Qodana Scan

To run Qodana on a GitHub repository, create a workflow file at .github/workflows/code_quality.yml.

Key Requirements:

• Permissions: The job must have contents: write, pull-requests: write, and checks: write permissions.
• Checkout: Use actions/checkout@v3 with fetch-depth: 0 to ensure a full history is available for pull request analysis.
• Authentication: You must provide a QODANA_TOKEN as an environment variable. This token should be stored as an encrypted secret in your GitHub repository settings.

This configuration allows Qodana to run on the main branch, release branches, and pull requests.

name: Qodana
on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
      - 'releases/*'

jobs:
  qodana:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      checks: write
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.2
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}

Use a baseline to ignore existing technical debt and a quality gate to prevent new issues from being introduced.

How to establish a baseline:

1. Run Qodana locally: qodana scan --show-report.
2. Open the report at http://localhost:8080/, add existing problems to the baseline, and download the qodana.sarif.json file.
3. Upload qodana.sarif.json to your project root on GitHub.
4. Update your GitHub Action configuration to use the baseline via the args parameter:

- name: Qodana Scan
  uses: JetBrains/qodana-action@main
  with:
    args: --baseline,qodana.sarif.json

How to add a quality gate: Add the fail-threshold property to your workflow configuration. This defines the maximum number of new problems allowed before the workflow fails and blocks the pull request.

- name: Qodana Scan
  uses: JetBrains/qodana-action@main
  with:
    args: --baseline,qodana.sarif.json
    fail-threshold: <number-of-accepted-problems>

To perform incremental analysis on Pull Requests (reporting only problems introduced by the PR), you must configure the pipeline to use prMode: true.

Important: Azure Pipelines typically checks out an ephemeral merge commit for PR builds. To ensure Qodana correctly identifies the source-branch head (and avoids reporting unrelated changes from the target branch), you must manually check out the PR source commit using git checkout $(System.PullRequest.SourceCommitId) before running the scan.

Requirements:

• fetchDepth: 0 must be set in the checkout step.
• persistCredentials: true should be set in the checkout step.
• prMode: true must be set in the QodanaScan@2026 task inputs.

pr:
  branches:
    include:
      - '*'

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self
    fetchDepth: 0
    persistCredentials: true
  - script: git checkout $(System.PullRequest.SourceCommitId)
    condition: eq(variables['Build.Reason'], 'PullRequest')
    displayName: Check out PR source commit (not the merge commit)
  - task: QodanaScan@2026
    env:
      QODANA_TOKEN: $(QODANA_TOKEN)
    inputs:
      prMode: true

Qodana can automatically fix identified issues and push those changes back to your repository. To enable this, follow these steps:

1. Choose a strategy:
   • Use the args property in the task with --apply-fixes or --cleanup.
   • Alternatively, specify fixesStrategy in your repository's qodana.yaml file.
2. Set the push mode: Set the pushFixes input to either:
   • pull-request: Creates a new branch with fixes and opens a PR.
   • branch: Pushes fixes directly to the original branch.
3. Configure Permissions: In Azure DevOps, go to Repositories → Manage repositories → Security. For the Qodana for Azure Pipelines Build Service user, allow:
   • Contribute
   • Bypass policies when pushing (to ensure fixes aren't blocked by branch policies)
   • Create branch (if using pull-request mode)
4. Enable Credentials: Set persistCredentials: true in your checkout step to allow the task to push changes.

steps:
  - checkout: self
    fetchDepth: 0
    persistCredentials: true
  - task: QodanaScan@2026
    env:
      QODANA_TOKEN: $(QODANA_TOKEN)
    inputs:
      pushFixes: "branch"
      args: "--apply-fixes"