Skip to content

Commit 6e5b004

Browse files
acgetchellacgetchell
committed
Changed: Improves code quality with Codacy and stricter lints
Adds Codacy configuration for static analysis and security scanning, and enables stricter Rust lints (pedantic, nursery, cargo) to improve code quality and maintainability. This change sets up automated code analysis with Codacy for improved code quality and security. Additionally, enables more restrictive lints in `clippy` to catch common code issues early. These changes are internal improvements.
1 parent b90468e commit 6e5b004

File tree

4 files changed

+256
-4
lines changed

4 files changed

+256
-4
lines changed

‎.codacy.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
---
2+
# Codacy configuration for la-stack project
3+
#
4+
# This repository is primarily Rust.
5+
# Note: clippy and rustfmt are not supported by Codacy and are handled by GitHub Actions CI.
6+
7+
engines:
8+
# === DOCUMENTATION / SCRIPTS ===
9+
markdownlint:
10+
enabled: true
11+
include_paths:
12+
- "**/*.md"
13+
config:
14+
file: ".markdownlint.json"
15+
16+
shellcheck:
17+
enabled: true
18+
include_paths:
19+
- "**/*.sh"
20+
config:
21+
shell: bash
22+
severity: warning
23+
include_code: true
24+
25+
# === RUST / SECURITY ===
26+
lizard:
27+
enabled: true
28+
include_paths:
29+
- "src/**/*.rs"
30+
- "tests/**/*.rs"
31+
- "examples/**/*.rs"
32+
- "benches/**/*.rs"
33+
config:
34+
languages: ["rust"]
35+
threshold:
36+
cyclomatic_complexity: 15
37+
token_count: 300
38+
nesting_depth: 5
39+
parameter_count: 5
40+
length: 1000
41+
42+
semgrep:
43+
enabled: true
44+
include_paths:
45+
- "src/**/*.rs"
46+
- "tests/**/*.rs"
47+
- "examples/**/*.rs"
48+
- "benches/**/*.rs"
49+
50+
trivy:
51+
enabled: true
52+
config:
53+
severity: ["HIGH", "CRITICAL"]
54+
skip_dev_dependencies: true
55+
enable_secret_scanning: true
56+
57+
# === DUPLICATION DETECTION ===
58+
duplication:
59+
enabled: true
60+
config:
61+
minimum_mass: 60
62+
minimum_tokens: 80
63+
exclude_paths:
64+
- "target/**"
65+
- "coverage/**"
66+
- "benches/**"
67+
- "examples/**"
68+
- "tests/**"
69+
70+
# === GLOBAL EXCLUSIONS ===
71+
exclude_paths:
72+
- "target/**"
73+
- "coverage/**"
74+
- "Cargo.lock"
75+
- ".git/**"
76+
- ".cspellcache"
77+
- ".DS_Store"
78+
79+
# Focus analysis on source, docs, and CI configuration
80+
include_paths:
81+
- "src/**"
82+
- "benches/**"
83+
- "examples/**"
84+
- "tests/**"
85+
- "Cargo.toml"
86+
- "rust-toolchain.toml"
87+
- "rustfmt.toml"
88+
- "justfile"
89+
- ".github/**"
90+
- "*.md"
91+
- "*.yml"
92+
- "*.yaml"
93+
- "*.json"
94+
- ".markdownlint.json"
95+
- "cspell.json"
96+
- ".codecov.yml"
97+
98+
# Custom file extensions per language (Codacy schema compliant)
99+
languages:
100+
rust:
101+
extensions:
102+
- ".rs"
103+
markdown:
104+
extensions:
105+
- ".md"
106+
yaml:
107+
extensions:
108+
- ".yml"
109+
- ".yaml"
110+
json:
111+
extensions:
112+
- ".json"
113+
shell:
114+
extensions:
115+
- ".sh"

‎.github/workflows/codacy.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow checks out code, performs a Codacy security scan
7+
# and integrates the results with the
8+
# GitHub Advanced Security code scanning feature.
9+
# For more information on the Codacy security scan action usage and
10+
# parameters, see https://github.com/codacy/codacy-analysis-cli-action.
11+
# For more information on Codacy Analysis CLI in general, see
12+
# https://github.com/codacy/codacy-analysis-cli.
13+
14+
name: Codacy Security Scan
15+
16+
concurrency:
17+
# This concurrency group ensures that only one Codacy analysis runs at a time
18+
group: codacy-${{ github.ref_name }}
19+
cancel-in-progress: true
20+
21+
on:
22+
push:
23+
branches: ["main"]
24+
pull_request:
25+
# The branches below must be a subset of the branches above
26+
branches: ["main"]
27+
schedule:
28+
- cron: '42 0 * * 1'
29+
workflow_dispatch:
30+
31+
permissions:
32+
contents: read
33+
34+
jobs:
35+
codacy-security-scan:
36+
permissions:
37+
# for actions/checkout to fetch code
38+
contents: read
39+
# for github/codeql-action/upload-sarif to upload SARIF results
40+
security-events: write
41+
# only required for a private repository by
42+
# github/codeql-action/upload-sarif to get the Action run status
43+
actions: read
44+
name: Codacy Security Scan
45+
runs-on: ubuntu-latest
46+
timeout-minutes: 30
47+
steps:
48+
# Checkout the repository to the GitHub Actions runner
49+
- name: Checkout code
50+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
51+
52+
- name: Set Codacy paths
53+
run: |
54+
set -euo pipefail
55+
echo "CODACY_WORKDIR=$RUNNER_TEMP/codacy-src" >> "$GITHUB_ENV"
56+
echo "CODACY_SARIF=$RUNNER_TEMP/results.sarif" >> "$GITHUB_ENV"
57+
58+
- name: Prepare workspace copy without .git
59+
run: |
60+
set -euo pipefail
61+
mkdir -p "$CODACY_WORKDIR"
62+
rsync -a --delete --exclude '.git' ./ "$CODACY_WORKDIR/"
63+
64+
# Execute Codacy Analysis CLI and generate a SARIF output with
65+
# the security issues identified during the analysis
66+
- name: Run Codacy Analysis CLI
67+
uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08
68+
with:
69+
# Check https://github.com/codacy/codacy-analysis-cli#project-token
70+
# to get your project token from your Codacy repository.
71+
# You can also omit the token and run the tools that support
72+
# default configurations
73+
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
74+
verbose: true
75+
directory: ${{ env.CODACY_WORKDIR }}
76+
output: ${{ env.CODACY_SARIF }}
77+
format: sarif
78+
skip-uncommitted-files-check: true
79+
# Adjust severity of non-security issues
80+
gh-code-scanning-compat: true
81+
# Force 0 exit code to allow SARIF file generation
82+
# This will handover control about PR rejection to the GitHub side
83+
max-allowed-issues: 2147483647
84+
85+
# Process SARIF file to split by tool
86+
- name: Split SARIF by tool
87+
run: |
88+
# Fail fast and surface errors clearly
89+
set -euo pipefail
90+
if [ -f "$CODACY_SARIF" ] && [ -s "$CODACY_SARIF" ]; then
91+
echo "$CODACY_SARIF present; preselecting for upload and skipping split."
92+
echo "SARIF_FILE=$CODACY_SARIF" >> "$GITHUB_ENV"
93+
exit 0
94+
else
95+
echo "No SARIF file found or file is empty: $CODACY_SARIF"
96+
echo "Creating empty SARIF file to prevent workflow failure"
97+
# Create empty SARIF file with proper schema
98+
schema_url="https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
99+
empty_sarif="$RUNNER_TEMP/sarif_empty.sarif"
100+
{
101+
echo '{'
102+
echo " \"\$schema\": \"$schema_url\","
103+
echo ' "version": "2.1.0",'
104+
echo ' "runs": []'
105+
echo '}'
106+
} > "$empty_sarif"
107+
# Mark the empty SARIF for upload
108+
echo "SARIF_FILE=$empty_sarif" >> "$GITHUB_ENV"
109+
exit 0
110+
fi
111+
112+
# Select SARIF file for upload
113+
- name: Select SARIF file for upload
114+
run: |
115+
set -euo pipefail
116+
# Honor preselected SARIF_FILE from earlier steps (e.g., empty SARIF case)
117+
if [ -n "${SARIF_FILE:-}" ]; then
118+
echo "Preselected SARIF_FILE=$SARIF_FILE; not overriding."
119+
exit 0
120+
fi
121+
# First, try to upload the original SARIF file if it exists
122+
if [ -f "$CODACY_SARIF" ] && [ -s "$CODACY_SARIF" ]; then
123+
echo "Found $CODACY_SARIF, attempting upload..."
124+
echo "SARIF_FILE=$CODACY_SARIF" >> "$GITHUB_ENV"
125+
else
126+
echo "No valid SARIF files found"
127+
echo "SARIF_FILE=" >> "$GITHUB_ENV"
128+
fi
129+
continue-on-error: true
130+
131+
# Upload the identified SARIF file
132+
- name: Upload identified SARIF file
133+
if: always() && env.SARIF_FILE != ''
134+
uses: github/codeql-action/upload-sarif@b36bf259c813715f76eafece573914b94412cd13 # v3
135+
with:
136+
sarif_file: ${{ env.SARIF_FILE }}
137+
continue-on-error: true

‎justfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ clean:
5050

5151
# Code quality and formatting
5252
clippy:
53-
cargo clippy --all-targets --all-features -- -D warnings
53+
cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery -W clippy::cargo
5454

5555
# Pre-commit workflow: comprehensive validation before committing
5656
# Runs: linting + all Rust tests (lib + doc + integration) + examples

‎src/matrix.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ impl<const D: usize> Matrix<D> {
5656
/// assert_eq!(i.get(2, 2), Some(1.0));
5757
/// ```
5858
#[inline]
59-
pub fn identity() -> Self {
59+
pub const fn identity() -> Self {
6060
let mut m = Self::zero();
6161

6262
let mut i = 0;
@@ -81,7 +81,7 @@ impl<const D: usize> Matrix<D> {
8181
/// ```
8282
#[inline]
8383
#[must_use]
84-
pub fn get(&self, r: usize, c: usize) -> Option<f64> {
84+
pub const fn get(&self, r: usize, c: usize) -> Option<f64> {
8585
if r < D && c < D {
8686
Some(self.rows[r][c])
8787
} else {
@@ -104,7 +104,7 @@ impl<const D: usize> Matrix<D> {
104104
/// assert!(!m.set(10, 0, 1.0));
105105
/// ```
106106
#[inline]
107-
pub fn set(&mut self, r: usize, c: usize, value: f64) -> bool {
107+
pub const fn set(&mut self, r: usize, c: usize, value: f64) -> bool {
108108
if r < D && c < D {
109109
self.rows[r][c] = value;
110110
true

0 commit comments

Comments
 (0)