Repository: ffcoders/vigilant-umbrella
Pull request #15: Update workflows for Dependabot, Codacy, and SonarQube
Author: login: alextcf
Created: 2025-04-12T10:33:13Z | Merged: 2025-04-12T11:33:29Z

- Refactored `dependabot.yml` to include version update triggers and improved formatting.
- Added `codacy.yml` for security scanning workflow on push and pull requests, with necessary permissions and steps.
- Introduced `sonar.yml` for SonarQube analysis, including setup for JDK 17 and caching mechanisms.


Diff:
diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml
new file mode 100644
index 0000000..a5ce638
--- /dev/null
+++ b/.github/workflows/codacy.yml
@@ -0,0 +1,94 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow checks out code, performs a Codacy security scan
+# and integrates the results with the
+# GitHub Advanced Security code scanning feature.  For more information on
+# the Codacy security scan action usage and parameters, see
+# https://github.com/codacy/codacy-analysis-cli-action.
+# For more information on Codacy Analysis CLI in general, see
+# https://github.com/codacy/codacy-analysis-cli.
+
+name: Codacy Security Scan
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '40 10 * * 6'
+
+permissions:
+  contents: read
+
+jobs:
+  codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Codacy Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Setup .NET for testing
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 9.0.x
+
+      # Restore dependencies
+      - name: Restore dependencies
+        run: dotnet restore src
+
+      # Build
+      - name: Build
+        run: dotnet build src --no-restore
+
+      # Run tests with coverage
+      - name: Test with coverage
+        run: dotnet test src --no-build --verbosity normal --collect:"XPlat Code Coverage" --results-directory ./coverage
+
+      # Install dotnet-coverage
+      - name: Install dotnet-coverage
+        run: dotnet tool install --global dotnet-coverage
+
+      # Generate coverage report in Cobertura format for Codacy
+      - name: Generate Cobertura coverage report
+        run: dotnet-coverage merge -f cobertura -o coverage.cobertura.xml coverage/**/*.xml
+
+      # Upload coverage to Codacy
+      - name: Upload coverage to Codacy
+        uses: codacy/codacy-coverage-reporter-action@v1
+        with:
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          coverage-reports: coverage.cobertura.xml
+
+      # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
+      - name: Run Codacy Analysis CLI
+        uses: codacy/codacy-analysis-cli-action@master
+        with:
+          # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
+          # You can also omit the token and run the tools that support default configurations
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          verbose: true
+          output: results.sarif
+          format: sarif
+          # Adjust severity of non-security issues
+          gh-code-scanning-compat: true
+          # Force 0 exit code to allow SARIF file generation
+          # This will handover control about PR rejection to the GitHub side
+          max-allowed-issues: 2147483647
+
+      # Upload the SARIF file generated in the previous step
+      - name: Upload SARIF results file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
\ No newline at end of file
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 8ca517d..332d313 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -1,11 +1,16 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+# To get started with Dependabot version updates, you'll need to specify which  
+# package ecosystems to update and where the package manifests are located.  
+# Please see the documentation for all configuration options:  
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file  
 
-version: 2
-updates:
-  - package-ecosystem: "nuget" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "weekly"
+on:  
+ push:  
+   branches:  
+     - main  
+
+version: 2  
+updates:  
+ - package-ecosystem: "nuget" # See documentation for possible values  
+   directory: "/" # Location of package manifests  
+   schedule:  
+     interval: "weekly"
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 0000000..a477df2
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,65 @@
+name: SonarCloud
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+jobs:
+  build:
+    name: Build and analyze
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: 'zulu' # Alternative distribution options are available.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+
+      - name: Set up .NET 9
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: '9.0.x'
+
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
+      - name: Cache SonarCloud scanner
+        id: cache-sonar-scanner
+        uses: actions/cache@v4
+        with:
+          path: ./.sonar/scanner
+          key: ${{ runner.os }}-sonar-scanner
+          restore-keys: ${{ runner.os }}-sonar-scanner
+
+      - name: Install SonarCloud scanner
+        if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p ./.sonar/scanner
+          dotnet tool update dotnet-sonarscanner --tool-path ./.sonar/scanner
+
+      - name: Build and analyze
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          dotnet tool install --global dotnet-coverage
+
+          ./.sonar/scanner/dotnet-sonarscanner begin /k:"ffcoders_vigilant-umbrella" /o:"ffcoders" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml /d:sonar.tests="src/vigilant-umbrella-test" /d:sonar.scanner.scanAll=false
+
+          dotnet build src/vigilant-umbrella.sln
+          dotnet-coverage collect 'dotnet test src/vigilant-umbrella.sln' -f xml -o 'coverage.xml'
+
+          ./.sonar/scanner/dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
\ No newline at end of file


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-12T10:34:17Z
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-12T10:51:32Z
user: login: copilot-pull-request-reviewer[bot]
body: 

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.




state: COMMENTED
author_association: NONE
submitted_at: 2025-04-12T11:18:02Z
user: login: alextcf
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-12T11:20:36Z
user: login: codacy-production[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-12T11:30:55Z
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-12T11:31:54Z

Review comments:
diff_hunk: @@ -0,0 +1,47 @@
+name: SonarQube
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+jobs:
+  build:
+    name: Build and analyze
+    runs-on: windows-latest
+    steps:
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: 'zulu' # Alternative distribution options are available.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - name: Cache SonarQube Cloud packages
+        uses: actions/cache@v4
+        with:
+          path: ~\sonar\cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+      - name: Cache SonarQube Cloud scanner
+        id: cache-sonar-scanner
+        uses: actions/cache@v4
+        with:
+          path: .\.sonar\scanner
+          key: ${{ runner.os }}-sonar-scanner
+          restore-keys: ${{ runner.os }}-sonar-scanner
+      - name: Install SonarQube Cloud scanner
+        if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
+        shell: powershell
+        run: |
+          New-Item -Path .\.sonar\scanner -ItemType Directory
+          dotnet tool update dotnet-sonarscanner --tool-path .\.sonar\scanner
+      - name: Build and analyze
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        shell: powershell
+        run: |
+          .\.sonar\scanner\dotnet-sonarscanner begin /k:"ffcoders_vigilant-umbrella" /o:"ffcoders" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io"
+          dotnet build src
+          .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
path: .github/workflows/sonar.yml
user: login: github-advanced-security[bot]
body: ## Workflow does not contain permissions

Actions Job or Workflow does not set permissions

[Show more details](https://github.com/ffcoders/vigilant-umbrella/security/code-scanning/2)
created_at: 2025-04-12T10:34:17Z
author_association: NONE
diff_hunk: @@ -0,0 +1,60 @@
+name: SonarCloud
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+jobs:
+  build:
+    name: Build and analyze
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: 'zulu' # Alternative distribution options are available.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+
+      - name: Set up .NET 9
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: '9.0.x'
+
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
+      - name: Cache SonarCloud scanner
+        id: cache-sonar-scanner
+        uses: actions/cache@v4
+        with:
+          path: ./.sonar/scanner
+          key: ${{ runner.os }}-sonar-scanner
+          restore-keys: ${{ runner.os }}-sonar-scanner
+
+      - name: Install SonarCloud scanner
+        if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p ./.sonar/scanner
+          dotnet tool update dotnet-sonarscanner --tool-path ./.sonar/scanner
+
+      - name: Build and analyze
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          dotnet tool install --global dotnet-coverage
+
+          ./.sonar/scanner/dotnet-sonarscanner begin /k:"ffcoders_vigilant-umbrella" /o:"ffcoders" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml /d:sonar.tests="src/vigilant-umbrella-test"
+
+          dotnet build src/vigilant-umbrella.sln
+          dotnet-coverage collect 'dotnet test src/vigilant-umbrella.sln' -f xml -o 'coverage.xml'
+
+          ./.sonar/scanner/dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
path: .github/workflows/sonar.yml
user: login: github-advanced-security[bot]
body: ## Workflow does not contain permissions

Actions Job or Workflow does not set permissions

[Show more details](https://github.com/ffcoders/vigilant-umbrella/security/code-scanning/228)
created_at: 2025-04-12T10:51:32Z
author_association: NONE
diff_hunk: @@ -1,11 +1,16 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+# To get started with Dependabot version updates, you'll need to specify which  
+# package ecosystems to update and where the package manifests are located.  
+# Please see the documentation for all configuration options:  
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file  
 
-version: 2
-updates:
-  - package-ecosystem: "nuget" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "weekly"
+on:  
+ push:  
+   branches:  
+     - main  
path: .github/workflows/dependabot.yml
user: login: Copilot
body: Dependabot configuration is typically processed automatically and does not require an 'on:' event trigger. Consider removing the event trigger configuration to match the official Dependabot config format.
```suggestion
# Removed unnecessary 'on:' event trigger as Dependabot operates independently.
```
created_at: 2025-04-12T11:18:02Z
author_association: NONE
diff_hunk: @@ -0,0 +1,60 @@
+name: SonarCloud
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+jobs:
+  build:
+    name: Build and analyze
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: 'zulu' # Alternative distribution options are available.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+
+      - name: Set up .NET 9
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: '9.0.x'
+
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
+      - name: Cache SonarCloud scanner
+        id: cache-sonar-scanner
+        uses: actions/cache@v4
+        with:
+          path: ./.sonar/scanner
+          key: ${{ runner.os }}-sonar-scanner
+          restore-keys: ${{ runner.os }}-sonar-scanner
+
+      - name: Install SonarCloud scanner
+        if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p ./.sonar/scanner
+          dotnet tool update dotnet-sonarscanner --tool-path ./.sonar/scanner
+
+      - name: Build and analyze
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          dotnet tool install --global dotnet-coverage
+
+          ./.sonar/scanner/dotnet-sonarscanner begin /k:"ffcoders_vigilant-umbrella" /o:"ffcoders" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml /d:sonar.tests="src/vigilant-umbrella-test"
+
+          dotnet build src/vigilant-umbrella.sln
+          dotnet-coverage collect 'dotnet test src/vigilant-umbrella.sln' -f xml -o 'coverage.xml'
+
+          ./.sonar/scanner/dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
path: .github/workflows/sonar.yml
user: login: alextcf
body: Adicionada permissão
created_at: 2025-04-12T11:20:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,94 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow checks out code, performs a Codacy security scan
+# and integrates the results with the
+# GitHub Advanced Security code scanning feature.  For more information on
+# the Codacy security scan action usage and parameters, see
+# https://github.com/codacy/codacy-analysis-cli-action.
+# For more information on Codacy Analysis CLI in general, see
+# https://github.com/codacy/codacy-analysis-cli.
+
+name: Codacy Security Scan
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '40 10 * * 6'
+
+permissions:
+  contents: read
+
+jobs:
+  codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Codacy Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Setup .NET for testing
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 9.0.x
+
+      # Restore dependencies
+      - name: Restore dependencies
+        run: dotnet restore src
+
+      # Build
+      - name: Build
+        run: dotnet build src --no-restore
+
+      # Run tests with coverage
+      - name: Test with coverage
+        run: dotnet test src --no-build --verbosity normal --collect:"XPlat Code Coverage" --results-directory ./coverage
+
+      # Install dotnet-coverage
+      - name: Install dotnet-coverage
+        run: dotnet tool install --global dotnet-coverage
+
+      # Generate coverage report in Cobertura format for Codacy
+      - name: Generate Cobertura coverage report
+        run: dotnet-coverage merge -f cobertura -o coverage.cobertura.xml coverage/**/*.xml
+
+      # Upload coverage to Codacy
+      - name: Upload coverage to Codacy
+        uses: codacy/codacy-coverage-reporter-action@v1
+        with:
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          coverage-reports: coverage.cobertura.xml
+
+      # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
+      - name: Run Codacy Analysis CLI
+        uses: codacy/codacy-analysis-cli-action@master
path: .github/workflows/codacy.yml
user: login: codacy-production[bot]
body: :warning: **Codacy** found a **medium Security** issue: [An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.](https://app.codacy.com/gh/ffcoders/vigilant-umbrella/pull-requests/15)

The issue identified by the Semgrep linter is related to the use of the `codacy/codacy-analysis-cli-action@master` action. Using the `master` branch reference means that the action is not pinned to a specific version and could lead to unpredictable behavior if the action's code changes in the future. This is a security concern because it makes the workflow susceptible to breaking changes or vulnerabilities introduced in future commits. The best practice is to pin the action to a specific commit SHA to ensure that the workflow runs the same code every time.

To fix this issue, you should replace the `master` reference with the full-length commit SHA of the last known stable version of the action. Here's how you can modify the line:

```suggestion
        uses: codacy/codacy-analysis-cli-action@<full-length-commit-sha>
``` 

Make sure to replace `<full-length-commit-sha>` with the actual SHA of the commit you want to pin to.

---

 *This comment was generated by an experimental AI tool.*
created_at: 2025-04-12T11:30:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,94 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow checks out code, performs a Codacy security scan
+# and integrates the results with the
+# GitHub Advanced Security code scanning feature.  For more information on
+# the Codacy security scan action usage and parameters, see
+# https://github.com/codacy/codacy-analysis-cli-action.
+# For more information on Codacy Analysis CLI in general, see
+# https://github.com/codacy/codacy-analysis-cli.
+
+name: Codacy Security Scan
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '40 10 * * 6'
+
+permissions:
+  contents: read
+
+jobs:
+  codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Codacy Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Setup .NET for testing
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 9.0.x
+
+      # Restore dependencies
+      - name: Restore dependencies
+        run: dotnet restore src
+
+      # Build
+      - name: Build
+        run: dotnet build src --no-restore
+
+      # Run tests with coverage
+      - name: Test with coverage
+        run: dotnet test src --no-build --verbosity normal --collect:"XPlat Code Coverage" --results-directory ./coverage
+
+      # Install dotnet-coverage
+      - name: Install dotnet-coverage
+        run: dotnet tool install --global dotnet-coverage
+
+      # Generate coverage report in Cobertura format for Codacy
+      - name: Generate Cobertura coverage report
+        run: dotnet-coverage merge -f cobertura -o coverage.cobertura.xml coverage/**/*.xml
+
+      # Upload coverage to Codacy
+      - name: Upload coverage to Codacy
+        uses: codacy/codacy-coverage-reporter-action@v1
path: .github/workflows/codacy.yml
user: login: github-advanced-security[bot]
body: An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

[Show more details](https://github.com/ffcoders/vigilant-umbrella/security/code-scanning/229)
created_at: 2025-04-12T11:31:54Z
author_association: NONE
diff_hunk: @@ -0,0 +1,94 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow checks out code, performs a Codacy security scan
+# and integrates the results with the
+# GitHub Advanced Security code scanning feature.  For more information on
+# the Codacy security scan action usage and parameters, see
+# https://github.com/codacy/codacy-analysis-cli-action.
+# For more information on Codacy Analysis CLI in general, see
+# https://github.com/codacy/codacy-analysis-cli.
+
+name: Codacy Security Scan
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '40 10 * * 6'
+
+permissions:
+  contents: read
+
+jobs:
+  codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Codacy Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Setup .NET for testing
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 9.0.x
+
+      # Restore dependencies
+      - name: Restore dependencies
+        run: dotnet restore src
+
+      # Build
+      - name: Build
+        run: dotnet build src --no-restore
+
+      # Run tests with coverage
+      - name: Test with coverage
+        run: dotnet test src --no-build --verbosity normal --collect:"XPlat Code Coverage" --results-directory ./coverage
+
+      # Install dotnet-coverage
+      - name: Install dotnet-coverage
+        run: dotnet tool install --global dotnet-coverage
+
+      # Generate coverage report in Cobertura format for Codacy
+      - name: Generate Cobertura coverage report
+        run: dotnet-coverage merge -f cobertura -o coverage.cobertura.xml coverage/**/*.xml
+
+      # Upload coverage to Codacy
+      - name: Upload coverage to Codacy
+        uses: codacy/codacy-coverage-reporter-action@v1
+        with:
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          coverage-reports: coverage.cobertura.xml
+
+      # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
+      - name: Run Codacy Analysis CLI
+        uses: codacy/codacy-analysis-cli-action@master
path: .github/workflows/codacy.yml
user: login: github-advanced-security[bot]
body: An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

[Show more details](https://github.com/ffcoders/vigilant-umbrella/security/code-scanning/230)
created_at: 2025-04-12T11:31:54Z
author_association: NONE

PR comments:
user: login: github-advanced-security[bot]
created_at: 2025-04-12T10:34:42Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/ffcoders/vigilant-umbrella/security/code-scanning?query=pr%3A15+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: NONE
user: login: github-advanced-security[bot]
created_at: 2025-04-12T10:34:42Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/ffcoders/vigilant-umbrella/security/code-scanning?query=pr%3A15+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: NONE
user: login: github-advanced-security[bot]
created_at: 2025-04-12T10:34:42Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/ffcoders/vigilant-umbrella/security/code-scanning?query=pr%3A15+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: NONE
user: login: github-advanced-security[bot]
created_at: 2025-04-12T10:34:42Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/ffcoders/vigilant-umbrella/security/code-scanning?query=pr%3A15+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: NONE
user: login: codacy-production[bot]
created_at: 2025-04-12T10:45:49Z
body: ## Coverage summary from Codacy
### [See diff coverage on Codacy](https://app.codacy.com/gh/ffcoders/vigilant-umbrella/pull-requests/15/coverage?utm_source=github.com&utm_medium=coverageSummary&utm_campaign=coverageSummaryPullRequest)

 | Coverage variation | Diff coverage | 
 | ------------- | ------------- |
 | Report missing for 6c0414dedce291edc689552d26862c466c09b153[^1] | :white_check_mark: **∅** |

<details>
<summary>Coverage variation details</summary>

| | Coverable lines | Covered lines | Coverage |
| ------------- | ------------- | ------------- | ------------- |
| Common ancestor commit (6c0414dedce291edc689552d26862c466c09b153) | Report Missing | Report Missing | Report Missing | |
| Head commit (ed6b88d8bc0dbcb246a3db935e7af8177d31051f) | 818 | 22 | 2.69% |

**Coverage variation** is the difference between the coverage for the head and common ancestor commits of the pull request branch: `<coverage of head commit> - <coverage of common ancestor commit>`
</details>

<details>
<summary>Diff coverage details</summary>

| | Coverable lines | Covered lines | Diff coverage |
| ------------- | ------------- | ------------- | ------------- |
| Pull request (#15) | 0 | 0 | **∅ (not applicable)** |

**Diff coverage** is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: `<covered lines added or modified>/<coverable lines added or modified> * 100%`
</details>

#### [See your quality gate settings](https://app.codacy.com/gh/ffcoders/vigilant-umbrella/settings/quality?utm_source=github.com&utm_medium=coverageSummary&utm_campaign=coverageSummaryGates)&nbsp;&nbsp;&nbsp;&nbsp;[Change summary preferences](https://app.codacy.com/gh/ffcoders/vigilant-umbrella/settings/integrations?utm_source=github.com&utm_medium=coverageSummary&utm_campaign=coverageSummarySettings)
[^1]: Codacy didn't receive coverage data for the commit, or there was an error processing the received data. [Check your integration for errors](https://app.codacy.com/gh/ffcoders/vigilant-umbrella/settings/coverage?utm_source=github.com&utm_medium=coverageSummary&utm_campaign=coverageSummarySetup) and [validate that your coverage setup is correct](https://docs.codacy.com/coverage-reporter/#validating-coverage?utm_source=github.com&utm_medium=coverageSummary&utm_campaign=coverageSummaryTroubleshoot).
<!-- 108f945d-e553-4918-8ccf-027c6d4acc2c -->
author_association: CONTRIBUTOR
user: login: sonarqubecloud[bot]
created_at: 2025-04-12T11:31:01Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=ffcoders_vigilant-umbrella&pullRequest=15) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=ffcoders_vigilant-umbrella&pullRequest=15&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=ffcoders_vigilant-umbrella&pullRequest=15&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=ffcoders_vigilant-umbrella&pullRequest=15&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=ffcoders_vigilant-umbrella&pullRequest=15&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=ffcoders_vigilant-umbrella&pullRequest=15&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=ffcoders_vigilant-umbrella&pullRequest=15)


author_association: NONE