codacy.yml

name: Codacy Analysis

on:
  push:
    branches:
      - main
      - '**'
  pull_request:
    branches:
      - main

jobs:
  codacy-analysis:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Check for Codacy token
        env:
          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
        run: |
          if [ -z "${CODACY_PROJECT_TOKEN:-}" ]; then
            echo "CODACY_PROJECT_TOKEN not set; skipping Codacy analysis"
            exit 0
          fi

      - name: Download Codacy CLI (bootstrap)
        run: |
          chmod +x ./.codacy/cli.sh || true
          bash ./.codacy/cli.sh download
          echo "--- DIAG: post-download (cwd=$(pwd)) ---" > codacy-diag.txt
          echo "pwd: $(pwd)" >> codacy-diag.txt
          echo "ls -la .codacy-cli-v2:" >> codacy-diag.txt
          ls -la .codacy-cli-v2 >> codacy-diag.txt 2>&1 || true
          echo "ls -la .codacy:" >> codacy-diag.txt
          ls -la .codacy >> codacy-diag.txt 2>&1 || true
          echo "ls -la ~/.cache/codacy (if present):" >> codacy-diag.txt
          ls -la ~/.cache/codacy >> codacy-diag.txt 2>&1 || true

      - name: Capture Codacy CLI version
        run: |
          # Locate the extracted Codacy CLI in the runner cache and capture its version
          cache="$HOME/.cache/codacy/codacy-cli-v2"
          version="$(awk -F'"' '/version:/ {print $2; exit}' "$cache/version.yaml" 2>/dev/null || true)"
          BIN=""
          if [ -n "$version" ] && [ -f "$cache/$version/codacy-cli-v2" ]; then
            BIN="$cache/$version/codacy-cli-v2"
          else
            BIN="$(find "$cache" -maxdepth 3 -type f -name codacy-cli-v2 | head -n1 || true)"
          fi

          echo "Binary candidate: $BIN"
          if [ -z "$BIN" ] || [ ! -f "$BIN" ]; then
            echo "Binary not found; listing cache:" >&2
            ls -la "$cache" || true
            exit 1
          fi

          chmod +x "$BIN" || true
          "$BIN" version > codacy-version.txt 2>&1 || true
          echo "WROTE codacy-version.txt"

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

      - name: Run Codacy analysis (local bootstrap)
        env:
          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
        run: |
          echo "--- DIAG: before analyze (cwd=$(pwd)) ---" >> codacy-diag.txt
          echo "whoami: $(whoami)" >> codacy-diag.txt
          echo "pwd: $(pwd)" >> codacy-diag.txt
          echo "ls -la (repo root):" >> codacy-diag.txt
          ls -la >> codacy-diag.txt 2>&1 || true

          # Ensure the bootstrap is executable and download the CLI into the cache
          chmod +x ./.codacy/cli.sh || true
          echo "--- running bootstrap download ---" >> codacy-diag.txt
          bash ./.codacy/cli.sh download >> codacy-diag.txt 2>&1 || true

          # Locate the extracted binary in the cache
          cache="$HOME/.cache/codacy/codacy-cli-v2"
          version="$(awk -F'"' '/version:/ {print $2; exit}' "$cache/version.yaml" 2>/dev/null || true)"
          BIN=""
          if [ -n "$version" ] && [ -f "$cache/$version/codacy-cli-v2" ]; then
            BIN="$cache/$version/codacy-cli-v2"
          else
            BIN="$(find "$cache" -maxdepth 3 -type f -name codacy-cli-v2 | head -n1 || true)"
          fi

          echo "Binary candidate: $BIN" >> codacy-diag.txt
          if [ -z "$BIN" ] || [ ! -f "$BIN" ]; then
            echo "Binary not found; listing cache:" >> codacy-diag.txt
            ls -la "$cache" >> codacy-diag.txt 2>&1 || true
            echo "Binary not found; failing" >> codacy-diag.txt
            exit 1
          fi

          ls -la "$BIN" >> codacy-diag.txt 2>&1 || true
          stat "$BIN" >> codacy-diag.txt 2>&1 || true
          chmod +x "$BIN" || true
          echo "--- executing extracted binary directly ---" >> codacy-diag.txt
          # Use bash pipefail so we can propagate the CLI exit code through the pipeline
          set -o pipefail

          # Capture version and help for diagnostics (use the correct subcommand)
          "$BIN" version > codacy-version.txt 2>&1 || true
          "$BIN" analyze --help > codacy-analyze-help.txt 2>&1 || true

          # Execute the extracted binary directly; quote the token to avoid shell interpretation
          # Use the CLI's --api-token flag (the binary does not accept --project-token).
          # Provide organization/provider/repository so the CLI can fetch remote configuration
          # when an API token is supplied.
          "$BIN" analyze --api-token "$CODACY_PROJECT_TOKEN" \
            --organization "tim-dickey" --provider "gh" --repository "multi-modal-neural-network" 2>&1 | tee codacy-cli.log

          # Capture the CLI's exit code (bash-specific PIPESTATUS) and fail the step if non-zero
          rc=${PIPESTATUS[0]:-0}
          echo "EXIT_CODE=$rc" >> codacy-cli.log

          # Append diagnostics to the log bundle
          echo "\n--- CONTENTS OF codacy-diag.txt ---" >> codacy-cli.log
          cat codacy-diag.txt >> codacy-cli.log || true

          if [ "$rc" -ne 0 ]; then
            echo "Codacy CLI exited with code $rc; failing job" >> codacy-cli.log
            exit $rc
          fi

      - name: Sanitize Codacy logs
        if: always()
        env:
          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
        run: |
          # Create a redacted copy of the CLI log to avoid leaking secrets in artifacts
          if [ -f codacy-cli.log ]; then
            python - <<'PY'
            import os
            tok = os.environ.get('CODACY_PROJECT_TOKEN','')
            try:
              with open('codacy-cli.log','r',encoding='utf-8',errors='ignore') as f:
                data = f.read()
              if tok:
                data = data.replace(tok, '[REDACTED]')
              with open('codacy-cli.log.redacted','w',encoding='utf-8') as f:
                f.write(data)
              print('WROTE codacy-cli.log.redacted')
            except Exception as e:
              print('redaction-failed', e)
              open('codacy-cli.log.redacted','w').close()
            PY
          else
            # Ensure the file exists so the uploader doesn't fail
            touch codacy-cli.log.redacted || true
          fi

      - name: Upload Codacy CLI output
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: codacy-cli-output
          path: |
            codacy-cli.log.redacted
            codacy-diag.txt
            codacy-version.txt
            codacy-analyze-help.txt
            .codacy-cli-v2
            .codacy

      - name: Upload SARIF to GitHub Code Scanning
        if: always()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Find any SARIF files produced by the Codacy CLI and upload them
          set -e
          found=false
          for f in $(find . -type f -name '*.sarif' -print); do
            echo "Uploading $f to GitHub Code Scanning API"
            curl -s -S -X POST \
              -H "Authorization: token $GITHUB_TOKEN" \
              -H "Content-Type: application/json" \
              --data-binary @"$f" \
              "https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs" || true
            found=true
          done
          if [ "$found" = false ]; then
            echo "No SARIF files found; skipping upload"
          fi