Repository navigation
fix:sonar test #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow uses actions that are not certified by GitHub. | |
| # They are provided by a third-party and are governed by | |
| # separate terms of service, privacy policy, and support | |
| # documentation. | |
| name: pmd | |
| on: | |
| push: | |
| branches: [ "develop" ] | |
| pull_request: | |
| branches: [ "develop" ] | |
| schedule: | |
| - cron: '41 12 * * 3' | |
| permissions: | |
| contents: read | |
| jobs: | |
| pmd-code-scan: | |
| permissions: | |
| contents: read # for actions/checkout to fetch code | |
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | |
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | |
| runs-on: ubuntu-latest | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 # 必须拉取完整历史，才能比较分支差异 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v5 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| - name: Run PMD | |
| id: pmd | |
| env: | |
| EVENT_BEFORE: ${{ github.event.before }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| FILE_LIST="changed-files.txt" | |
| rm -f "$FILE_LIST" pmd-report.sarif | |
| trap 'rm -f "$FILE_LIST"' EXIT | |
| case "$GITHUB_EVENT_NAME" in | |
| pull_request) | |
| git diff --name-only --diff-filter=ACMRT "$PR_BASE_SHA...$PR_HEAD_SHA" -- '*.java' > "$FILE_LIST" | |
| SCAN_SCOPE="changed Java files in the pull request" | |
| ;; | |
| push) | |
| if [ -n "${EVENT_BEFORE:-}" ] && [ "$EVENT_BEFORE" != "0000000000000000000000000000000000000000" ]; then | |
| git diff --name-only --diff-filter=ACMRT "$EVENT_BEFORE" "$GITHUB_SHA" -- '*.java' > "$FILE_LIST" | |
| SCAN_SCOPE="Java files introduced by this push" | |
| else | |
| find . -type f \( -path '*/src/main/java/*.java' -o -path '*/src/test/java/*.java' \) -print | sed 's|^./||' | sort > "$FILE_LIST" | |
| SCAN_SCOPE="all Java source and test files for an initial push" | |
| fi | |
| ;; | |
| schedule) | |
| find . -type f \( -path '*/src/main/java/*.java' -o -path '*/src/test/java/*.java' \) -print | sed 's|^./||' | sort > "$FILE_LIST" | |
| SCAN_SCOPE="all Java source and test files" | |
| ;; | |
| *) | |
| echo "Unsupported event: $GITHUB_EVENT_NAME" | |
| exit 1 | |
| ;; | |
| esac | |
| echo "PMD scan scope: $SCAN_SCOPE" | |
| if [ ! -s "$FILE_LIST" ]; then | |
| echo "No Java files to scan." | |
| echo "violations=0" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "Java files to scan:" | |
| cat "$FILE_LIST" | |
| sed -i "s|^|$PWD/|" "$FILE_LIST" | |
| PMD_VERSION="6.55.0" | |
| curl -L "https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip" -o pmd.zip | |
| unzip -q pmd.zip | |
| mv pmd-bin-${PMD_VERSION} pmd | |
| PMD_CMD="$PWD/pmd/bin/run.sh" | |
| chmod +x "$PMD_CMD" | |
| # PMD can use a non-zero exit code for rule violations. Validate the SARIF | |
| # report below before treating that case differently from an execution error. | |
| set +e | |
| "$PMD_CMD" pmd --no-cache \ | |
| -filelist "$FILE_LIST" \ | |
| -f sarif \ | |
| -R rulesets/java/quickstart.xml \ | |
| -r pmd-report.sarif | |
| pmd_exit=$? | |
| set -e | |
| if [ ! -s pmd-report.sarif ]; then | |
| echo "PMD completed without producing a SARIF report." | |
| exit 1 | |
| fi | |
| if ! jq -e ' | |
| (.runs | type == "array" and length > 0) | |
| and all(.runs[]; | |
| (.results | type == "array") | |
| and ((.invocations? // []) | all(.[]; .executionSuccessful != false)) | |
| and ((.invocations? // []) | all(.[]; | |
| (.toolExecutionNotifications? // []) | all(.[]; .level != "error") | |
| )) | |
| ) | |
| ' pmd-report.sarif > /dev/null; then | |
| echo "PMD produced an invalid or unsuccessful SARIF report." | |
| exit 1 | |
| fi | |
| violations=$(jq '[.runs[]?.results[]?] | length' pmd-report.sarif) | |
| if [ "$pmd_exit" -ne 0 ] && [ "$violations" -eq 0 ]; then | |
| echo "PMD exited with status $pmd_exit without reporting rule violations." | |
| exit "$pmd_exit" | |
| fi | |
| echo "violations=$violations" >> "$GITHUB_OUTPUT" | |
| - name: Install sarif-tools and convert to HTML | |
| if: ${{ always() && hashFiles('pmd-report.sarif') != '' }} | |
| run: | | |
| pip install sarif-tools | |
| sarif html pmd-report.sarif --output pmd-report.html | |
| - name: Upload SARIF file | |
| if: ${{ always() && hashFiles('pmd-report.sarif') != '' }} | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: pmd-report.sarif | |
| - name: Upload SARIF file as artifact | |
| if: ${{ always() && hashFiles('pmd-report.sarif') != '' }} | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: pmd-sarif-report # 给工件起一个有意义的名字 | |
| path: pmd-report.sarif | |
| - name: Upload HTML report | |
| if: ${{ always() && hashFiles('pmd-report.html') != '' }} | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: pmd-html-report | |
| path: pmd-report.html | |
| - name: Check PMD violations | |
| run: | | |
| if [[ ${{ steps.pmd.outputs.violations }} -eq 0 ]]; then | |
| echo "✅ PMD 未发现代码问题，构建通过。" | |
| exit 0 | |
| else | |
| echo "❌ PMD 发现 ${{ steps.pmd.outputs.violations }} 个代码问题，构建失败。" | |
| exit 1 | |
| fi |