Violations Command Line


This is a command line tool that will find report files from static code analysis, present and optionally fail the command. It uses the Violations Lib.

- The runnable can be found in Maven Central
- or NPM.
- The Docker image can be found in Dockerhub
- Can used like docker run --mount src="$(pwd)",target=/home/violations-command-line,type=bind tomasbjerre/violations-command-line:a.b.c -v "FINDBUGS" src/test/resources/findbugs/ ".*main\.xml$" "Spotbugs".
- Or open a shell to have a look docker run --rm -it --entrypoint sh tomasbjerre/violations-command-line:a.b.c

| Version | Java Version |
| ------------------| ------------ |
| version < 2.0.0 | 8 |
| 2.0.0 - 3.2.1 | 11 |
| 3.2.2 <= version | 17 |

Run it with:

``bash
npx violations-command-line -s ERROR -mv 0 \
-v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
-v "JSLINT" "." ".*jshint/report\.xml$" "JSHint"
`

It can parse results from static code analysis and:

- Report violations in the build log.
- Export to a normalized JSON format.

`bash
npx violations-command-line -vf violations-report.json \
-v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"
`

- Export to CodeClimate JSON.

`bash
npx violations-command-line -cc code-climate-report.json \
-v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"
`

- Export to Sarif JSON.

`bash
npx violations-command-line -sa sarif-report.json \
-v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"
`

- Optionally fail the build depending on violations found.

A snippet of the output may look like this:

`
...
se/bjurr/violations/lib/example/OtherClass.java
╔══════════╤════════════╤══════════╤══════╤════════════════════════════════════════════════════╗
║ Reporter │ Rule │ Severity │ Line │ Message ║
╠══════════╪════════════╪══════════╪══════╪════════════════════════════════════════════════════╣
║ Findbugs │ MS_SHOULD_ │ INFO │ 7 │ Field isn't final but should be ║
║ │ BE_FINAL │ │ │ ║
║ │ │ │ │ ║
║ │ │ │ │

║
║ │ │ │ │ This static field public but not final, and ║
║ │ │ │ │ could be changed by malicious code or ║
║ │ │ │ │ by accident from another package. ║
║ │ │ │ │ The field could be made final to avoid ║
║ │ │ │ │ this vulnerability.


Summary
╔════════════╤══════╤══════╤═══════╤═══════╗
║ Reporter │ INFO │ WARN │ ERROR │ Total ║
╠════════════╪══════╪══════╪═══════╪═══════╣
║ Checkstyle │ 4 │ 1 │ 1 │ 6 ║
╟────────────┼──────┼──────┼───────┼───────╢
║ Findbugs │ 2 │ 2 │ 5 │ 9 ║
╟────────────┼──────┼──────┼───────┼───────╢
║ │ 6 │ 3 │ 6 │ 15 ║
╚════════════╧══════╧══════╧═══════╧═══════╝
`

GitHub

GitHub is supported via SARIF. This tool can export SARIF format and it can be uploaded to Github to get feedback in pull-requests.

`yml
name: My workflow

on: [workflow_call, push, pull_request]

jobs:
build:
permissions:
security-events: write
actions: read
contents: read
steps:
- name: Build
run: |
your-build-command-here
- name: Transorm static code analysis to SARIF
if: success() || failure()
run: |
npx violations-command-line -sarif sarif-report.json \
-v "FINDBUGS" "." ".*spotbugs/main\.xml$" "Spotbugs" \
-v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
-v "PMD" "." ".*pmd/main\.xml$" "PMD" \
-v "JUNIT" "." ".test/TEST-.\.xml$" "JUNIT"
- uses: github/codeql-action/upload-sarif@v3
if: success() || failure()
with:
sarif_file: sarif-report.json
category: violations-lib
`

GitLab

GitLab is supported via CodeClimate. This tool can export CodeClimate format and it can be uploaded to GitLab to get feedback in pull-requests.

If you export CodeClimate like this:

`sh
npx violations-command-line -cc code-climate-report.json \
-v "FINDBUGS" "." ".*spotbugs/main\.xml$" "Spotbugs" \
-v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
-v "PMD" "." ".*pmd/main\.xml$" "PMD" \
-v "JUNIT" "." ".test/TEST-.\.xml$" "JUNIT"
`

You can upload it like this:

`yml
artifacts:
paths:
- code-climate-report.json
reports:
codequality: code-climate-report.json
`

Formats


Example of supported reports are available here.

A number of parsers have been implemented. Some parsers can parse output from several reporters.

| Reporter | Parser | Notes
| --- | --- | ---
| _ARM-GCC_ | CLANG |
| _AndroidLint_ | ANDROIDLINT |
| _Ansible-Later_ | ANSIBLELATER | With json format
| _AnsibleLint_ | FLAKE8 | With -p
| _Bandit_ | CLANG | With bandit -r examples/ -f custom -o bandit.out --msg-template "{abspath}:{line}: {severity}: {test_id}: {msg}"
| _CLang_ | CLANG |
| _CPD_ | CPD |
| _CPPCheck_ | CPPCHECK | With cppcheck test.cpp --output-file=cppcheck.xml --xml
| _CPPLint_ | CPPLINT |
| _CSSLint_ | CSSLINT |
| _Checkstyle_ | CHECKSTYLE |
| _CloudFormation Linter_ | JUNIT | cfn-lint . -f junit --output-file report-junit.xml
| _CodeClimate_ | CODECLIMATE |
| _CodeNarc_ | CODENARC |
| _Coverity_ | COVERITY |
| _Dart_ | MACHINE | With dart analyze --format=machine
| _Dependency Check_ | SARIF | Using --format SARIF
| _Detekt_ | CHECKSTYLE | With --output-format xml.
| _DocFX_ | DOCFX |
| _Doxygen_ | CLANG |
| _ERB_ | CLANG | With erb -P -x -T '-' "${it}" \| ruby -c 2>&1 >/dev/null \| grep '^-' \| sed -E 's/^-([a-zA-Z0-9:]+)/${filename}\1 ERROR:/p' > erbfiles.out.
| _ESLint_ | CHECKSTYLE | With format: 'checkstyle'.
| _Findbugs_ | FINDBUGS |
| _Flake8_ | FLAKE8 |
| _FxCop_ | FXCOP |
| _GCC_ | CLANG |
| _GHS_ | GHS |
| _Gendarme_ | GENDARME |
| [_Generic reporter_]() | GENERIC | Will create one single violation with all the content as message.
| _GoLint_ | GOLINT |
| _GoVet_ | GOLINT | Same format as GoLint.
| _GolangCI-Lint_ | CHECKSTYLE | With --out-format=checkstyle.
| _GoogleErrorProne_ | GOOGLEERRORPRONE |
| _HadoLint_ | CHECKSTYLE | With -f checkstyle
| _IAR_ | IAR | With --no_wrap_diagnostics
| _Infer_ | PMD | Facebook Infer. With --pmd-xml.
| _JACOCO_ | JACOCO |
| _JCReport_ | JCREPORT |
| _JSHint_ | JSLINT | With --reporter=jslint or the CHECKSTYLE parser with --reporter=checkstyle
| _JUnit_ | JUNIT | It only contains the failures.
| _KTLint_ | CHECKSTYLE |
| _Klocwork_ | KLOCWORK |
| _KotlinGradle_ | KOTLINGRADLE | Output from Kotlin Gradle Plugin.
| _KotlinMaven_ | KOTLINMAVEN | Output from Kotlin Maven Plugin.
| [_Lint_]() | LINT | A common XML format, used by different linters.
| _MSBuildLog_ | MSBULDLOG | With -fileLogger use .*msbuild\\.log$ as pattern or -fl -flp:logfile=MyProjectOutput.log;verbosity=diagnostic for a custom output filename
| _MSCpp_ | MSCPP |
| _Mccabe_ | FLAKE8 |
| _MyPy_ | MYPY |
| _NullAway_ | GOOGLEERRORPRONE | Same format as Google Error Prone.
| _PCLint_ | PCLINT | PC-Lint using the same output format as the Jenkins warnings plugin, _details here_
| _PHPCS_ | CHECKSTYLE | With phpcs api.php --report=checkstyle.
| _PHPPMD_ | PMD | With phpmd api.php xml ruleset.xml.
| _PMD_ | PMD |
| _Pep8_ | FLAKE8 |
| _PerlCritic_ | PERLCRITIC |
| _PiTest_ | PITEST |
| _ProtoLint_ | PROTOLINT |
| _Puppet-Lint_ | CLANG | With -log-format %{fullpath}:%{line}:%{column}: %{kind}: %{message}
| _PyDocStyle_ | PYDOCSTYLE |
| _PyFlakes_ | FLAKE8 |
| _PyLint_ | PYLINT | With pylint --output-format=parseable.
| _ReSharper_ | RESHARPER |
| _RubyCop_ | CLANG | With rubycop -f clang file.rb
| _SARIF_ | SARIF | v2.x. Microsoft Visual C# can generate it with ErrorLog="BuildErrors.sarif,version=2".
| _SbtScalac_ | SBTSCALAC |
| _Scalastyle_ | CHECKSTYLE |
| _Semgrep_ | SEMGREP | With --json.
| _Simian_ | SIMIAN |
| _Sonar_ | SONAR | With mvn sonar:sonar -Dsonar.analysis.mode=preview -Dsonar.report.export.path=sonar-report.json. Removed in 7.7, see SONAR-11670 but can be retrieved with: curl --silent 'http://sonar-server/api/issues/search?componentKeys=unique-key&resolved=false' \| jq -f sonar-report-builder.jq > sonar-report.json.
| _Spotbugs_ | FINDBUGS |
| _StyleCop_ | STYLECOP |
| _SwiftLint_ | CHECKSTYLE | With --reporter checkstyle.
| _TSLint_ | CHECKSTYLE | With -t checkstyle
| _Valgrind_ | VALGRIND | With --xml=yes.
| _XMLLint_ | XMLLINT |
| _XUnit_ | XUNIT | It only contains the failures.
| _YAMLLint_ | YAMLLINT | With -f parsable
| _ZPTLint_ | ZPTLINT |

52 parsers and 79 reporters.

Missing a format? Open an issue here!

Usage

`shell
Available parsers are:
ANDROIDLINT, ANSIBLELATER, CHECKSTYLE, CODENARC, CLANG, COVERITY, CPD, CPPCHECK, CPPLINT, CSSLINT, GENERIC, GHS, FINDBUGS, FLAKE8, MACHINE, FXCOP, GENDARME, IAR, JACOCO, JCREPORT, JSLINT, JUNIT, LINT, KLOCWORK, KOTLINMAVEN, KOTLINGRADLE, MSCPP, MSBULDLOG, MYPY, GOLINT, GOOGLEERRORPRONE, PERLCRITIC, PITEST, PMD, PROTOLINT, PYDOCSTYLE, PYLINT, RESHARPER, SARIF, SBTSCALAC, SEMGREP, SIMIAN, SONAR, STYLECOP, XMLLINT, YAMLLINT, ZPTLINT, DOCFX, PCLINT, CODECLIMATE, XUNIT, VALGRIND

Usage: violations-command-line [-dpv] [--help] [-pv] [-show-debug-info]
[-show-json-config] [-cc=]
[-cf=] [-ddl=]
[-df=] [-dl=]
[-dmv=]
[-ds=] [-dt=]
[-gr=] [-jmc=]
[-jmlc=]
[-mlcw=]
[-mmcw=]
[-mrcw=]
[-mrucw=]
[-mscw=]
[-mv=] [-s=]
[-ss=] [-vf=]
[-v=]...
-cc, -code-climate=
Create a CodeClimate file with all the violations.
-cf, -config-file=
Will read config from given file. Can also be
configured with environment variable
VIOLATIONS_CONFIG. Format is what you get from
-show-json-config.
-ddl, -diff-detail-level=
VERBOSE, COMPACT, PER_FILE_COMPACT
-df, -diff-from=
Can be empty (ignored), Git-commit or any
Git-reference
-dl, -detail-level=
Verbosity VERBOSE, COMPACT, PER_FILE_COMPACT
-dmv, -diff-max-violations=
Will fail the build if total number of found
violations is higher
-dpv, -diff-print-violations
Will print violations found in diff
-ds, -diff-severity=
INFO, WARN, ERROR
-dt, -diff-to=
Can be empty (ignored), Git-commit or any
Git-reference
-gr, -git-repo=
Where to look for Git.
--help display this help and exit
-jmc, -jacoco-min-coverage=
Minimum coverage in Jacoco that will generate a
violation.
-jmlc, -jacoco-min-line-count=
Minimum line count in Jacoco that will generate a
violation.
-mlcw, -max-line-column-width=
0 means no limit
-mmcw, -max-message-column-width=
0 means no limit
-mrcw, -max-reporter-column-width=
0 means no limit
-mrucw, -max-rule-column-width=
0 means no limit
-mscw, -max-severity-column-width=
0 means no limit
-mv, -max-violations=
Will fail the build if total number of found
violations is higher.
-pv, -print-violations
Will print violations found
-s, -severity=
Minimum severity level to report. INFO, WARN, ERROR
-show-debug-info Please run your command with this parameter and
supply output when reporting bugs.
-show-json-config Will print the given config as JSON.
-ss, -sarif=
Create a Sarif file with all the violations.
-v, --violations=
Format: ,
Example: -v "JSLINT" "." ".*/jshint.xml$" "JSHint"
-vf, -violations-file=
Create a JSON file with all the violations.
``

Checkout the Violations Lib for more documentation.