Welcome to Qodana Discussions!

[tiulpin]

👋 Welcome!

Hello, Qodana community! We've decided to switch to GitHub Discussions instead of Slack to better connect with our community, as it's easier to sign up, and discussions won't get so easily lost. We hope that you'll:

• Ask questions.
• Share your ideas and suggestions.
• Give community members a hand.
• Welcome others and stay open-minded. Remember that we are building this community together. 💪

💡 To contact the Qodana support, please use [email protected]. To file an issue (bug, problem), please proceed to https://jb.gg/qodana-issue

To get started, drop a comment below with an introduction of yourself and tell us about your experience with Qodana!

[shaqman]

Hi there,

I'm still trying out qodana, but plan to be using it in the company's pipeline as part of a quality check

[nickalexander-disco]

Hi Everyone, Im trying to come up with a solution to identify all database related references in code for a project around automatically identifying communities of DB objects and code artefacts across our entire code base. Need to identify JPA/ Hibernate or other ORM reference literal SQL statements and everything in-between. Some form of static code analysis seems to be the answer or to use distributed tracing was wondering if there is any way to achieve this using Qodana?

[avafanasiev]

Hi! I think the best we can offer is writing custom inspections.
There are two ways for it: structural search and custom plugins. Structural search is a quite fast way but i'm not sure if it suits your needs. Functionality is quite limited, but it can detect specific function calls or specific expressions.
The over way is writing plugin with your own custom inspections. It is very powerful way, you will have all possible information IDEA Ultimate have, and it knows a lot, for example about sql code injections. So, i'm pretty sure you can achieve whatever you wish, but you got to be ready for significant amount of programming and working with intellij platform API.

[nickalexander-disco]

Thanks Alexey, Pretty much what I was thinking, will try the custom inspections route. NIck From: Alexey Afanasiev ***@***.***> Date: Thursday, 24 November 2022 at 16:25 To: JetBrains/Qodana ***@***.***> Cc: Nick Alexander ***@***.***>, Comment ***@***.***> Subject: Re: [JetBrains/Qodana] Welcome to Qodana Discussions! (Discussion #48) [Email from external sender. Proceed with caution.] Hi! I think the best we can offer is writing custom inspections<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.jetbrains.com%2Fhelp%2Fidea%2Fcreating-custom-inspections.html&data=05%7C01%7CNickA%40discovery.co.za%7Cbccbb1bc32444a2b9d3708dace27adac%7C710b1675b8704652b453d417a82a0b6f%7C0%7C0%7C638048967082225017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=6nMGT4thkaUJA52A6VQi%2Fum1XyRifB6R%2BerGw3wnQwY%3D&reserved=0>. There are two ways for it: structural search and custom plugins. Structural search is a quite fast way but i'm not sure if it suits your needs. Functionality is quite limited, but it can detect specific function calls or specific expressions. The over way is writing plugin with your own custom inspections. It is very powerful way, you will have all possible information IDEA Ultimate have, and it knows a lot, for example about sql code injections<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.jetbrains.com%2Fhelp%2Fidea%2Fusing-language-injections.html&data=05%7C01%7CNickA%40discovery.co.za%7Cbccbb1bc32444a2b9d3708dace27adac%7C710b1675b8704652b453d417a82a0b6f%7C0%7C0%7C638048967082225017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=mFyqnmgaoHyqXf2HI7vrFRQY9PSshsvjw5XhWmtkVWA%3D&reserved=0>. So, i'm pretty sure you can achieve whatever you wish, but you got to be ready for significant amount of programming<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FJetBrains%2Fintellij-sdk-code-samples%2Ftree%2Fmain%2Fcomparing_references_inspection&data=05%7C01%7CNickA%40discovery.co.za%7Cbccbb1bc32444a2b9d3708dace27adac%7C710b1675b8704652b453d417a82a0b6f%7C0%7C0%7C638048967082225017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Gg1yQR0nWtCUXOOZ5Czc%2BrB3VD662l7Au98UCWY%2BA%2BQ%3D&reserved=0> and working with intellij platform API<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplugins.jetbrains.com%2Fdocs%2Fintellij%2Fcode-inspections.html%23creating-an-inspection&data=05%7C01%7CNickA%40discovery.co.za%7Cbccbb1bc32444a2b9d3708dace27adac%7C710b1675b8704652b453d417a82a0b6f%7C0%7C0%7C638048967082225017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=9ETIdH6jh%2F15z8mGSzXXcAPnkNsi%2BbxTuKSxd8NpMwA%3D&reserved=0>. — Reply to this email directly, view it on GitHub<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FJetBrains%2FQodana%2Fdiscussions%2F48%23discussioncomment-4226609&data=05%7C01%7CNickA%40discovery.co.za%7Cbccbb1bc32444a2b9d3708dace27adac%7C710b1675b8704652b453d417a82a0b6f%7C0%7C0%7C638048967082225017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=6DPROX2KeCD0QFSe04p5m0g6sowM7PK7vI7M5nH8Jq4%3D&reserved=0>, or unsubscribe<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAUSLG4HYW5ROY2ONPRSYL5DWJ5ZPTANCNFSM5L6ZLGUA&data=05%7C01%7CNickA%40discovery.co.za%7Cbccbb1bc32444a2b9d3708dace27adac%7C710b1675b8704652b453d417a82a0b6f%7C0%7C0%7C638048967082225017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=oVlPcqrHlLQrKX7QcwQymK1%2F1yV0crb0Mmp4QBu%2BZOg%3D&reserved=0>. You are receiving this because you commented.Message ID: ***@***.***> Discovery Limited is the licensed controlling company of the designated Discovery Insurance Group. Registration number: 1999/007789/06. Companies in the Group are licensed insurers and authorised financial services providers. The information in this email is confidential and may have legal privileges. We intend it only for the use of the individual or entity we've addressed the communication to. If you have received this email by mistake please delete it and tell the sender. We forbid any unauthorised use, change, disclosure or sending of the contents of this email (including its attachments), whether in part or as a whole, unless consented to in writing by the sender, as it may be unlawful. We cannot guarantee this email has no malicious coding. We reserve the right to check, intercept and block emails or take any other action according to our email etiquette. Discovery will not be liable for any delivery delay, loss, harm, disruption or data corruption that may arise from this email. A full list of company directors is available on our website at: https://www.discovery.co.za/corporate/investor-relations <https://www.discovery.co.za/corporate/investor-relations> - or to get this list by email, please email ***@***.*** ***@***.***>

[bvanhorn-clear]

Hello! I'm trying out the cloud offering. I'm running the analysis in Docker on my computer and the results are transmitted to the cloud. It's all working fine. My question is why am I required to give JetBrains access to my repositories? If the scan happens on my computer, y'all shouldn't need my code. It seems really risky to give y'all a public key tied to my account. If I put on my tin-foil hat, I'd be tempted to point out that anybody with access at JetBrains could, in theory, pull my work anytime you wanted for purposes beyond analysis.

[brichbash]

Hello,
I understand your concerns.
The SSH connection is needed only to get meta information from your repository: the number of active contributors for the last 90 days. Our subscription price is based on that information, and we don't pull any code from the user repositories.
We're also working on an on-premises solution for Qodana, which is planned for mid-2024. It won't require the connection, although it will have a different licensing logic and pricing.
Currently, you can use Qodana without Qodana Cloud if you use our community and EAP linters, they are free.

[alapierre]

Why linter on BitBucket pipeline starts so long... and finally failed?

5m 30 sec to read simple yaml file (20 lines)?

Starting up Qodana for JVM 2023.3 (build QDJVM-233.14244.182)…done.
Preparing for the Project opening stage ...
Opening project…done.
The Project opening stage completed in 10s
Initializing project…Inspecting with the 'qodana.starter' profile
Preparing for the Project configuration stage ...
Keep running Project configuration ... so far 30s
Keep running Project configuration ... so far 1m
Keep running Project configuration ... so far 1m 30s
Keep running Project configuration ... so far 2m
Keep running Project configuration ... so far 2m 30s
Keep running Project configuration ... so far 3m
Keep running Project configuration ... so far 3m 30s
Keep running Project configuration ... so far 4m
Keep running Project configuration ... so far 4m 30s
Keep running Project configuration ... so far 5m
Keep running Project configuration ... so far 5m 30s
Detected 0 package.json files under the project to install dependencies
The Project configuration stage completed in 5m 52s
Preparing for the Project analysis stage ...
Keep running Project analysis ... so far 30s
Analyzing code 1%
Analyzing code 2%
Analyzing code 3%
Analyzing code 4%
Analyzing code 5%
Analyzing code 6%
Analyzing code 7%
Analyzing code 8%
The Project analysis stage completed in 58s

and finally it fails:

2024-02-15 06:46:49,627 [ 436787] SEVERE - #c.i.c.InspectionApplicationBase - /opt/atlassian/pipelines/agent/build/.qodana/cache/idea/233/.port (No such device or address)
java.io.FileNotFoundException: /opt/atlassian/pipelines/agent/build/.qodana/cache/idea/233/.port (No such device or address)

pipeline step looks like this:

      - step:
          name: Qodana
          caches:
            - qodana
          image: jetbrains/qodana-jvm:latest
          script:
            - export QODANA_TOKEN=$QODANA_TOKEN  # Export the environment variable
            - qodana --results-dir=$BITBUCKET_CLONE_DIR/.qodana --report-dir=$BITBUCKET_CLONE_DIR/.qodana/report --cache-dir=$BITBUCKET_CLONE_DIR/.qodana/cache
          artifacts:
            - .qodana/report

[ddysmhz]

Hi,
How to config mapping path in qodana coverage directory?, i'm using qodana-cli to integrate my pipeline using qodana and scanning new codes, i have specific path jacoco report using qodana-jvm. But when check the dashboard still got code coverage not set.
This is qodana-cli i have used.
qodana scan --source-directory services --diff-start=first head_commit --diff-end=last_commit --coverage-dir=./build/reports/jacoco/test

and this is qodana.yaml for config
linter: jetbrains/qodana-jvm:2024.1
projectJDK: 11
profile:
name: qodana.recommended.full
exclude:

name: All
paths:
src/test/**/*
include:
name: Eslint
name: GrazieInspection
name: IdentifierGrammar
name: LanguageDetectionInspection
name: CheckDependencyLicenses
Can i got the insight for solved this debug?

Thankyou