{"id":446509,"date":"2024-02-29T15:27:58","date_gmt":"2024-02-29T14:27:58","guid":{"rendered":"https:\/\/blog.jetbrains.com\/?post_type=dotnet&p=446509"},"modified":"2024-03-11T23:54:44","modified_gmt":"2024-03-11T22:54:44","slug":"boost-code-quality-with-qodana-and-github-actions","status":"publish","type":"dotnet","link":"https:\/\/blog.jetbrains.com\/zh-hans\/dotnet\/2024\/02\/29\/boost-code-quality-with-qodana-and-github-actions","title":{"rendered":"Boost Code Quality with Qodana and GitHub Actions"},"content":{"rendered":"\n

It\u2019s been roughly half a year since we introduced Qodana to .NET in our blog post about how to elevate your C# code quality with Qodana.<\/a> Since then, we\u2019ve been quite busy! Qodana went out of preview and into GA<\/a>. Furthermore, we greatly improved the integration with our IDEs<\/a>, providing an effortless Try Qodana<\/a> experience directly on your local machine. We\u2019ve also released a plugin for Visual Studio Code<\/a>. And lastly, we\u2019ve taken your feedback on board and started to discuss custom On-Premises plans<\/a> with interested teams.<\/p>\n\n\n\n

Still haven\u2019t heard about Qodana? Our new code quality platform helps various stakeholders in your company improve code quality, comply with license requirements, spot security issues, and deliver a better product! In the realm of open source, Qodana has already proven to ensure<\/a> and encourage<\/a> qualitative pull requests.<\/p>\n\n\n\n

\n \n
Qodana in Action<\/figcaption>\n<\/figure>\n\n\n\n

In this blog post, we will dive deeper into the topic of integrating Qodana with your GitHub Actions infrastructure to maintain your team\u2019s software engineering standards.<\/p>\n\n\n

\n
\n Try Qodana with your .NET projects<\/a>\n <\/div>\n <\/div>\n\n\n\n\n\n\n\n\n\n\n\n

Setting up a Qodana Project<\/h2>\n\n\n\n

Head over to Qodana Cloud<\/a> or your On-Premises solution, and create a new project that links to one of your GitHub repositories:<\/p>\n\n\n\n

\n \n
Creating a new Qodana project with an HTTPS address<\/figcaption>\n<\/figure>\n\n\n\n

Once you\u2019ve gone through all the setup steps, Qodana will present your personal access token:<\/p>\n\n\n\n

\n \n
Confirmation after the Qodana project has been created<\/figcaption>\n<\/figure>\n\n\n\n

You can copy the Qodana token right away, but you\u2019ll also get another chance while we\u2019re setting up the configuration and workflow files in the next step!<\/p>\n\n\n\n

Adding a GitHub Actions workflow file<\/h2>\n\n\n\n

As already mentioned, our Qodana team has put a lot of effort into IDE integration and your first-time experience. Bring up the Search Everything<\/em> popup<\/a> and search for the Add Qodana to CI Pipeline<\/em> action:<\/p>\n\n\n\n

\n \n
Adding Qodana to a CI pipeline<\/figcaption>\n<\/figure>\n\n\n\n

Assuming you haven\u2019t tried Qodana yet, the dialog will first prompt you to add a qodana.yml<\/code> file based on a template with standard defaults for your .NET solution:<\/p>\n\n\n\n

\n \n
Adding the qodana.yml<\/code> configuration file<\/figcaption>\n<\/figure>\n\n\n\n

From the colorization, you might have guessed it already, but this is not just a simple multiline textbox but rather an embedded editor with full YAML support<\/a>! So you can take advantage of code completion, formatting, and validation when editing the file. For instance, you can see which inspection profiles<\/a> are included out of the box:<\/p>\n\n\n\n

\n \n
YAML support in qodana.yml<\/code><\/figcaption>\n<\/figure>\n\n\n\n

Once you confirm the qodana.yml<\/code> file, the wizard will continue with a list of all the major CI\/CD services and tools. As you may have gathered, we\u2019ll be focusing on Qodana\u2019s integration with GitHub Actions<\/a> in this blog post. The workflow template comes with all the most important bits, including when to trigger the analysis, how to checkout the repository (do not shallow clone!), the actual analysis invocation through qodana-action<\/a><\/code>, and the QODANA_TOKEN<\/code> as an environment variable:<\/p>\n\n\n\n

\n \n
Adding a GitHub Actions workflow file<\/figcaption>\n<\/figure>\n\n\n\n

By default, the action will use the same version as the current version of your IDE. You can also change it to JetBrains\/qodana-action@main<\/code> to always use the latest version.<\/em><\/p>\n\n\n\n

Before you confirm to add the qodana.yaml<\/code> and workflow file to your repository, it\u2019s a good idea to click the Get token<\/em> link and grab the Qodana token for your project:<\/p>\n\n\n\n

\n \n
Grabbing the Qodana Token<\/figcaption>\n<\/figure>\n\n\n\n

This QODANA_TOKEN<\/code> needs to be added as a secret to your GitHub repository so that Qodana can upload analysis results to your Qodana Cloud or On-Premises solution:<\/p>\n\n\n\n

\n \n
Adding the Qodana Token to a GitHub repository<\/figcaption>\n<\/figure>\n\n\n\n

Now you can finally confirm the Qodana wizard and push the qodana.yml<\/code> and GitHub Actions workflow file to your repository:<\/p>\n\n\n\n

\n \n
Qodana setup confirmation<\/figcaption>\n<\/figure>\n\n\n\n

Your GitHub repository will take it from here and run the workflow through GitHub Actions. In the meantime, you might want to log in to Qodana in your IDE under Settings | Tools | Qodana<\/em> so that we can download and inspect analysis results in the next part:<\/p>\n\n\n\n

\n \n
Logging in to Qodana in the IDE<\/figcaption>\n<\/figure>\n\n\n\n

Get ready, we\u2019re about to enter the really interesting part!<\/p>\n\n\n\n

Inspecting Qodana results for GitHub Actions<\/h2>\n\n\n\n

Before inspecting your first run results, you need to link the local repository to the Qodana project. Under the Problems<\/em> tool window<\/a>, you can find the Server-Side Analysis<\/em> tab<\/a>. If Qodana hasn\u2019t linked your project automatically yet, you can perform this step manually from here:<\/p>\n\n\n\n

\n \n
Linking a Qodana project in the IDE<\/figcaption>\n<\/figure>\n\n\n\n

Once the project is linked, you will see the first analysis results inside your IDE. The report includes all important information about the workflow run, branch, number of issues, their classifications, and severities:<\/p>\n\n\n\n

\n \n
Inspecting Qodana results in the IDE<\/figcaption>\n<\/figure>\n\n\n\n

Double-clicking an issue quickly navigates you to the location in your repository. It\u2019s also worth noting that from the context menu, not only can you navigate to the report in Qodana Cloud but also to the workflow run in GitHub Actions:<\/p>\n\n\n\n

\n \n
Navigation to Qodana Cloud and the GitHub Actions workflow run<\/figcaption>\n<\/figure>\n\n\n\n

Another great strength of Qodana is that it doesn\u2019t just provide its analysis results through our IDEs and Qodana web interface but also directly through both annotations<\/a> and job summaries<\/a> under workflow runs. That means even contributors who don\u2019t use JetBrains IDEs or don\u2019t have access to your Qodana project can take advantage of Qodana\u2019s first-class analysis reports:<\/p>\n\n\n\n

\n \n
GitHub Actions annotations with Qodana results<\/figcaption>\n<\/figure>\n\n\n\n

This is a little reminder that we also built an extension for Visual Studio Code<\/a>.<\/em><\/p>\n\n\n\n

In case you don\u2019t want to see any annotations, you can opt out via the use-annotations<\/code> property:<\/p>\n\n\n\n

- name: Qodana Scan\n  uses: JetBrains\/qodana-action@main\n\twith:\n\t  use-annotations: false\n<\/pre>\n\n\n\n
In contrast to our demo project in this blog post, your solution might show significantly more code inspections and problems. This is expected, and you shouldn\u2019t feel discouraged by it. Our goal with Qodana is to help you improve your code quality in an incremental and flexible way<\/strong>, which can be achieved by moving existing problems to the baseline and configuring a fail threshold as a quality gate<\/a>.<\/p>\n\n\n\n
In the following sections, we\u2019ll dive into the GitHub-specific aspects of Qodana<\/a>.<\/p>\n\n\n\n
Qodana results in GitHub Pull Requests<\/h2>\n\n\n\n
In order to make Qodana work properly with pull requests, you need to set the ref<\/code> and fetch-depth<\/code> properties on the checkout<\/code> action as follows:<\/p>\n\n\n\n
- uses: actions\/checkout@v4\n  with:\n    ref: ${{ github.event.pull_request.merge_commit_sha }}\n    fetch-depth: 0\n<\/pre>\n\n\n\n
Without any additional effort, Qodana can post analysis results on GitHub pull requests. This enables contributors to react promptly to potential bugs and quality degradation. At the same time, it gives repository owners more confidence when it comes to merging pull requests:<\/p>\n\n\n\n
\n    \n    
Qodana results as a comment in a GitHub pull request<\/figcaption>\n<\/figure>\n\n\n\n
This analysis report is updated as more commits are pushed to the branch.<\/p>\n\n\n\n
If you prefer not to post any updates on pull requests, you can opt out via the post-pr-comment<\/code> property:<\/p>\n\n\n\n
- name: Qodana Scan\n  uses: JetBrains\/qodana-action@main\n\twith:\n\t  post-pr-comment: false\n<\/pre>\n\n\n\n
Uploading Qodana results as artifacts<\/h2>\n\n\n\n
By default, Qodana will upload analysis results only to Qodana Cloud. Under certain circumstances, you might also want to upload them as artifacts. This could be to update the qodana.sarif.json<\/code> baseline file by simply downloading and replacing it in your repository or to allow contributors to investigate a report directly in their IDE without having to link the project:<\/p>\n\n\n\n
\n    \n    
Load a Qodana report locally in the IDE<\/figcaption>\n<\/figure>\n\n\n\n
In order to opt into uploading the Qodana report as an artifact, you can use the upload-result<\/code> and artifact-name<\/code> properties:<\/p>\n\n\n\n
- name: Qodana Scan\n  uses: JetBrains\/qodana-action@main\n\twith:\n\t  upload-result: ${{ github.ref_name == 'main' }}\n\t\tartifact-name: qodana-report\n<\/pre>\n\n\n\n
Adding a Qodana status badge<\/h2>\n\n\n\n
After all that work of integrating Qodana into your repository, what could be better than adding a lovely little badge to show that it\u2019s in good shape? Just head over to one of the workflow runs and grab it from the menu in the upper right-hand corner:<\/p>\n\n\n\n
\n    \n    
Adding a Qodana status badge<\/figcaption>\n<\/figure>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
Over recent months, Qodana has made significant strides in seamlessly integrating with your GitHub repositories, diligently monitoring code quality with each commit and pull request. Through this integration, maintainers and contributors can swiftly pinpoint defects, whether within their IDEs\/editors or directly within the GitHub UI. Register on Qodana Cloud today<\/strong><\/a> and experience the enhancement of code quality in GitHub firsthand!<\/p>\n\n\n\n
As always, let us know what you think and what features you\u2019d like to see in the future!<\/p>\n\n\n\n
Image credits: <\/sub><\/em>Andy Hermawan<\/a><\/em><\/sub><\/p>\n","protected":false},"author":553,"featured_media":446517,"comment_status":"closed","ping_status":"closed","template":"","categories":[4992,1401,6924],"tags":[228,6470,6359,1978],"cross-post-tag":[6687],"acf":[],"_links":{"self":[{"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/dotnet\/446509"}],"collection":[{"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/dotnet"}],"about":[{"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/types\/dotnet"}],"author":[{"embeddable":true,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/users\/553"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/comments?post=446509"}],"version-history":[{"count":9,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/dotnet\/446509\/revisions"}],"predecessor-version":[{"id":456357,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/dotnet\/446509\/revisions\/456357"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/media\/446517"}],"wp:attachment":[{"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/media?parent=446509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/categories?post=446509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/tags?post=446509"},{"taxonomy":"cross-post-tag","embeddable":true,"href":"https:\/\/blog.jetbrains.com\/zh-hans\/wp-json\/wp\/v2\/cross-post-tag?post=446509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}