repository·2025.2·Indexed 19 days ago
https://github.com/jetbrains/qodanaOfficial user guides for Qodana, a code quality platform for enforcing coding standards and quality gates. Documentation covers local execution via CLI and IDEs, CI/CD integration with GitHub Actions, GitLab CI/CD, Azure Pipelines, CircleCI, TeamCity, Bitbucket, and Jenkins, as well as configuring baselines, quality gates, and custom inspection profiles.
Qodana provides static analysis for Golang projects based on the GoLand IDE. It is available as both a native solution and a Docker image.
Key Characteristics:
%go-linter%%go-image%Qodana analysis reports provide an interactive interface to review inspection results either locally (via HTML reports) or in the cloud. The report UI is organized into several key tabs:
Additionally, the upper-right corner of the report displays code coverage analysis results.
The Insights dashboard provides several widgets to monitor code quality and compliance across your projects:
Qodana can be integrated into various CI systems either through native solutions or by running Qodana via Docker images.
| Method | Supported CI Systems |
|---|---|
| Native Solutions | Azure Pipelines, Bitbucket, GitHub, GitLab, TeamCity |
| Docker Images | Bitbucket, Jenkins |
For a complete list of guides and configuration examples for other CI systems, refer to the ci.md section.
Qodana integrates with several IDEs, providing varying levels of functionality depending on the product:
(IntelliJ IDEA, PhpStorm, WebStorm, GoLand, PyCharm, Rider, CLion)
Version 2025.2 includes several security analysis enhancements for Java and Kotlin to better address OWASP Top 10 risks:
Qodana provides several linters for JVM-based languages depending on your license and required features.
To analyze .NET code, you can choose between two different Qodana linters depending on your licensing and language requirements:
%dotnet-linter%%dotnet-image%%dotnet-co-linter%%dotnet-co-image%By default, Qodana runs linters using Docker-based Linux images. Native mode allows you to run specific linters directly on your host operating system (Linux, macOS, or Windows) without Docker.
| Linter | Linter name |
|---|---|
| JVM | %jvm-linter% |
| JVM Code Analysis | %jvm-co-linter% |
| PHP | %php-linter% |
| JavaScript | %js-linter% |
| .NET | %dotnet-linter% |
| Python | %python-linter% |
| Python Code Analysis | %python-co-linter% |
| Go | %go-linter% |
IMPORTANT Native mode is currently in Early Access and may be unreliable or contain errors. Native mode is incompatible with Docker containers; you must choose either Docker mode or Native mode.
FlexInspect allows you to develop custom code inspections specific to your project using the IntelliJ API and Kotlin. These inspections are written as .inspection.kts files and stored in an inspections directory within your project.
IntelliJ IDEA reads these files, compiles the Kotlin code on the fly, and executes them. FlexInspect uses the Program Structure Interface (PSI), which is an Abstract Syntax Tree (AST) representation of your source code. By traversing the PSI tree, your inspection can identify specific code patterns, nodes, and structures (like classes, methods, or imports) to validate or flag.
Taint analysis is a security process that traces the flow of untrusted user input (called a source) through a program to see if it reaches sensitive operations (called a sink) without proper validation or sanitization. This helps identify vulnerabilities like SQL injection, XSS, command injection, and path traversal.
Key components of the taint flow include:
By default, if no specific configuration exists for a library function, a projection is applied, meaning the taint status of the arguments is passed to the return value.
To manage technical debt effectively, combine the baseline and quality gate. This configuration ensures that Qodana only detects new problems (those not in the baseline) and fails the workflow if those new problems exceed the specified --fail-threshold.
- name: Qodana Scan
uses: %action-version%
with:
args: --baseline,qodana.sarif.json,--fail-threshold,<number-of-accepted-problems>
env:
QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}