ci: add Codecov, Snyk, SonarCloud and Codacy badges by EquityBot · Pull Request #25 · EquityBot/Puritanical

EquityBot · 2026-10-31T23:24:23Z

Summary

Brings this repository's badges up to the maintainer's other account: Codecov coverage, a Snyk scan, SonarCloud and Codacy, and fixes static-analysis findings.

publish.yml (grants id-token, so the called workflow may use it)
└── test.yml
    ├── test     permissions: contents: read
    └── codecov  permissions: contents: read, id-token: write

tests/package-scripts.test.js checks each job's permissions separately. 5 regexes that could take quadratic time are now linear, with regression tests. CI's Python packages are pinned, installed wheels-only and scanned by Snyk and Dependabot.

Evidence

npm test passes on Linux Node 22; the coverage run and contract test pass.
The contract test failed under 4 deliberate permission breakages.
The new statusLine regex matched the old one on 200,000 random commands; its regression test fails on the old code.

Merge danger

Door: two-way. Blast radius: CI

The OIDC token is granted only to the separate codecov job, which continues on error, so a Codecov outage cannot turn the tests badge red.

Unverified

The changed workflows have not run yet; this PR's own run is the first.
Codecov has not yet received an OIDC upload for this repository.
Wheel-only installation of the pinned Python packages has not run on all 3 CI platforms.

The Linux test leg writes an lcov report and a separate codecov job uploads it with OIDC. publish.yml grants the called test.yml id-token so it can start; the codecov job skips publish runs and the test job keeps contents: read, which the workflow contract test now checks. Snyk tests the Rust tools' Cargo graph as a CycloneDX SBOM weekly and when tools/Cargo.toml or Cargo.lock changes.

SonarQube Cloud flagged 4 regexes with super-linear backtracking. The Ruby and JVM map patterns let a leading \s* cross blank lines, so a 64 KiB file of them took seconds; the deactivation check stripped trailing punctuation with an unanchored pattern; the benchmark's numbered-list check rescanned digit runs. Each now runs in linear time, with a regression test that fails on the old pattern. The CI install of pandas and pyyaml now takes wheels only, so no setup script runs.

pandas, pyyaml and their dependencies are pinned in .github/ci/requirements.txt, installed as wheels only. Snyk tests the set through its pip support and Dependabot keeps the pins current.

test.yml's test job now declares contents: read itself, so the id-token publish.yml grants the called workflow reaches only the codecov job. The workflow contract test checks each job's permissions in both files. The codecov job continues on error, so a Codecov outage cannot turn the tests badge red; the upload still fails its own job. The statusline path regex starts its unquoted form only at a word start, so a long statusLine command no longer takes quadratic time.

codacy-production · 2026-10-31T23:26:00Z

Not up to standards ⛔

🔴 Issues 4 critical · 1 high

Alerts:
⚠ 5 issues (≤ 0 issues of at least minor severity)

Results:
5 new issues

Category Results

Security 4 critical
1 high

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

👀 Worth a closer look

The review found no high-confidence blocking defect. The Ubuntu workflow now exercises a narrower test command than the other matrix jobs, so the coverage-producing path may omit repository-level checks. The modified workflows and OIDC/Snyk behavior also lack automated validation.

The map regex has a potential backtracking risk on adversarial input; this warrants review, particularly before processing large untrusted files.

Test suggestions

Verify each workflow job has the intended permissions and that only Codecov requests id-token access.
Verify the Codecov job is gated appropriately, downloads the coverage artifact, and invokes the OIDC upload.
Verify Snyk workflow target parsing, missing-token failure, Python installation, and Rust SBOM scanning behavior.
Verify deactivation-command matching rejects embedded commands and remains fast on long punctuation input.
Verify status-line detection remains fast on long commands and preserves safe, absolute-path behavior.
Verify behavior and codebase-map regexes remain linear on long inputs and still detect indented declarations.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the Codecov job is gated appropriately, downloads the coverage artifact, and invokes the OIDC upload.
2. Verify Snyk workflow target parsing, missing-token failure, Python installation, and Rust SBOM scanning behavior.

Low confidence findings

The external analysis badges should be backed by verified repository integrations or documented as dependent on configuration outside this change; their working status is not demonstrated here.

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-10-31T23:26:20Z

+      - name: Run tests with line coverage
+        if: matrix.os == 'ubuntu-latest'
+        run: >-
+          node --test --experimental-test-coverage
+          --test-coverage-exclude='tests/**' --test-coverage-exclude='pi-extension/test/**'
+          --test-reporter=spec --test-reporter-destination=stdout
+          --test-reporter=lcov --test-reporter-destination=coverage.lcov
+          tests/*.test.js pi-extension/test/*.test.js


_{🟡 MEDIUM RISK}

Run the full test suite on Ubuntu as well, while separately collecting Node coverage, or explicitly add the omitted correctness checks so the coverage runner does not exercise a reduced suite.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-10-31T23:26:20Z

+  // [ \t]* rather than \s*: \s also matches newlines, so a run of blank lines cost
+  // quadratic time.
+  rb: [/^[ \t]*(?:def|class|module)\s+([A-Za-z][\w.]*)/gm],
+  jvm: [/^[ \t]*(?:public\s+)?(?:static\s+)?(?:final\s+)?(?:class|interface|enum|record)\s+(\w+)/gm],


_{🔴 HIGH RISK}

Suggestion: Refactor this declaration matcher to avoid chained optional groups and unbounded backtracking while preserving indented declaration detection. Add regression coverage for long adversarial non-matching input.

See Issue in Codacy

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

pip now installs .github/ci/requirements.txt with --require-hashes, with every wheel's hash for Linux, macOS and Windows (SonarCloud S8544).

sonarqubecloud · 2026-10-31T23:52:10Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

ryanduguid added 4 commits November 1, 2026 08:34

ci: pin the CI's Python packages and scan them with Snyk

183b3cd

pandas, pyyaml and their dependencies are pinned in .github/ci/requirements.txt, installed as wheels only. Snyk tests the set through its pip support and Dependabot keeps the pins current.

codacy-production Bot reviewed Oct 31, 2026

View reviewed changes

ci: hash-lock the CI's Python packages

81ac9c5

pip now installs .github/ci/requirements.txt with --require-hashes, with every wheel's hash for Linux, macOS and Windows (SonarCloud S8544).

EquityBot merged commit f6ecc76 into main Nov 1, 2026
14 of 15 checks passed

EquityBot deleted the ryan/badges-parity branch November 1, 2026 01:33

Navigation Menu

Repository navigation

ci: add Codecov, Snyk, SonarCloud and Codacy badges - #25

ci: add Codecov, Snyk, SonarCloud and Codacy badges#25
EquityBot merged 5 commits into
mainfrom
ryan/badges-parity

EquityBot commented Oct 31, 2026

Uh oh!

codacy-production Bot commented Oct 31, 2026

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot Oct 31, 2026

Uh oh!

codacy-production Bot Oct 31, 2026

Uh oh!

sonarqubecloud Bot commented Oct 31, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

EquityBot commented Oct 31, 2026

Summary

Evidence

Merge danger

Unverified

Uh oh!

codacy-production Bot commented Oct 31, 2026

Not up to standards ⛔

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

Test suggestions

Uh oh!

codacy-production Bot Oct 31, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Oct 31, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Oct 31, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants