diff --git a/.github/workflows/deleted-files.yml b/.github/workflows/deleted-files.yml index 419467da53..03f02933aa 100644 --- a/.github/workflows/deleted-files.yml +++ b/.github/workflows/deleted-files.yml @@ -15,7 +15,7 @@ jobs: - name: Get changed docs md files id: changed-files - uses: tj-actions/changed-files@v40 + uses: tj-actions/changed-files@v41 with: files: docs/**/*.md diff --git a/.github/workflows/mkdocs.yml b/.github/workflows/mkdocs.yml index 9f8c168fc6..be9df1b713 100644 --- a/.github/workflows/mkdocs.yml +++ b/.github/workflows/mkdocs.yml @@ -43,7 +43,7 @@ jobs: mkdocs -v build - name: Upload meta descriptions artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: meta-descriptions path: ./site/meta-descriptions.csv diff --git a/docs/assets/includes/coverage-github-accept-permissions.md b/docs/assets/includes/coverage-github-accept-permissions.md new file mode 100644 index 0000000000..9224f8b818 --- /dev/null +++ b/docs/assets/includes/coverage-github-accept-permissions.md @@ -0,0 +1,3 @@ + +!!! info "GitHub only: this feature requires updated app permissions. If you haven't done so yet, please [review and accept the updated Codacy app permissions](https://docs.github.com/en/enterprise-cloud@latest/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#reviewing-permissions) on GitHub" + diff --git a/docs/coverage-reporter/uploading-coverage-in-advanced-scenarios.md b/docs/coverage-reporter/uploading-coverage-in-advanced-scenarios.md index e377f2442d..aeea8bf6e5 100644 --- a/docs/coverage-reporter/uploading-coverage-in-advanced-scenarios.md +++ b/docs/coverage-reporter/uploading-coverage-in-advanced-scenarios.md @@ -26,6 +26,9 @@ bash <(curl -Ls https://coverage.codacy.com/get.sh) report \ You can also upload all your reports dynamically using the command `find`. For example: +!!! note + This example works only on systems that use GNU `find` with support for the `-printf` action, such as Linux. + ```bash bash <(curl -Ls https://coverage.codacy.com/get.sh) report \ -l Java $(find . -name 'jacoco*.xml' -printf '-r %p ') diff --git a/docs/faq/code-analysis/which-metrics-does-codacy-calculate.md b/docs/faq/code-analysis/which-metrics-does-codacy-calculate.md index 2913b38f22..adb7455360 100644 --- a/docs/faq/code-analysis/which-metrics-does-codacy-calculate.md +++ b/docs/faq/code-analysis/which-metrics-does-codacy-calculate.md @@ -55,7 +55,7 @@ Codacy calculates the number of issues in the following static code analysis cat - **Performance:** Code that can have performance problems - **Compatibility:** Mainly for frontend code, compatibility problems across different browser versions - **Unused Code:** Unused variables and methods, code that can't be reached -- **Security:** All security problems +- **Security:** Potential security vulnerabilities, including hard-coded passwords and keys (secret scanning), vulnerable dependencies (software composition analysis or SCA), and insecure code patterns (static application security testing or SAST). For more information, see the complete [list of security issue categories](../../repositories/security-monitor.md#supported-security-categories) - **Documentation:** Methods and classes that don't have the correct comment annotations diff --git a/docs/faq/troubleshooting/why-did-codacy-stop-commenting-on-pull-requests.md b/docs/faq/troubleshooting/why-did-codacy-stop-commenting-on-pull-requests.md index 72e5852de7..b49a6c4c0d 100644 --- a/docs/faq/troubleshooting/why-did-codacy-stop-commenting-on-pull-requests.md +++ b/docs/faq/troubleshooting/why-did-codacy-stop-commenting-on-pull-requests.md @@ -1,6 +1,16 @@ # Why did Codacy stop commenting on pull requests? -!!! info "This page applies only to GitLab and Bitbucket" +## Outdated app permissions + +!!! info "This section applies to Codacy Coverage on GitHub" + +Coverage information is currently sent to GitHub by a new version of the Codacy Coverage engine, which depends on updated app permissions. + +If you stopped receiving coverage summaries on your pull requests, please [review and accept the updated Codacy app permissions on GitHub](https://docs.github.com/en/enterprise-cloud@latest/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#reviewing-permissions). For more information on the rollout of the new Coverage engine, [see the relevant release note](../../release-notes/cloud/cloud-2023-11-23-new-coverage-engine-status-checks.md). + +## Outdated permissions or invalid SSH key + +!!! info "This section applies to GitLab and Bitbucket" Different reasons can cause Codacy to stop analyzing and commenting on pull requests, but the most common is that the user who initially enabled the GitLab or Bitbucket integration no longer has permissions on the repository or that the SSH key is no longer valid. diff --git a/docs/organizations/integrations/images/default-git-provider-settings-apply-all.png b/docs/organizations/integrations/images/default-git-provider-settings-apply-all.png index f8cfed5086..a4b6dd84f5 100644 Binary files a/docs/organizations/integrations/images/default-git-provider-settings-apply-all.png and b/docs/organizations/integrations/images/default-git-provider-settings-apply-all.png differ diff --git a/docs/organizations/integrations/images/default-git-provider-settings.png b/docs/organizations/integrations/images/default-git-provider-settings.png index 4025e8e423..074385a01a 100644 Binary files a/docs/organizations/integrations/images/default-git-provider-settings.png and b/docs/organizations/integrations/images/default-git-provider-settings.png differ diff --git a/docs/organizations/managing-security-and-risk.md b/docs/organizations/managing-security-and-risk.md index 6cf8eb9e39..01d6494379 100644 --- a/docs/organizations/managing-security-and-risk.md +++ b/docs/organizations/managing-security-and-risk.md @@ -26,7 +26,7 @@ Each panel shows the total count of matching items and contains a **Review** but When viewing the dashboard, you can: - Limit the total counts in each panel to a specific set of severities or repositories by clicking the **Severity** or **Repository** drop-downs above the main area. -- Export a list of items as a CSV file by clicking the **Export CSV** button in the top right-hand corner of the page. The exported list always includes all items, ignoring any applied filters. + - Review the [severity assignment rules](#item-severities-and-deadlines) by clicking the **See rules** button in the top right-hand corner of the page. ![Security and risk management dashboard](images/security-risk-management-dashboard.png) @@ -40,12 +40,19 @@ To access the item list, access the [dashboard](#dashboard) and click the **Revi When viewing the item list, you can: - Update the filtering criteria by clicking the **Severity**, **Status**, or **Repository** drop-downs above the list. + - Find out more about an item by clicking its **Details** column to navigate to the item of interest on the source platform. -- Export a list of items as a CSV file by clicking the **Export CSV** button in the top right-hand corner of the page. The exported list always includes all items, ignoring any applied filters. + - Review the [severity assignment rules](#item-severities-and-deadlines) by clicking the **See rules** button in the top right-hand corner of the page. ![Security and risk management items](images/security-risk-management-item-list.png) +## Exporting the security item list + +!!! info "This feature is available only to organization admins and organization managers" + +To export a list of security items as a CSV file, click the **Export CSV** button in the top right-hand corner of the page. The exported list always includes all items, ignoring any applied filters. + ## How Codacy manages security items {: id="opening-and-closing-items"} !!! important diff --git a/docs/organizations/roles-and-permissions-for-organizations.md b/docs/organizations/roles-and-permissions-for-organizations.md index c435e82b60..4f4f238f74 100644 --- a/docs/organizations/roles-and-permissions-for-organizations.md +++ b/docs/organizations/roles-and-permissions-for-organizations.md @@ -64,6 +64,15 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp Yes Yes + + Access Security and risk management + No + Yes3 + Yes3 + Yes3 + Yes + Yes + Ignore issues and files,
configure code patterns and file extensions,
manage branches,
reanalyze branches and pull requests No @@ -96,7 +105,7 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp No No No - Yes3 + Yes4 Inherits original permission Yes @@ -118,15 +127,6 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp Yes Yes - - Access Security and risk management - No - No - No - No - Yes - Yes - Invite and accept members,
modify billing No @@ -150,7 +150,8 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp 1: Outside collaborators aren't supported as members of organizations on Codacy. You can still [add outside collaborators to Codacy](managing-people.md#adding-people) so that Codacy analyzes their commits to private repositories, but they won't be able to join your Codacy organization. 2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization). -3: Requires that an organization owner has given the Codacy GitHub App access to the repositories to add or remove. +3: These users can only see security items originating from Codacy repositories that they follow. +4: Requires that an organization owner has given the Codacy GitHub App access to the repositories to add or remove. ## Permissions for GitLab @@ -199,6 +200,15 @@ The table below maps the GitLab Cloud and GitLab Enterprise roles to the corresp Yes Yes + + Access Security and risk management + No + Yes3 + Yes3 + Yes3 + Yes + Yes + Ignore issues and files,
configure code patterns and file extensions,
manage branches,
reanalyze branches and pull requests No @@ -253,15 +263,6 @@ The table below maps the GitLab Cloud and GitLab Enterprise roles to the corresp Yes Yes - - Access Security and risk management - No - No - No - No - Yes - Yes - Invite and accept members,
modify billing No @@ -284,7 +285,8 @@ The table below maps the GitLab Cloud and GitLab Enterprise roles to the corresp 1: External users aren't supported as members of organizations on Codacy. You can still [add external users to Codacy](managing-people.md#adding-people) so that Codacy analyzes their commits to private repositories, but they won't be able to join your Codacy organization. -2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization). +2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization). +3: These users can only see security items originating from Codacy repositories that they follow. ## Permissions for Bitbucket @@ -319,6 +321,12 @@ The table below maps the Bitbucket Cloud and Bitbucket Server roles to the corre Yes Yes + + Access Security and risk management + Yes3 + Yes + Yes + Ignore issues and files,
configure code patterns and file extensions,
manage branches,
reanalyze branches and pull requests Configurable @@ -355,12 +363,6 @@ The table below maps the Bitbucket Cloud and Bitbucket Server roles to the corre Yes Yes - - Access Security and risk management - No - Yes - Yes - Invite and accept members,
modify billing No @@ -377,7 +379,8 @@ The table below maps the Bitbucket Cloud and Bitbucket Server roles to the corre 1: Codacy can't distinguish the Bitbucket roles Read and Write because of a limitation on the Bitbucket API. -2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization). +2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization). +3: These users can only see security items originating from Codacy repositories that they follow. ## The organization manager role diff --git a/docs/release-notes/cloud/cloud-2023-11-23-new-coverage-engine-status-checks.md b/docs/release-notes/cloud/cloud-2023-11-23-new-coverage-engine-status-checks.md index 39108666ed..53f42e190d 100644 --- a/docs/release-notes/cloud/cloud-2023-11-23-new-coverage-engine-status-checks.md +++ b/docs/release-notes/cloud/cloud-2023-11-23-new-coverage-engine-status-checks.md @@ -5,19 +5,48 @@ rss_href: /feed_rss_created.xml # Rollout of new Coverage engine November 23, 2023 -As part of an ongoing effort to improve the speed and value of the insights provided by Codacy, we've been working on a new Coverage engine and started its deployment on November 23rd, 2023. The rollout to use the new engine across Codacy will be phased across several months and will gradually impact the coverage data you see on the Git provider, UI, and API. +{% + include-markdown "../../assets/includes/coverage-github-accept-permissions.md" + start="" + end="" +%} -!!! info - GitHub only: The new Coverage engine requires updated app permissions. If you haven't done so yet, please [review and accept the updated Codacy app permissions](https://docs.github.com/en/enterprise-cloud@latest/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#reviewing-permissions). +As part of an ongoing effort to improve the speed and value of the insights provided by Codacy, we've been working on a new Coverage engine and started its deployment on November 23rd, 2023. The rollout to use the new engine across Codacy will be phased across several months and will gradually impact the coverage data you see on the Git provider, UI, and API. Please refer to the table below for the updated status of the transition process. The table will be updated as changes are introduced. -| Feature | Status | Notes | -|--------------------------------------------------|-------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [Git provider status checks](#status-checks) | Live (beta) | The new Coverage engine now sends coverage data to your Git provider. This data is marked \[beta\] and is shown alongside the data from the current engine. | -| [GitHub coverage summaries](#coverage-summaries) | Live | The new Coverage engine now sends coverage summaries to GitHub. If you haven't done so yet, please review and update your app permissions as mentioned above. | -| Codacy app UI | Planned | - | -| Codacy API | Planned | - | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Feature setFeatureStatusNotes
Git providersGit provider status checksLive (beta)The new Coverage engine now sends coverage data to your Git provider.
This data is marked [beta] and is shown alongside the data from the current engine.
GitHub coverage summariesLiveThe new Coverage engine now sends coverage summaries to GitHub. If you haven't done so yet, please review and update your app permissions as mentioned above.
Codacy app UICoverage pull request diff tabLive-
Other pages and componentsPlanned-
Because of this transition, both old and new data will coexist during this period, potentially leading to [differences in reported metrics](#differences-in-coverage-metrics-between-the-old-and-new-coverage-engines). @@ -95,7 +124,23 @@ If you are using the old status check to block merging pull requests on GitHub, !!! info "This section applies to the repositories for which you set Codacy to post [coverage summaries](../../repositories-configure/integrations/github-integration.md#coverage-summaries) to your GitHub pull requests" -On December 7th 2023 we set the new Coverage engine to post coverage summaries to GitHub, replacing the old Coverage engine. If you haven't done so yet, please [review and accept the updated Codacy app permissions](https://docs.github.com/en/enterprise-cloud@latest/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#reviewing-permissions). +{% + include-markdown "../../assets/includes/coverage-github-accept-permissions.md" + start="" + end="" +%} + +On December 7th 2023 we set the new Coverage engine to post coverage summaries to GitHub, replacing the old Coverage engine. + +## Codacy app UI diff tabs from the new Coverage engine {: id="diff-tabs"} + +{% + include-markdown "../../assets/includes/coverage-github-accept-permissions.md" + start="" + end="" +%} + +On December 27th 2023 we set the [diff tab of the Coverage pull requests page](../../repositories-coverage/pull-requests.md#diff-tab) to get data from the new Coverage engine. ## Differences in coverage metrics between the old and new Coverage engines diff --git a/requirements.txt b/requirements.txt index 6906ca98cf..8ab2e78d54 100644 --- a/requirements.txt +++ b/requirements.txt @@ -11,10 +11,10 @@ pymdown-extensions==10.5 # MkDocs plugins mkdocs-exclude-search==0.6.6 mkdocs-exclude==1.0.2 -mkdocs-git-revision-date-localized-plugin==1.2.1 +mkdocs-git-revision-date-localized-plugin==1.2.2 mkdocs-include-markdown-plugin==6.0.4 mkdocs-macros-plugin==1.0.5 mkdocs-meta-descriptions-plugin==3.0.0 mkdocs-monorepo-plugin==1.0.5 mkdocs-redirects==1.2.1 -mkdocs-rss-plugin==1.9.0 +mkdocs-rss-plugin==1.11.0