Skip to content

Add Qodana scanning to pull requests and master #268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mambax7 merged 3 commits into from
Oct 14, 2026
Merged

Add Qodana scanning to pull requests and master #268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ab9afaa
Add Qodana scanning to pull requests and master
mambax7 Oct 14, 2026
8cb05b0
Enable CodeRabbit automatic reviews
mambax7 Oct 14, 2026
d5f8c09
Restrict default permissions in the Qodana workflow
mambax7 Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .coderabbit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ reviews:
review_status: true
collapse_walkthrough: false
auto_review:
enabled: false
enabled: true
drafts: false
path_filters:
# Skip vendored third-party code and generated/lock files (e.g. the
Expand Down
34 changes: 34 additions & 0 deletions .github/workflows/qodana.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
name: Qodana
on:
workflow_dispatch:
pull_request:
push:
branches:
- master

permissions: {}

concurrency:
group: qodana-${{ github.ref }}
cancel-in-progress: true

jobs:
qodana:
runs-on: ubuntu-22.04
timeout-minutes: 30
if: github.repository == 'XOOPS/XoopsCore27'
permissions:
contents: read
pull-requests: write
checks: write
env:
QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
fetch-depth: 0

- name: Qodana Scan
if: env.QODANA_TOKEN != ''

@sourcery-ai sourcery-ai Bot Oct 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium · Fork pull requests skip scanning

When a pull request comes from a fork, gitHub does not expose repository secrets to pull_request runs from forks, so QODANA_TOKEN is empty and the Qodana step is skipped; no tokenless scan or other fallback analyzes those pull requests.

Provide a safe tokenless scanning path for fork pull requests, or otherwise make clear that Qodana coverage is limited to runs with the secret.

Prompt for AI agents 
In `.github/workflows/qodana.yml` at line 31:

**Fork pull requests skip scanning**

When a pull request comes from a fork, gitHub does not expose repository secrets to `pull_request` runs from forks, so `QODANA_TOKEN` is empty and the Qodana step is skipped; no tokenless scan or other fallback analyzes those pull requests.

Provide a safe tokenless scanning path for fork pull requests, or otherwise make clear that Qodana coverage is limited to runs with the secret.

Comment thread
coderabbitai[bot] marked this conversation as resolved.
uses: JetBrains/qodana-action@3e8d76ff0e0241618abd808682f426afe84bab3f # v2026.2.2
3 changes: 3 additions & 0 deletions docs/changelog.270.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ Libraries and assets:
- update the bundled XMF library to 1.3.3: the proxy_env header is only honoured when the direct peer is listed in the new $xoopsConfig['proxy_trusted'] (addresses or CIDR ranges, documented in xoops_data/configs/xoopsconfig.dist.php) — sites that set proxy_env must add proxy_trusted, until then the peer address is used; Forwarded headers are parsed per RFC 7239; Xmf\Mail\SendmailRunner has a delivery timeout; Xmf\Database\Tables keeps CURRENT_TIMESTAMP defaults and refuses tables with functional index parts; Xmf\Security\Serializer accepts every legacy payload; Xmf\Jwt\TokenReader accepts Bearer tokens on custom headers again (xoops_lib/composer.dist.json, xoops_lib/vendor/xoops/xmf)
- HTML Purifier 4.19.1, firebase/php-jwt 7.2.1, Monolog 3.12.1, Punic 3.8.2, Smarty 4.5.8, symfony/polyfill-mbstring 1.43.0, symfony/var-dumper 7.4.18, symfony/yaml 7.4.20, TCPDF 6.11.4, webmozart/assert 2.5.0 (xoops_lib/composer.dist.lock, xoops_lib/vendor) (#265)

Tooling and CI:
- Qodana (jetbrains/qodana-php 2026.2, qodana.recommended profile) scans pull requests and master again, as it does on XoopsCore26; the scan installs xoops_lib/composer.dist.lock inside the linter container and skips the vendor trees, the installer, xoops_data, extras and tests; it runs only when the QODANA_TOKEN repository secret is set (qodana.yaml, .github/workflows/qodana.yml) (mamba)

===================================
2.7.4 RC 2 2026-10
===================================
Expand Down
22 changes: 22 additions & 0 deletions qodana.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
version: "1.0"

image: jetbrains/qodana-php:2026.2
Comment thread
coderabbitai[bot] marked this conversation as resolved.

profile:
name: qodana.recommended

php:
version: "8.4"

bootstrap: cd htdocs/xoops_lib && cp composer.dist.json composer.json && cp composer.dist.lock composer.lock && composer install --no-interaction --prefer-dist '--ignore-platform-req=ext-*'

exclude:
- name: All
paths:
- htdocs/xoops_lib/vendor
- htdocs/class/libraries/vendor
- htdocs/install
- htdocs/xoops_data
- extras
- tests
- build