violations-command-line

Violations Command Line

This is a command line tool that will find report files from static code analysis, present and optionally fail the command. It uses the Violations Lib.

• The runnable can be found in Maven Central
• or NPM.
• The Docker image can be found in Dockerhub
  • Can used like docker run --mount src="$(pwd)",target=/home/violations-command-line,type=bind tomasbjerre/violations-command-line:a.b.c -v "FINDBUGS" src/test/resources/findbugs/ ".*main\.xml$" "Spotbugs".
  • Or open a shell to have a look docker run --rm -it --entrypoint sh tomasbjerre/violations-command-line:a.b.c

Version	Java Version
version < 2.0.0	8
2.0.0 - 3.2.1	11
3.2.2 <= version	17

Run it with:

npx violations-command-line -s ERROR -mv 0 \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
 -v "JSLINT" "." ".*jshint/report\.xml$" "JSHint"

It can parse results from static code analysis and:

• Report violations in the build log.
• Export to a normalized JSON format.

npx violations-command-line -vf violations-report.json \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"

• Export to CodeClimate JSON.

npx violations-command-line -cc code-climate-report.json \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"

• Export to Sarif JSON.

npx violations-command-line -sa sarif-report.json \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"

• Optionally fail the build depending on violations found.

A snippet of the output may look like this:

...
se/bjurr/violations/lib/example/OtherClass.java
╔══════════╤════════════╤══════════╤══════╤════════════════════════════════════════════════════╗
║ Reporter │ Rule       │ Severity │ Line │ Message                                            ║
╠══════════╪════════════╪══════════╪══════╪════════════════════════════════════════════════════╣
║ Findbugs │ MS_SHOULD_ │ INFO     │ 7    │ Field isn't final but should be                    ║
║          │ BE_FINAL   │          │      │                                                    ║
║          │            │          │      │                                                    ║
║          │            │          │      │    <p>                                             ║
║          │            │          │      │ This static field public but not final, and        ║
║          │            │          │      │ could be changed by malicious code or              ║
║          │            │          │      │         by accident from another package.          ║
║          │            │          │      │         The field could be made final to avoid     ║
║          │            │          │      │         this vulnerability.</p>                    ║
╟──────────┼────────────┼──────────┼──────┼────────────────────────────────────────────────────╢
║ Findbugs │ NM_FIELD_N │ INFO     │ 6    │ Field names should start with a lower case letter  ║
║          │ AMING_CONV │          │      │                                                    ║
║          │ ENTION     │          │      │                                                    ║
║          │            │          │      │   <p>                                              ║
║          │            │          │      │ Names of fields that are not final should be in mi ║
║          │            │          │      │ xed case with a lowercase first letter and the fir ║
║          │            │          │      │ st letters of subsequent words capitalized.        ║
║          │            │          │      │ </p>                                               ║
╚══════════╧════════════╧══════════╧══════╧════════════════════════════════════════════════════╝

Summary of se/bjurr/violations/lib/example/OtherClass.java
╔══════════╤══════╤══════╤═══════╤═══════╗
║ Reporter │ INFO │ WARN │ ERROR │ Total ║
╠══════════╪══════╪══════╪═══════╪═══════╣
║ Findbugs │ 2    │ 0    │ 0     │ 2     ║
╟──────────┼──────┼──────┼───────┼───────╢
║          │ 2    │ 0    │ 0     │ 2     ║
╚══════════╧══════╧══════╧═══════╧═══════╝


Summary
╔════════════╤══════╤══════╤═══════╤═══════╗
║ Reporter   │ INFO │ WARN │ ERROR │ Total ║
╠════════════╪══════╪══════╪═══════╪═══════╣
║ Checkstyle │ 4    │ 1    │ 1     │ 6     ║
╟────────────┼──────┼──────┼───────┼───────╢
║ Findbugs   │ 2    │ 2    │ 5     │ 9     ║
╟────────────┼──────┼──────┼───────┼───────╢
║            │ 6    │ 3    │ 6     │ 15    ║
╚════════════╧══════╧══════╧═══════╧═══════╝

GitHub

GitHub is supported via SARIF. This tool can export SARIF format and it can be uploaded to Github to get feedback in pull-requests.

name: My workflow

on: [workflow_call, push, pull_request]

jobs:
  build:
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - name: Build
        run: |
          your-build-command-here
      - name: Transorm static code analysis to SARIF
        if: success() || failure()
        run: |
          npx violations-command-line -sarif sarif-report.json \
          -v "FINDBUGS" "." ".*spotbugs/main\.xml$" "Spotbugs" \
          -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
          -v "PMD" "." ".*pmd/main\.xml$" "PMD" \
          -v "JUNIT" "." ".*test/TEST-.*\.xml$" "JUNIT"
      - uses: github/codeql-action/upload-sarif@v3
        if: success() || failure()
        with:
          sarif_file: sarif-report.json
          category: violations-lib

GitLab

GitLab is supported via CodeClimate. This tool can export CodeClimate format and it can be uploaded to GitLab to get feedback in pull-requests.

If you export CodeClimate like this:

npx violations-command-line -cc code-climate-report.json \
  -v "FINDBUGS" "." ".*spotbugs/main\.xml$" "Spotbugs" \
  -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
  -v "PMD" "." ".*pmd/main\.xml$" "PMD" \
  -v "JUNIT" "." ".*test/TEST-.*\.xml$" "JUNIT"

You can upload it like this:

  artifacts:
    paths:
      - code-climate-report.json
    reports:
      codequality: code-climate-report.json

Formats

Example of supported reports are available here.

A number of parsers have been implemented. Some parsers can parse output from several reporters.

Reporter	Parser	Notes
ARM-GCC	CLANG
AndroidLint	ANDROIDLINT
Ansible-Later	ANSIBLELATER	With json format
AnsibleLint	FLAKE8	With -p
Bandit	CLANG	With bandit -r examples/ -f custom -o bandit.out --msg-template "{abspath}:{line}: {severity}: {test_id}: {msg}"
CLang	CLANG
CPD	CPD
CPPCheck	CPPCHECK	With cppcheck test.cpp --output-file=cppcheck.xml --xml
CPPLint	CPPLINT
CSSLint	CSSLINT
Checkstyle	CHECKSTYLE
CloudFormation Linter	JUNIT	cfn-lint . -f junit --output-file report-junit.xml
CodeClimate	CODECLIMATE
CodeNarc	CODENARC
Coverity	COVERITY
Dart	MACHINE	With dart analyze --format=machine
Dependency Check	SARIF	Using --format SARIF
Detekt	CHECKSTYLE	With --output-format xml.
DocFX	DOCFX
Doxygen	CLANG
ERB	CLANG	With erb -P -x -T '-' "${it}" | ruby -c 2>&1 >/dev/null | grep '^-' | sed -E 's/^-([a-zA-Z0-9:]+)/${filename}\1 ERROR:/p' > erbfiles.out.
ESLint	CHECKSTYLE	With format: 'checkstyle'.
Findbugs	FINDBUGS
Flake8	FLAKE8
FxCop	FXCOP
GCC	CLANG
GHS	GHS
Gendarme	GENDARME
Generic reporter	GENERIC	Will create one single violation with all the content as message.
GoLint	GOLINT
GoVet	GOLINT	Same format as GoLint.
GolangCI-Lint	CHECKSTYLE	With --out-format=checkstyle.
GoogleErrorProne	GOOGLEERRORPRONE
HadoLint	CHECKSTYLE	With -f checkstyle
IAR	IAR	With --no_wrap_diagnostics
Infer	PMD	Facebook Infer. With --pmd-xml.
JACOCO	JACOCO
JCReport	JCREPORT
JSHint	JSLINT	With --reporter=jslint or the CHECKSTYLE parser with --reporter=checkstyle
JUnit	JUNIT	It only contains the failures.
KTLint	CHECKSTYLE
Klocwork	KLOCWORK
KotlinGradle	KOTLINGRADLE	Output from Kotlin Gradle Plugin.
KotlinMaven	KOTLINMAVEN	Output from Kotlin Maven Plugin.
Lint	LINT	A common XML format, used by different linters.
MSBuildLog	MSBULDLOG	With -fileLogger use .*msbuild\\.log$ as pattern or -fl -flp:logfile=MyProjectOutput.log;verbosity=diagnostic for a custom output filename
MSCpp	MSCPP
Mccabe	FLAKE8
MyPy	MYPY
NullAway	GOOGLEERRORPRONE	Same format as Google Error Prone.
PCLint	PCLINT	PC-Lint using the same output format as the Jenkins warnings plugin, details here
PHPCS	CHECKSTYLE	With phpcs api.php --report=checkstyle.
PHPPMD	PMD	With phpmd api.php xml ruleset.xml.
PMD	PMD
Pep8	FLAKE8
PerlCritic	PERLCRITIC
PiTest	PITEST
ProtoLint	PROTOLINT
Puppet-Lint	CLANG	With -log-format %{fullpath}:%{line}:%{column}: %{kind}: %{message}
PyDocStyle	PYDOCSTYLE
PyFlakes	FLAKE8
PyLint	PYLINT	With pylint --output-format=parseable.
ReSharper	RESHARPER
RubyCop	CLANG	With rubycop -f clang file.rb
SARIF	SARIF	v2.x. Microsoft Visual C# can generate it with ErrorLog="BuildErrors.sarif,version=2".
SbtScalac	SBTSCALAC
Scalastyle	CHECKSTYLE
Semgrep	SEMGREP	With --json.
Simian	SIMIAN
Sonar	SONAR	With mvn sonar:sonar -Dsonar.analysis.mode=preview -Dsonar.report.export.path=sonar-report.json. Removed in 7.7, see SONAR-11670 but can be retrieved with: curl --silent 'http://sonar-server/api/issues/search?componentKeys=unique-key&resolved=false' | jq -f sonar-report-builder.jq > sonar-report.json.
Spotbugs	FINDBUGS
StyleCop	STYLECOP
SwiftLint	CHECKSTYLE	With --reporter checkstyle.
TSLint	CHECKSTYLE	With -t checkstyle
Valgrind	VALGRIND	With --xml=yes.
XMLLint	XMLLINT
XUnit	XUNIT	It only contains the failures.
YAMLLint	YAMLLINT	With -f parsable
ZPTLint	ZPTLINT

52 parsers and 79 reporters.

Missing a format? Open an issue here!

Usage

Available parsers are:
ANDROIDLINT, ANSIBLELATER, CHECKSTYLE, CODENARC, CLANG, COVERITY, CPD, CPPCHECK, CPPLINT, CSSLINT, GENERIC, GHS, FINDBUGS, FLAKE8, MACHINE, FXCOP, GENDARME, IAR, JACOCO, JCREPORT, JSLINT, JUNIT, LINT, KLOCWORK, KOTLINMAVEN, KOTLINGRADLE, MSCPP, MSBULDLOG, MYPY, GOLINT, GOOGLEERRORPRONE, PERLCRITIC, PITEST, PMD, PROTOLINT, PYDOCSTYLE, PYLINT, RESHARPER, SARIF, SBTSCALAC, SEMGREP, SIMIAN, SONAR, STYLECOP, XMLLINT, YAMLLINT, ZPTLINT, DOCFX, PCLINT, CODECLIMATE, XUNIT, VALGRIND

Usage: violations-command-line [-dpv] [--help] [-pv] [-show-debug-info]
                               [-show-json-config] [-cc=<codeClimateFileArg>]
                               [-cf=<configFileArg>] [-ddl=<diffDetailLevel>]
                               [-df=<diffFrom>] [-dl=<detailLevelArg>]
                               [-dmv=<diffMaxViolations>]
                               [-ds=<diffMinSeverity>] [-dt=<diffTo>]
                               [-gr=<gitRepoArg>] [-jmc=<jacocoMinCoverage>]
                               [-jmlc=<jacocoMinLineCount>]
                               [-mlcw=<maxLineColumnWidth>]
                               [-mmcw=<maxMessageColumnWidth>]
                               [-mrcw=<maxReporterColumnWidth>]
                               [-mrucw=<maxRuleColumnWidth>]
                               [-mscw=<maxSeverityColumnWidth>]
                               [-mv=<maxViolationsArg>] [-s=<minSeverityArg>]
                               [-ss=<sarifFileArg>] [-vf=<violationsFileArg>]
                               [-v=<violationsArg>]...
      -cc, -code-climate=<codeClimateFileArg>
                          Create a CodeClimate file with all the violations.
      -cf, -config-file=<configFileArg>
                          Will read config from given file. Can also be
                            configured with environment variable
                            VIOLATIONS_CONFIG. Format is what you get from
                            -show-json-config.
      -ddl, -diff-detail-level=<diffDetailLevel>
                          VERBOSE, COMPACT, PER_FILE_COMPACT
      -df, -diff-from=<diffFrom>
                          Can be empty (ignored), Git-commit or any
                            Git-reference
      -dl, -detail-level=<detailLevelArg>
                          Verbosity VERBOSE, COMPACT, PER_FILE_COMPACT
      -dmv, -diff-max-violations=<diffMaxViolations>
                          Will fail the build if total number of found
                            violations is higher
      -dpv, -diff-print-violations
                          Will print violations found in diff
      -ds, -diff-severity=<diffMinSeverity>
                          INFO, WARN, ERROR
      -dt, -diff-to=<diffTo>
                          Can be empty (ignored), Git-commit or any
                            Git-reference
      -gr, -git-repo=<gitRepoArg>
                          Where to look for Git.
      --help              display this help and exit
      -jmc, -jacoco-min-coverage=<jacocoMinCoverage>
                          Minimum coverage in Jacoco that will generate a
                            violation.
      -jmlc, -jacoco-min-line-count=<jacocoMinLineCount>
                          Minimum line count in Jacoco that will generate a
                            violation.
      -mlcw, -max-line-column-width=<maxLineColumnWidth>
                          0 means no limit
      -mmcw, -max-message-column-width=<maxMessageColumnWidth>
                          0 means no limit
      -mrcw, -max-reporter-column-width=<maxReporterColumnWidth>
                          0 means no limit
      -mrucw, -max-rule-column-width=<maxRuleColumnWidth>
                          0 means no limit
      -mscw, -max-severity-column-width=<maxSeverityColumnWidth>
                          0 means no limit
      -mv, -max-violations=<maxViolationsArg>
                          Will fail the build if total number of found
                            violations is higher.
      -pv, -print-violations
                          Will print violations found
  -s, -severity=<minSeverityArg>
                          Minimum severity level to report. INFO, WARN, ERROR
      -show-debug-info    Please run your command with this parameter and
                            supply output when reporting bugs.
      -show-json-config   Will print the given config as JSON.
      -ss, -sarif=<sarifFileArg>
                          Create a Sarif file with all the violations.
  -v, --violations=<violationsArg>
                          Format: <PARSER> <FOLDER> <REGEXP PATTERN> <NAME>,
                            Example: -v "JSLINT" "." ".*/jshint.xml$" "JSHint"
      -vf, -violations-file=<violationsFileArg>
                          Create a JSON file with all the violations.

Checkout the Violations Lib for more documentation.