Skip to content

ci: pin qodana-action to QD-14800 head SHA to verify check-run fix (QD-14800) - #18

Draft
Anna Zhukova (bindreams) wants to merge 1 commit into
mainfrom
azhukova/QD-14800
Draft

ci: pin qodana-action to QD-14800 head SHA to verify check-run fix (QD-14800)#18
Anna Zhukova (bindreams) wants to merge 1 commit into
mainfrom
azhukova/QD-14800

Conversation

@bindreams

Copy link
Copy Markdown
Collaborator

Summary

Not for merge. Proof-of-work for QD-14800 / JetBrains/qodana-action#599, per the reviewer's ask for a run of the action at @azhukova/QD-14800.

qodana-kotlin-cli has two pull_request-triggered workflows (CI and Semantic PR Title) — the exact reproducer for QD-14800. On main, the Qodana summary check-run is auto-grouped into Semantic PR Title rather than CI. This PR pins qodana-action to PR #599's head SHA (821eac04, branch azhukova/QD-14800) and adds the newly required actions: read permission; the CI run on this PR is the evidence.

Changes

  • .github/workflows/ci.yaml:
    • JetBrains/qodana-action@v2026.1.0JetBrains/qodana-action@821eac0410bf54032962a073e65c66706ea56b1f
    • Added actions: read to the qodana job's permissions: block

Test plan

  • CI green on this PR
  • Qodana summary check-run appears under the CI workflow's check-suite, not under Semantic PR Title
  • Verify with gh api repos/JetBrains/qodana-kotlin-cli/commits/<head_sha>/check-runs --jq '.check_runs[] | {name, check_suite_id, app: .app.slug}'

Will be closed (not merged) after verification and once qodana-action ships a tagged release with the fix.

@github-actions

Copy link
Copy Markdown

Qodana for JVM

56 new problems were found

Inspection name Severity Problems
Unstable API Usage 🔶 Warning 7
Vulnerable declared dependency 🔶 Warning 3
Possibly blocking call in non-blocking context 🔶 Warning 2
Long overload to Duration conversion 🔶 Warning 1
'StringBuilder.append(CharArray, offset, len)' call on the JVM 🔶 Warning 1
Redundant interpolation prefix ◽️ Notice 31
Vulnerable declared dependency ◽️ Notice 5
Constant conditions ◽️ Notice 3
Multi-dollar interpolation can be used in string literals ◽️ Notice 2
Function or property has platform type ◽️ Notice 1

☁️ View the detailed Qodana report

Detected 76 dependencies

Third-party software list

This page lists the third-party software dependencies used in qodana-kotlin-cli

Dependency Version Licenses
annotations 13.0 Apache-2.0
annotations 23.0.0 Apache-2.0
anonymization 77 Apache-2.0
ap-validation 77 Apache-2.0
bcpkix-jdk18on 1.76 MIT
bcprov-jdk18on 1.76 MIT
bcutil-jdk18on 1.76 MIT
client 77 Apache-2.0
commons-codec 1.13 Apache-2.0
commons-codec 1.17.1 Apache-2.0
commons-codec 1.20.0 Apache-2.0
commons-collections4 4.5.0 Apache-2.0
commons-compress 1.21 Apache-2.0
commons-compress 1.27.1 Apache-2.0
commons-io 2.13.0 Apache-2.0
commons-io 2.16.1 Apache-2.0
commons-io 2.21.0 Apache-2.0
commons-lang3 3.12.0 Apache-2.0
commons-lang3 3.16.0 Apache-2.0
commons-lang3 3.19.0 Apache-2.0
cyclonedx-core-java 11.0.1 BSD-3-Clause
CDDL-1.0
CDDL-1.1
Classpath-exception-2.0
GPL-2.0-only
GPL-3.0-only
LGPL-3.0-only
MIT
W3C
cyclonedx-gradle-plugin 3.2.4 Apache-2.0
detekt-gradle-plugin 1.23.7 Apache-2.0
docker-java-api 3.4.1 Apache-2.0
docker-java-core 3.4.1 Apache-2.0
docker-java-transport-httpclient5 3.4.1 Apache-2.0
docker-java-transport 3.4.1 Apache-2.0
fus-statistics-gradle-plugin 2.1.20 Apache-2.0
graalvm-reachability-metadata 0.10.6 UPL-1.0
guava 19.0 Apache-2.0
httpclient5 5.0.3 Apache-2.0
httpcore5-h2 5.0.2 Apache-2.0
httpcore5 5.0.2 Apache-2.0
intellij-report-converter 0.11.76.1 Apache-2.0
itu 1.14.0 Apache-2.0
jackson-annotations 2.18.2 Apache-2.0
jackson-annotations 2.20 Apache-2.0
jackson-core 2.18.2 Apache-2.0
jackson-core 2.20.1 Apache-2.0
jackson-databind 2.18.2 Apache-2.0
jackson-databind 2.20.1 Apache-2.0
jackson-dataformat-xml 2.20.1 Apache-2.0
jackson-dataformat-yaml 2.20.1 Apache-2.0
jna 5.13.0 Apache-2.0
LGPL-2.1-only
json-schema-validator 1.5.9 Apache-2.0
jspecify 1.0.0 Apache-2.0
kotlin-build-tools-api 2.1.20 Apache-2.0
kotlin-gradle-plugin-annotations 2.1.20 Apache-2.0
kotlin-gradle-plugin-api 2.1.20 Apache-2.0
kotlin-gradle-plugin-model 2.1.20 Apache-2.0
kotlin-gradle-plugin 2.1.20 Apache-2.0
kotlin-logging 1.5.3 Apache-2.0
kotlin-native-utils 2.1.20 Apache-2.0
kotlin-reflect 2.3.0 Apache-2.0
kotlin-stdlib-jdk7 1.9.10 Apache-2.0
kotlin-stdlib-jdk8 1.9.10 Apache-2.0
kotlin-stdlib 2.1.20 Apache-2.0
kotlin-stdlib 2.3.0 Apache-2.0
kotlin-tooling-core 2.1.20 Apache-2.0
kotlin-util-io 2.1.20 Apache-2.0
kotlinx-coroutines-core-jvm 1.10.1 Apache-2.0
ktlint-gradle 12.1.1 Apache-2.0
model 77 Apache-2.0
native-gradle-plugin 0.10.6 UPL-1.0
okhttp 4.12.0 Apache-2.0
okio-jvm 3.6.0 Apache-2.0
openjson 1.0.13 Apache-2.0
packageurl-java 1.5.0 MIT
scheme 77 Apache-2.0
slf4j-api 2.0.16 MIT
slf4j-api 2.0.17 MIT
slf4j-simple 2.0.16 MIT
snakeyaml 2.4 Apache-2.0
stax2-api 4.2.2 BSD-2-Clause
utils 0.10.6 UPL-1.0
woodstox-core 7.1.1 Apache-2.0
Contact Qodana team

Contact us at qodana-support@jetbrains.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant