-v2 | head -n1 || true)" | |
| fi | |
| echo "Binary candidate: $BIN" >> codacy-diag.txt | |
| if [ -z "$BIN" ] || [ ! -f "$BIN" ]; then | |
| echo "Binary not found; listing cache:" >> codacy-diag.txt | |
| ls -la "$cache" >> codacy-diag.txt 2>&1 || true | |
| echo "Binary not found; failing" >> codacy-diag.txt | |
| exit 1 | |
| fi | |
| ls -la "$BIN" >> codacy-diag.txt 2>&1 || true | |
| stat "$BIN" >> codacy-diag.txt 2>&1 || true | |
| chmod +x "$BIN" || true | |
| echo "--- executing extracted binary directly ---" >> codacy-diag.txt | |
| # Use bash pipefail so we can propagate the CLI exit code through the pipeline | |
| set -o pipefail | |
| # Capture version and help for diagnostics (use the correct subcommand) | |
| "$BIN" version > codacy-version.txt 2>&1 || true | |
| "$BIN" analyze --help > codacy-analyze-help.txt 2>&1 || true | |
| # Execute the extracted binary directly; quote the token to avoid shell interpretation | |
| # Use the CLI's --api-token flag (the binary does not accept --project-token). | |
| # Provide organization/provider/repository so the CLI can fetch remote configuration | |
| # when an API token is supplied. | |
| "$BIN" analyze --api-token "$CODACY_PROJECT_TOKEN" \ | |
| --organization "tim-dickey" --provider "gh" --repository "multi-modal-neural-network" 2>&1 | tee codacy-cli.log | |
| # Capture the CLI's exit code (bash-specific PIPESTATUS) and fail the step if non-zero | |
| rc=${PIPESTATUS[0]:-0} | |
| echo "EXIT_CODE=$rc" >> codacy-cli.log | |
| # Append diagnostics to the log bundle | |
| echo "\n--- CONTENTS OF codacy-diag.txt ---" >> codacy-cli.log | |
| cat codacy-diag.txt >> codacy-cli.log || true | |
| if [ "$rc" -ne 0 ]; then | |
| echo "Codacy CLI exited with code $rc; failing job" >> codacy-cli.log | |
| exit $rc | |
| fi | |
| - name: Sanitize Codacy logs | |
| if: always() | |
| env: | |
| CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} | |
| run: | | |
| # Create a redacted copy of the CLI log to avoid leaking secrets in artifacts | |
| if [ -f codacy-cli.log ]; then | |
| python - <<'PY' | |
| import os | |
| tok = os.environ.get('CODACY_PROJECT_TOKEN','') | |
| try: | |
| with open('codacy-cli.log','r',encoding='utf-8',errors='ignore') as f: | |
| data = f.read() | |
| if tok: | |
| data = data.replace(tok, '[REDACTED]') | |
| with open('codacy-cli.log.redacted','w',encoding='utf-8') as f: | |
| f.write(data) | |
| print('WROTE codacy-cli.log.redacted') | |
| except Exception as e: | |
| print('redaction-failed', e) | |
| open('codacy-cli.log.redacted','w').close() | |
| PY | |
| else | |
| # Ensure the file exists so the uploader doesn't fail | |
| touch codacy-cli.log.redacted || true | |
| fi | |
| - name: Upload Codacy CLI output | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: codacy-cli-output | |
| path: | | |
| codacy-cli.log.redacted | |
| codacy-diag.txt | |
| codacy-version.txt | |
| codacy-analyze-help.txt | |
| .codacy-cli-v2 | |
| .codacy | |
| - name: Upload SARIF to GitHub Code Scanning | |
| if: always() | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Find any SARIF files produced by the Codacy CLI and upload them | |
| set -e | |
| found=false | |
| for f in $(find . -type f -name '*.sarif' -print); do | |
| echo "Uploading $f to GitHub Code Scanning API" | |
| curl -s -S -X POST \ | |
| -H "Authorization: token $GITHUB_TOKEN" \ | |
| -H "Content-Type: application/json" \ | |
| --data-binary @"$f" \ | |
| "https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs" || true | |
| found=true | |
| done | |
| if [ "$found" = false ]; then | |
| echo "No SARIF files found; skipping upload" | |
| fi |