From ab51fa5da2c874094b149493a8dd1a6a59182503 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Fri, 16 Jan 2026 13:37:06 -0300 Subject: [PATCH 01/15] feat(codenarc): adiciona suporte a identificacao de priority via violationMessage --- entrypoint.sh | 99 ++++++++++------ testdata/basic.xml | 255 ++++++++++++++++++++++++++++++++-------- testdata/subdir/text.md | 2 - testdata/test.groovy | 36 +++++- testdata/text.md | 5 - 5 files changed, 301 insertions(+), 96 deletions(-) delete mode 100644 testdata/subdir/text.md delete mode 100644 testdata/text.md diff --git a/entrypoint.sh b/entrypoint.sh index 2efe540..c26aee0 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,6 +1,7 @@ #!/bin/sh set -e +# ========== ARQUIVOS TEMPORÁRIOS ========== CODENARC_RESULT="result.txt" LINE_VIOLATIONS="line_violations.txt" FILE_VIOLATIONS="file_violations.txt" @@ -8,21 +9,22 @@ VIOLATIONS_FLAG="/tmp/found_violations.txt" ALL_DIFF="/tmp/all_diff.txt" CHANGED_LINES_CACHE="/tmp/changed_lines.txt" CHANGED_FILES_CACHE="/tmp/changed_files.txt" +TMP_VIOLATIONS="/tmp/violations.tmp" cleanup_temp_files() { rm -f "$CODENARC_RESULT" "$LINE_VIOLATIONS" "$FILE_VIOLATIONS" "$VIOLATIONS_FLAG" \ "$ALL_DIFF" "$CHANGED_LINES_CACHE" "$CHANGED_FILES_CACHE" \ - "${FILE_VIOLATIONS}.formatted" >/dev/null 2>&1 + "${FILE_VIOLATIONS}.formatted" "$TMP_VIOLATIONS" >/dev/null 2>&1 } - trap 'cleanup_temp_files' EXIT +# ========== ETAPA 1 - EXECUTA CODENARC ========== run_codenarc() { report="${INPUT_REPORT:-compact:stdout}" includes_arg="" - + [ -n "$INPUT_SOURCE_FILES" ] && includes_arg="-includes=${INPUT_SOURCE_FILES}" - + echo "🔍 Executando CodeNarc..." java -jar /lib/codenarc-all.jar \ -report="$report" \ @@ -32,6 +34,7 @@ run_codenarc() { > "$CODENARC_RESULT" } +# ========== ETAPA 2 - REVIEWDOG ========== run_reviewdog_with_config() { input_file="$1" efm="$2" @@ -39,7 +42,7 @@ run_reviewdog_with_config() { name="$4" filter_mode="$5" level="$6" - + < "$input_file" reviewdog \ -efm="$efm" \ -reporter="$reporter" \ @@ -57,16 +60,16 @@ separate_violations() { run_reviewdog() { echo "📤 Enviando resultados para reviewdog..." - + separate_violations - + if [ -s "$LINE_VIOLATIONS" ]; then echo "📤 Enviando violações line-based (${INPUT_REPORTER:-github-pr-check})..." run_reviewdog_with_config "$LINE_VIOLATIONS" "%f:%l:%m" \ "${INPUT_REPORTER:-github-pr-check}" "codenarc" \ "${INPUT_FILTER_MODE}" "${INPUT_LEVEL}" fi - + if [ -s "$FILE_VIOLATIONS" ]; then true > "${FILE_VIOLATIONS}.formatted" while read -r violation; do @@ -76,21 +79,17 @@ run_reviewdog() { echo "$violation" | sed 's/:null:/::/' fi done < "$FILE_VIOLATIONS" > "${FILE_VIOLATIONS}.formatted" - + if [ "${INPUT_REPORTER}" = "local" ]; then - echo "📤 Enviando violações file-based (local)..." run_reviewdog_with_config "${FILE_VIOLATIONS}.formatted" "%f::%m" \ "local" "codenarc" "nofilter" "${INPUT_LEVEL}" else - echo "📤 Enviando violações file-based (github-pr-check)..." run_reviewdog_with_config "${FILE_VIOLATIONS}.formatted" "%f::%m" \ "github-pr-check" "codenarc" "nofilter" "warning" fi fi - - # fallback se nao houver violacoes categorizadas + if [ ! -s "$LINE_VIOLATIONS" ] && [ ! -s "$FILE_VIOLATIONS" ]; then - echo "📝 Executando reviewdog padrão..." run_reviewdog_with_config "$CODENARC_RESULT" "%f:%l:%m" \ "${INPUT_REPORTER:-github-pr-check}" "codenarc" \ "${INPUT_FILTER_MODE}" "${INPUT_LEVEL}" @@ -98,11 +97,20 @@ run_reviewdog() { } generate_git_diff() { + if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then + echo "⚠️ Diretório não é um repositório Git; nenhuma comparação de diff será feita." + return 0 + fi + if [ -n "$GITHUB_BASE_SHA" ] && [ -n "$GITHUB_HEAD_SHA" ]; then git fetch origin "$GITHUB_BASE_SHA" --depth=1 2>/dev/null || true git fetch origin "$GITHUB_HEAD_SHA" --depth=1 2>/dev/null || true git diff -U0 "$GITHUB_BASE_SHA" "$GITHUB_HEAD_SHA" -- '*.groovy' else + if ! git rev-parse HEAD~1 >/dev/null 2>&1; then + echo "⚠️ Nenhum commit anterior para comparar; diff vazio." + return 0 + fi git diff -U0 HEAD~1 -- '*.groovy' fi } @@ -119,10 +127,13 @@ parse_diff_range() { build_changed_lines_cache() { true > "$CHANGED_LINES_CACHE" true > "$CHANGED_FILES_CACHE" - + generate_git_diff > "$ALL_DIFF" 2>/dev/null || true - [ ! -s "$ALL_DIFF" ] && return 0 - + [ ! -s "$ALL_DIFF" ] && { + echo "ℹ️ Nenhum diff detectado; prosseguindo com cache vazio." + return 0 + } + current_file="" while read -r line; do case "$line" in @@ -150,6 +161,7 @@ build_changed_lines_cache() { done < "$ALL_DIFF" } +# ========== FUNÇÕES AUXILIARES ========== get_p1_count() { p1_count=$(grep -Eo "p1=[0-9]+" "$CODENARC_RESULT" | cut -d'=' -f2 | head -1) echo "${p1_count:-0}" @@ -179,52 +191,63 @@ is_file_changed() { grep -q "^$1$" "$CHANGED_FILES_CACHE" } +# ========== ETAPA 4 - BLOQUEIO POR P1 ========== check_blocking_rules() { echo "🔎 Verificando violações bloqueantes (priority 1)..." [ ! -f "$CODENARC_RESULT" ] && echo "❌ Resultado não encontrado" && return 1 - + p1_count=$(get_p1_count) - echo "📊 Total de P1 encontradas: $p1_count" - - [ "$p1_count" -eq 0 ] && echo "✅ Nenhuma P1 detectada → merge permitido" && return 0 - - echo "⚠️ Verificando P1s em linhas alteradas..." + echo "📊 Total de P1 encontradas no resumo: ${p1_count:-0}" + [ "$p1_count" -eq 0 ] && { echo "✅ Nenhuma P1 detectada → merge permitido"; return 0; } + + echo "⚙️ Preparando diff..." build_changed_lines_cache - allowed_patterns=$(get_allowed_patterns) - [ -n "$allowed_patterns" ] && echo "🧩 Analisando apenas arquivos filtrados por INPUT_SOURCE_FILES" - + [ -n "$allowed_patterns" ] && echo "🧩 Filtrando por INPUT_SOURCE_FILES" + echo "0" > "$VIOLATIONS_FLAG" - - grep -E ':[0-9]+:|:null:|\|\|' "$CODENARC_RESULT" | while IFS=: read -r file line rest; do + grep -E ':[0-9]+:|:null:|\|\|' "$CODENARC_RESULT" > "$TMP_VIOLATIONS" || true + + while IFS=: read -r file line rest; do + [ -z "$file" ] && continue if echo "$file" | grep -q '||'; then file=$(echo "$file" | cut -d'|' -f1) line="" fi - [ -z "$file" ] && continue file_matches_patterns "$file" "$allowed_patterns" || continue + + priority_marker=$(echo "$rest" | grep -o '\[P[0-9]\]' | head -1) + if [ -n "$priority_marker" ]; then + [ "$priority_marker" != "[P1]" ] && continue + fi + if [ -z "$line" ] || [ "$line" = "null" ]; then if is_file_changed "$file"; then - echo "📍 Violação file-based em arquivo alterado: $file" - echo "1" > "$VIOLATIONS_FLAG" && break + echo "📍 Violação P1 file-based em arquivo alterado: $file" + echo "1" > "$VIOLATIONS_FLAG" + break fi elif is_line_changed "$line" "$file"; then - echo "📍 Violação em linha alterada: $file:$line" - echo "1" > "$VIOLATIONS_FLAG" && break + echo "📍 Violação P1 em linha alterada: $file:$line" + echo "1" > "$VIOLATIONS_FLAG" + break fi - done - + done < "$TMP_VIOLATIONS" + + rm -f "$TMP_VIOLATIONS" + if [ "$(cat "$VIOLATIONS_FLAG")" -eq 1 ]; then - echo "⛔ P1s existem E há violações em linhas alteradas" - echo "💡 Corrija as violacoes ou use o bypass autorizado pelo coordenador." + echo "⛔ P1 encontrada em linha/arquivo alterado" + echo "💡 Corrija as violações ou utilize o bypass autorizado." exit 1 else - echo "✅ P1s existem mas fora das linhas alteradas → merge permitido" + echo "✅ Existência de P1 fora das linhas alteradas → merge permitido" fi } +# ========== EXECUÇÃO PRINCIPAL ========== if [ -n "${GITHUB_WORKSPACE}" ]; then cd "${GITHUB_WORKSPACE}/${INPUT_WORKDIR}" || exit git config --global --add safe.directory "$GITHUB_WORKSPACE" diff --git a/testdata/basic.xml b/testdata/basic.xml index 54df9b7..942ddc2 100644 --- a/testdata/basic.xml +++ b/testdata/basic.xml @@ -1,52 +1,213 @@ + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://codenarc.org/ruleset/1.0 http://codenarc.org/ruleset-schema.xsd" + xsi:noNamespaceSchemaLocation="http://codenarc.org/ruleset-schema.xsd"> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/testdata/subdir/text.md b/testdata/subdir/text.md deleted file mode 100644 index 5b33346..0000000 --- a/testdata/subdir/text.md +++ /dev/null @@ -1,2 +0,0 @@ -Determinisitic result is important! - diff --git a/testdata/test.groovy b/testdata/test.groovy index 0897f5c..6feb46a 100644 --- a/testdata/test.groovy +++ b/testdata/test.groovy @@ -1,13 +1,41 @@ package test +import org.springframework.web.util.UriComponentsBuilder + class Test { + // P1 - ForceHttps + String url = "http://example.com" + + // P1 - VerifyUriComponentsBuilderVulnerability + UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl("test") + boolean before() { - return true + return true // P2 - ImplicitReturnStatement } - boolean after() { true } + boolean after() { true } // P2 - ImplicitReturnStatement - void after() { + void after() { // P2 - EmptyMethod + } + + // P2 - Multiple violations + def x = new ArrayList() // P2 - ExplicitArrayListInstantiation + String msg = 'Hello ${name}' // P2 - GStringExpressionWithinString + + void testMethod() { + if (true) { // P2 - ConstantIfExpression + println "test" // P2 - PrintlnRule + } + + // P2 - AssignmentInConditional + if (x = 5) { + return + } + + // P2 - ComparisonWithSelf + if (x == x) { + return + } } -} +} \ No newline at end of file diff --git a/testdata/text.md b/testdata/text.md deleted file mode 100644 index 5025db8..0000000 --- a/testdata/text.md +++ /dev/null @@ -1,5 +0,0 @@ -Determinisitic result is important. - -colour # <= Check -locale - -langauge From d0d736523ec52107647ca078fd212663ee6c1216 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Fri, 16 Jan 2026 14:20:42 -0300 Subject: [PATCH 02/15] adicionando log --- entrypoint.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/entrypoint.sh b/entrypoint.sh index c26aee0..8598983 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -32,6 +32,9 @@ run_codenarc() { -basedir="." \ $includes_arg \ > "$CODENARC_RESULT" + + echo "📋 Saída do CodeNarc:" + cat "$CODENARC_RESULT" } # ========== ETAPA 2 - REVIEWDOG ========== From 59e73fc94de2b71c65b9799c9af8bc5a7ce0ce41 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Fri, 16 Jan 2026 14:24:05 -0300 Subject: [PATCH 03/15] adicionando log --- entrypoint.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/entrypoint.sh b/entrypoint.sh index 8598983..a312b45 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -33,8 +33,11 @@ run_codenarc() { $includes_arg \ > "$CODENARC_RESULT" + echo "" echo "📋 Saída do CodeNarc:" + echo "" cat "$CODENARC_RESULT" + echo "" } # ========== ETAPA 2 - REVIEWDOG ========== From 40ac0775077b98694e2c544d858c300e02dbb242 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Fri, 16 Jan 2026 14:29:16 -0300 Subject: [PATCH 04/15] adicionando log --- entrypoint.sh | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index a312b45..aef7f5c 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -32,12 +32,9 @@ run_codenarc() { -basedir="." \ $includes_arg \ > "$CODENARC_RESULT" - - echo "" - echo "📋 Saída do CodeNarc:" - echo "" - cat "$CODENARC_RESULT" - echo "" + + echo -e "\n📋 Saída do CodeNarc:\n" + cat "$CODENARC_RESULT" && echo -e "\n" } # ========== ETAPA 2 - REVIEWDOG ========== From dcb4116997dfcd1b825911e0e67d0535b0109b00 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Fri, 16 Jan 2026 14:34:06 -0300 Subject: [PATCH 05/15] adicionando log --- entrypoint.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index aef7f5c..2c1b137 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -33,8 +33,11 @@ run_codenarc() { $includes_arg \ > "$CODENARC_RESULT" - echo -e "\n📋 Saída do CodeNarc:\n" - cat "$CODENARC_RESULT" && echo -e "\n" + printf '\n' + echo "📋 Saída do CodeNarc:" + printf '\n' + cat "$CODENARC_RESULT" + printf '\n' } # ========== ETAPA 2 - REVIEWDOG ========== From 4f5695c39ae9a3111a17f1a05a2ba24859982987 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Fri, 16 Jan 2026 14:34:28 -0300 Subject: [PATCH 06/15] adicionando log --- entrypoint.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 2c1b137..943f18f 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -33,11 +33,11 @@ run_codenarc() { $includes_arg \ > "$CODENARC_RESULT" - printf '\n' + printf '\n\n' echo "📋 Saída do CodeNarc:" printf '\n' cat "$CODENARC_RESULT" - printf '\n' + printf '\n\n' } # ========== ETAPA 2 - REVIEWDOG ========== From 9befd716dea4a9896c4fc27148f395e569fbccfa Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Fri, 16 Jan 2026 14:36:57 -0300 Subject: [PATCH 07/15] adicionando log --- entrypoint.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 943f18f..cec26f0 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -33,11 +33,13 @@ run_codenarc() { $includes_arg \ > "$CODENARC_RESULT" - printf '\n\n' + echo " " + echo " " echo "📋 Saída do CodeNarc:" - printf '\n' + echo " " cat "$CODENARC_RESULT" - printf '\n\n' + echo " " + echo " " } # ========== ETAPA 2 - REVIEWDOG ========== From 33f1f1df53f45a655c1b36fd2ced1461dd16bedc Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Mon, 19 Jan 2026 15:43:36 -0300 Subject: [PATCH 08/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- README.md | 10 +++-- entrypoint.sh | 52 +++++++++++++++++++---- testdata/basic.xml | 100 ++++++++++++++++++++++----------------------- 3 files changed, 101 insertions(+), 61 deletions(-) diff --git a/README.md b/README.md index c303326..c06d15f 100644 --- a/README.md +++ b/README.md @@ -7,11 +7,15 @@ CodeNarc image with reviewdog. ## Test local -``` -# build image +### build image + +```bash docker build -t docker.io/asaasdev/codenarc . +``` # run container + +```bash docker run --rm \ --workdir /testdata \ -e INPUT_REPORTER=local \ @@ -19,7 +23,7 @@ docker run --rm \ -e INPUT_FAIL_ON_ERROR=false \ -e INPUT_LEVEL=error \ -e INPUT_RULESETFILES=file:basic.xml \ + -e INPUT_RULESETS_CONTENT="$(cat testdata/basic.xml)" \ -v $(pwd)/testdata:/testdata \ docker.io/asaasdev/codenarc - ``` \ No newline at end of file diff --git a/entrypoint.sh b/entrypoint.sh index cec26f0..e28f9d7 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -82,9 +82,9 @@ run_reviewdog() { true > "${FILE_VIOLATIONS}.formatted" while read -r violation; do if echo "$violation" | grep -q '||'; then - echo "$violation" | sed 's/||/::/' + echo "$violation" | sed 's/||/::/g' else - echo "$violation" | sed 's/:null:/::/' + echo "$violation" | sed 's/:null:/::/g' fi done < "$FILE_VIOLATIONS" > "${FILE_VIOLATIONS}.formatted" @@ -170,6 +170,38 @@ build_changed_lines_cache() { } # ========== FUNÇÕES AUXILIARES ========== +get_rule_priority() { + rule_name="$1" + + # Busca por property name='RuleName' primeiro (override no XML) + priority=$(echo "$INPUT_RULESETS_CONTENT" | grep -B 2 "name='$rule_name'" | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) + + # Se não encontrou, busca por class que termina com RuleNameRule (adiciona sufixo Rule) + if [ -z "$priority" ]; then + priority=$(echo "$INPUT_RULESETS_CONTENT" | grep "class='[^']*${rule_name}Rule'" -A 5 | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) + fi + + # Se ainda não encontrou, tenta sem adicionar Rule (pode já ter o sufixo) + if [ -z "$priority" ]; then + priority=$(echo "$INPUT_RULESETS_CONTENT" | grep "class='[^']*${rule_name}'" -A 5 | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) + fi + + # Se ainda não encontrou, busca em rule-script com property name + if [ -z "$priority" ]; then + priority=$(echo "$INPUT_RULESETS_CONTENT" | grep -A 3 "path='[^']*${rule_name}" | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) + fi + + echo "${priority:-2}" +} + +extract_rule_name() { + violation_line="$1" + + # Formato: file:line:RuleName Message ou file:null:RuleName Message + # Extrai apenas o RuleName (terceiro campo após os dois pontos) + echo "$violation_line" | sed -E 's/^[^:]+:[^:]+:([A-Za-z0-9]+).*/\1/' +} + get_p1_count() { p1_count=$(grep -Eo "p1=[0-9]+" "$CODENARC_RESULT" | cut -d'=' -f2 | head -1) echo "${p1_count:-0}" @@ -219,26 +251,30 @@ check_blocking_rules() { while IFS=: read -r file line rest; do [ -z "$file" ] && continue + + # Trata file-based violations (formato com ||) if echo "$file" | grep -q '||'; then file=$(echo "$file" | cut -d'|' -f1) line="" fi + file_matches_patterns "$file" "$allowed_patterns" || continue - priority_marker=$(echo "$rest" | grep -o '\[P[0-9]\]' | head -1) + # Extrai o nome da regra e busca a priority no XML + rule_name=$(extract_rule_name "$file:$line:$rest") + priority=$(get_rule_priority "$rule_name") - if [ -n "$priority_marker" ]; then - [ "$priority_marker" != "[P1]" ] && continue - fi + [ "$priority" != "1" ] && continue + # Verifica se é file-based ou line-based if [ -z "$line" ] || [ "$line" = "null" ]; then if is_file_changed "$file"; then - echo "📍 Violação P1 file-based em arquivo alterado: $file" + echo "📍 Violação P1 ($rule_name) file-based em arquivo alterado: $file" echo "1" > "$VIOLATIONS_FLAG" break fi elif is_line_changed "$line" "$file"; then - echo "📍 Violação P1 em linha alterada: $file:$line" + echo "📍 Violação P1 ($rule_name) em linha alterada: $file:$line" echo "1" > "$VIOLATIONS_FLAG" break fi diff --git a/testdata/basic.xml b/testdata/basic.xml index 942ddc2..86df763 100644 --- a/testdata/basic.xml +++ b/testdata/basic.xml @@ -7,207 +7,207 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + \ No newline at end of file From 8a3e0e9ddb88b1311604ba0846d69297d1318dce Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Mon, 19 Jan 2026 16:53:06 -0300 Subject: [PATCH 09/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- entrypoint.sh | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index e28f9d7..baac6fb 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -238,15 +238,20 @@ check_blocking_rules() { [ ! -f "$CODENARC_RESULT" ] && echo "❌ Resultado não encontrado" && return 1 p1_count=$(get_p1_count) - echo "📊 Total de P1 encontradas no resumo: ${p1_count:-0}" - [ "$p1_count" -eq 0 ] && { echo "✅ Nenhuma P1 detectada → merge permitido"; return 0; } + + if [ "$p1_count" -eq 0 ]; then + echo "✅ Nenhuma violação P1 detectada" + return 0 + fi - echo "⚙️ Preparando diff..." + echo "📊 Violações P1 nos arquivos analisados: ${p1_count:-0}" + echo "⚙️ Analisando diff para identificar P1 em linhas/arquivos alterados..." build_changed_lines_cache allowed_patterns=$(get_allowed_patterns) - [ -n "$allowed_patterns" ] && echo "🧩 Filtrando por INPUT_SOURCE_FILES" + [ -n "$allowed_patterns" ] && echo "🧩 Aplicando filtro de arquivos: INPUT_SOURCE_FILES" echo "0" > "$VIOLATIONS_FLAG" + p1_in_diff=0 grep -E ':[0-9]+:|:null:|\|\|' "$CODENARC_RESULT" > "$TMP_VIOLATIONS" || true while IFS=: read -r file line rest; do @@ -269,25 +274,28 @@ check_blocking_rules() { # Verifica se é file-based ou line-based if [ -z "$line" ] || [ "$line" = "null" ]; then if is_file_changed "$file"; then - echo "📍 Violação P1 ($rule_name) file-based em arquivo alterado: $file" + p1_in_diff=$((p1_in_diff + 1)) + echo " ⛔ P1 #$p1_in_diff: $rule_name (file-based) em $file" echo "1" > "$VIOLATIONS_FLAG" - break fi elif is_line_changed "$line" "$file"; then - echo "📍 Violação P1 ($rule_name) em linha alterada: $file:$line" + p1_in_diff=$((p1_in_diff + 1)) + echo " ⛔ P1 #$p1_in_diff: $rule_name na linha $line de $file" echo "1" > "$VIOLATIONS_FLAG" - break fi done < "$TMP_VIOLATIONS" rm -f "$TMP_VIOLATIONS" + echo "" if [ "$(cat "$VIOLATIONS_FLAG")" -eq 1 ]; then - echo "⛔ P1 encontrada em linha/arquivo alterado" - echo "💡 Corrija as violações ou utilize o bypass autorizado." + echo "❌ BLOQUEIO: $p1_in_diff violação(ões) P1 encontrada(s) em linhas/arquivos alterados do PR" + echo "💡 Corrija as violações acima ou utilize o bypass autorizado" exit 1 else - echo "✅ Existência de P1 fora das linhas alteradas → merge permitido" + p1_outside_diff=$((p1_count - p1_in_diff)) + echo "✅ APROVADO: Nenhuma violação P1 em linhas/arquivos alterados do PR" + [ "$p1_outside_diff" -gt 0 ] && echo "ℹ️ ${p1_outside_diff} violação(ões) P1 em código não modificado (não bloqueia)" fi } From b4a22bc195c4b65780b2cb2344aa929abda945e8 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Mon, 19 Jan 2026 17:17:12 -0300 Subject: [PATCH 10/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- entrypoint.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index baac6fb..cf6fb0a 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -67,12 +67,16 @@ separate_violations() { } run_reviewdog() { - echo "📤 Enviando resultados para reviewdog..." - separate_violations + has_violations=false + [ -s "$LINE_VIOLATIONS" ] || [ -s "$FILE_VIOLATIONS" ] && has_violations=true + + if [ "$has_violations" = true ]; then + echo "📤 Enviando resultados para reviewdog..." + fi + if [ -s "$LINE_VIOLATIONS" ]; then - echo "📤 Enviando violações line-based (${INPUT_REPORTER:-github-pr-check})..." run_reviewdog_with_config "$LINE_VIOLATIONS" "%f:%l:%m" \ "${INPUT_REPORTER:-github-pr-check}" "codenarc" \ "${INPUT_FILTER_MODE}" "${INPUT_LEVEL}" From 14fcf567a54d994017c40709bbd6b1d649e2f8bd Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Mon, 19 Jan 2026 17:28:35 -0300 Subject: [PATCH 11/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- entrypoint.sh | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index cf6fb0a..9428a58 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -69,13 +69,18 @@ separate_violations() { run_reviewdog() { separate_violations - has_violations=false - [ -s "$LINE_VIOLATIONS" ] || [ -s "$FILE_VIOLATIONS" ] && has_violations=true - - if [ "$has_violations" = true ]; then - echo "📤 Enviando resultados para reviewdog..." + if [ ! -s "$LINE_VIOLATIONS" ] && [ ! -s "$FILE_VIOLATIONS" ]; then + if grep -qE ':[0-9]+:|:null:|\|\|' "$CODENARC_RESULT"; then + echo "📤 Enviando resultados para reviewdog..." + run_reviewdog_with_config "$CODENARC_RESULT" "%f:%l:%m" \ + "${INPUT_REPORTER:-github-pr-check}" "codenarc" \ + "${INPUT_FILTER_MODE}" "${INPUT_LEVEL}" + fi + return fi + echo "📤 Enviando resultados para reviewdog..." + if [ -s "$LINE_VIOLATIONS" ]; then run_reviewdog_with_config "$LINE_VIOLATIONS" "%f:%l:%m" \ "${INPUT_REPORTER:-github-pr-check}" "codenarc" \ @@ -100,12 +105,6 @@ run_reviewdog() { "github-pr-check" "codenarc" "nofilter" "warning" fi fi - - if [ ! -s "$LINE_VIOLATIONS" ] && [ ! -s "$FILE_VIOLATIONS" ]; then - run_reviewdog_with_config "$CODENARC_RESULT" "%f:%l:%m" \ - "${INPUT_REPORTER:-github-pr-check}" "codenarc" \ - "${INPUT_FILTER_MODE}" "${INPUT_LEVEL}" - fi } generate_git_diff() { From bb8fcaf3edbea5ad8b78a518af94727d73d64653 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Mon, 19 Jan 2026 17:43:56 -0300 Subject: [PATCH 12/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- entrypoint.sh | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 9428a58..a11dbfa 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -33,13 +33,11 @@ run_codenarc() { $includes_arg \ > "$CODENARC_RESULT" - echo " " - echo " " + echo "" echo "📋 Saída do CodeNarc:" - echo " " + echo "" cat "$CODENARC_RESULT" - echo " " - echo " " + echo "" } # ========== ETAPA 2 - REVIEWDOG ========== @@ -70,12 +68,6 @@ run_reviewdog() { separate_violations if [ ! -s "$LINE_VIOLATIONS" ] && [ ! -s "$FILE_VIOLATIONS" ]; then - if grep -qE ':[0-9]+:|:null:|\|\|' "$CODENARC_RESULT"; then - echo "📤 Enviando resultados para reviewdog..." - run_reviewdog_with_config "$CODENARC_RESULT" "%f:%l:%m" \ - "${INPUT_REPORTER:-github-pr-check}" "codenarc" \ - "${INPUT_FILTER_MODE}" "${INPUT_LEVEL}" - fi return fi @@ -105,6 +97,8 @@ run_reviewdog() { "github-pr-check" "codenarc" "nofilter" "warning" fi fi + + echo "" } generate_git_diff() { @@ -244,11 +238,12 @@ check_blocking_rules() { if [ "$p1_count" -eq 0 ]; then echo "✅ Nenhuma violação P1 detectada" + echo "" return 0 fi echo "📊 Violações P1 nos arquivos analisados: ${p1_count:-0}" - echo "⚙️ Analisando diff para identificar P1 em linhas/arquivos alterados..." + echo "⚙️ Analisando diff para identificar P1 em linhas/arquivos alterados..." build_changed_lines_cache allowed_patterns=$(get_allowed_patterns) [ -n "$allowed_patterns" ] && echo "🧩 Aplicando filtro de arquivos: INPUT_SOURCE_FILES" @@ -300,6 +295,8 @@ check_blocking_rules() { echo "✅ APROVADO: Nenhuma violação P1 em linhas/arquivos alterados do PR" [ "$p1_outside_diff" -gt 0 ] && echo "ℹ️ ${p1_outside_diff} violação(ões) P1 em código não modificado (não bloqueia)" fi + + echo "" } # ========== EXECUÇÃO PRINCIPAL ========== From f9232ab8b6697aadb5d1fbc0078ae96199519853 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Mon, 19 Jan 2026 17:52:35 -0300 Subject: [PATCH 13/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- entrypoint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/entrypoint.sh b/entrypoint.sh index a11dbfa..7cbdebe 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -68,7 +68,7 @@ run_reviewdog() { separate_violations if [ ! -s "$LINE_VIOLATIONS" ] && [ ! -s "$FILE_VIOLATIONS" ]; then - return + return 0 fi echo "📤 Enviando resultados para reviewdog..." From 0d57370ea2ad52610097a4426cc5e6d14e5e7532 Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Mon, 19 Jan 2026 18:08:35 -0300 Subject: [PATCH 14/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- entrypoint.sh | 48 +++++++++++++++++++++++++++--------------------- 1 file changed, 27 insertions(+), 21 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 7cbdebe..44978c6 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -33,11 +33,14 @@ run_codenarc() { $includes_arg \ > "$CODENARC_RESULT" + echo "" echo "" echo "📋 Saída do CodeNarc:" echo "" + echo "" cat "$CODENARC_RESULT" echo "" + echo "" } # ========== ETAPA 2 - REVIEWDOG ========== @@ -60,8 +63,8 @@ run_reviewdog_with_config() { } separate_violations() { - grep -E ':[0-9]+:' "$CODENARC_RESULT" > "$LINE_VIOLATIONS" || true - grep -E ':null:|\|\|' "$CODENARC_RESULT" > "$FILE_VIOLATIONS" || true + grep -E '^[^:]+:[0-9]+:' "$CODENARC_RESULT" > "$LINE_VIOLATIONS" || true + grep -E '^[^:]+:(null:|\|\|)' "$CODENARC_RESULT" > "$FILE_VIOLATIONS" || true } run_reviewdog() { @@ -72,6 +75,8 @@ run_reviewdog() { fi echo "📤 Enviando resultados para reviewdog..." + echo "" + echo "" if [ -s "$LINE_VIOLATIONS" ]; then run_reviewdog_with_config "$LINE_VIOLATIONS" "%f:%l:%m" \ @@ -97,8 +102,6 @@ run_reviewdog() { "github-pr-check" "codenarc" "nofilter" "warning" fi fi - - echo "" } generate_git_diff() { @@ -152,10 +155,10 @@ build_changed_lines_cache() { range_info=$(parse_diff_range "$range") start=$(echo "$range_info" | cut -d' ' -f1) count=$(echo "$range_info" | cut -d' ' -f2) - + case "$start" in ''|*[!0-9]*) continue ;; esac case "$count" in ''|*[!0-9]*) continue ;; esac - + i="$start" while [ "$i" -lt "$((start + count))" ]; do echo "$current_file:$i" >> "$CHANGED_LINES_CACHE" @@ -169,31 +172,31 @@ build_changed_lines_cache() { # ========== FUNÇÕES AUXILIARES ========== get_rule_priority() { rule_name="$1" - + # Busca por property name='RuleName' primeiro (override no XML) priority=$(echo "$INPUT_RULESETS_CONTENT" | grep -B 2 "name='$rule_name'" | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) - + # Se não encontrou, busca por class que termina com RuleNameRule (adiciona sufixo Rule) if [ -z "$priority" ]; then priority=$(echo "$INPUT_RULESETS_CONTENT" | grep "class='[^']*${rule_name}Rule'" -A 5 | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) fi - + # Se ainda não encontrou, tenta sem adicionar Rule (pode já ter o sufixo) if [ -z "$priority" ]; then priority=$(echo "$INPUT_RULESETS_CONTENT" | grep "class='[^']*${rule_name}'" -A 5 | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) fi - + # Se ainda não encontrou, busca em rule-script com property name if [ -z "$priority" ]; then priority=$(echo "$INPUT_RULESETS_CONTENT" | grep -A 3 "path='[^']*${rule_name}" | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) fi - + echo "${priority:-2}" } extract_rule_name() { violation_line="$1" - + # Formato: file:line:RuleName Message ou file:null:RuleName Message # Extrai apenas o RuleName (terceiro campo após os dois pontos) echo "$violation_line" | sed -E 's/^[^:]+:[^:]+:([A-Za-z0-9]+).*/\1/' @@ -211,9 +214,9 @@ get_allowed_patterns() { file_matches_patterns() { file="$1" patterns="$2" - + [ -z "$patterns" ] && return 0 - + for pattern in $patterns; do echo "$file" | grep -Eq "$pattern" && return 0 done @@ -231,14 +234,15 @@ is_file_changed() { # ========== ETAPA 4 - BLOQUEIO POR P1 ========== check_blocking_rules() { echo "🔎 Verificando violações bloqueantes (priority 1)..." - + [ ! -f "$CODENARC_RESULT" ] && echo "❌ Resultado não encontrado" && return 1 p1_count=$(get_p1_count) - + if [ "$p1_count" -eq 0 ]; then echo "✅ Nenhuma violação P1 detectada" echo "" + echo "" return 0 fi @@ -250,23 +254,23 @@ check_blocking_rules() { echo "0" > "$VIOLATIONS_FLAG" p1_in_diff=0 - grep -E ':[0-9]+:|:null:|\|\|' "$CODENARC_RESULT" > "$TMP_VIOLATIONS" || true + grep -E '^[^:]+:[0-9]+:|^[^:]+:(null:|\|\|)' "$CODENARC_RESULT" > "$TMP_VIOLATIONS" || true while IFS=: read -r file line rest; do [ -z "$file" ] && continue - + # Trata file-based violations (formato com ||) if echo "$file" | grep -q '||'; then file=$(echo "$file" | cut -d'|' -f1) line="" fi - + file_matches_patterns "$file" "$allowed_patterns" || continue # Extrai o nome da regra e busca a priority no XML rule_name=$(extract_rule_name "$file:$line:$rest") priority=$(get_rule_priority "$rule_name") - + [ "$priority" != "1" ] && continue # Verifica se é file-based ou line-based @@ -285,6 +289,7 @@ check_blocking_rules() { rm -f "$TMP_VIOLATIONS" + echo "" echo "" if [ "$(cat "$VIOLATIONS_FLAG")" -eq 1 ]; then echo "❌ BLOQUEIO: $p1_in_diff violação(ões) P1 encontrada(s) em linhas/arquivos alterados do PR" @@ -295,7 +300,8 @@ check_blocking_rules() { echo "✅ APROVADO: Nenhuma violação P1 em linhas/arquivos alterados do PR" [ "$p1_outside_diff" -gt 0 ] && echo "ℹ️ ${p1_outside_diff} violação(ões) P1 em código não modificado (não bloqueia)" fi - + + echo "" echo "" } From 73a1ec923c650f000741d4c77ee6248ceed3264f Mon Sep 17 00:00:00 2001 From: "ana.alves" Date: Wed, 21 Jan 2026 08:20:11 -0300 Subject: [PATCH 15/15] refactor: consulta priority do XML ao inves de marcadores P1/P2 --- entrypoint.sh | 54 ++++++--------------------------------------------- 1 file changed, 6 insertions(+), 48 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 44978c6..3de258f 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,7 +1,6 @@ #!/bin/sh set -e -# ========== ARQUIVOS TEMPORÁRIOS ========== CODENARC_RESULT="result.txt" LINE_VIOLATIONS="line_violations.txt" FILE_VIOLATIONS="file_violations.txt" @@ -18,11 +17,9 @@ cleanup_temp_files() { } trap 'cleanup_temp_files' EXIT -# ========== ETAPA 1 - EXECUTA CODENARC ========== run_codenarc() { report="${INPUT_REPORT:-compact:stdout}" includes_arg="" - [ -n "$INPUT_SOURCE_FILES" ] && includes_arg="-includes=${INPUT_SOURCE_FILES}" echo "🔍 Executando CodeNarc..." @@ -30,20 +27,15 @@ run_codenarc() { -report="$report" \ -rulesetfiles="${INPUT_RULESETFILES}" \ -basedir="." \ - $includes_arg \ - > "$CODENARC_RESULT" + $includes_arg > "$CODENARC_RESULT" - echo "" echo "" echo "📋 Saída do CodeNarc:" echo "" - echo "" cat "$CODENARC_RESULT" echo "" - echo "" } -# ========== ETAPA 2 - REVIEWDOG ========== run_reviewdog_with_config() { input_file="$1" efm="$2" @@ -68,15 +60,14 @@ separate_violations() { } run_reviewdog() { - separate_violations - - if [ ! -s "$LINE_VIOLATIONS" ] && [ ! -s "$FILE_VIOLATIONS" ]; then + if ! grep -qE '^[^:]+:[0-9]+:|^[^:]+:(null:|\|\|)' "$CODENARC_RESULT"; then return 0 fi + separate_violations + echo "📤 Enviando resultados para reviewdog..." echo "" - echo "" if [ -s "$LINE_VIOLATIONS" ]; then run_reviewdog_with_config "$LINE_VIOLATIONS" "%f:%l:%m" \ @@ -85,7 +76,6 @@ run_reviewdog() { fi if [ -s "$FILE_VIOLATIONS" ]; then - true > "${FILE_VIOLATIONS}.formatted" while read -r violation; do if echo "$violation" | grep -q '||'; then echo "$violation" | sed 's/||/::/g' @@ -169,37 +159,23 @@ build_changed_lines_cache() { done < "$ALL_DIFF" } -# ========== FUNÇÕES AUXILIARES ========== get_rule_priority() { rule_name="$1" - - # Busca por property name='RuleName' primeiro (override no XML) priority=$(echo "$INPUT_RULESETS_CONTENT" | grep -B 2 "name='$rule_name'" | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) - - # Se não encontrou, busca por class que termina com RuleNameRule (adiciona sufixo Rule) if [ -z "$priority" ]; then priority=$(echo "$INPUT_RULESETS_CONTENT" | grep "class='[^']*${rule_name}Rule'" -A 5 | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) fi - - # Se ainda não encontrou, tenta sem adicionar Rule (pode já ter o sufixo) if [ -z "$priority" ]; then priority=$(echo "$INPUT_RULESETS_CONTENT" | grep "class='[^']*${rule_name}'" -A 5 | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) fi - - # Se ainda não encontrou, busca em rule-script com property name if [ -z "$priority" ]; then priority=$(echo "$INPUT_RULESETS_CONTENT" | grep -A 3 "path='[^']*${rule_name}" | grep -o 'priority" value="[0-9]' | head -1 | cut -d'"' -f3) fi - echo "${priority:-2}" } extract_rule_name() { - violation_line="$1" - - # Formato: file:line:RuleName Message ou file:null:RuleName Message - # Extrai apenas o RuleName (terceiro campo após os dois pontos) - echo "$violation_line" | sed -E 's/^[^:]+:[^:]+:([A-Za-z0-9]+).*/\1/' + echo "$1" | sed -E 's/^[^:]+:[^:]+:([A-Za-z0-9]+).*/\1/' } get_p1_count() { @@ -214,9 +190,7 @@ get_allowed_patterns() { file_matches_patterns() { file="$1" patterns="$2" - [ -z "$patterns" ] && return 0 - for pattern in $patterns; do echo "$file" | grep -Eq "$pattern" && return 0 done @@ -231,18 +205,14 @@ is_file_changed() { grep -q "^$1$" "$CHANGED_FILES_CACHE" } -# ========== ETAPA 4 - BLOQUEIO POR P1 ========== check_blocking_rules() { echo "🔎 Verificando violações bloqueantes (priority 1)..." - [ ! -f "$CODENARC_RESULT" ] && echo "❌ Resultado não encontrado" && return 1 p1_count=$(get_p1_count) - if [ "$p1_count" -eq 0 ]; then echo "✅ Nenhuma violação P1 detectada" echo "" - echo "" return 0 fi @@ -258,22 +228,15 @@ check_blocking_rules() { while IFS=: read -r file line rest; do [ -z "$file" ] && continue - - # Trata file-based violations (formato com ||) if echo "$file" | grep -q '||'; then file=$(echo "$file" | cut -d'|' -f1) line="" fi - file_matches_patterns "$file" "$allowed_patterns" || continue - - # Extrai o nome da regra e busca a priority no XML rule_name=$(extract_rule_name "$file:$line:$rest") priority=$(get_rule_priority "$rule_name") - [ "$priority" != "1" ] && continue - # Verifica se é file-based ou line-based if [ -z "$line" ] || [ "$line" = "null" ]; then if is_file_changed "$file"; then p1_in_diff=$((p1_in_diff + 1)) @@ -288,8 +251,6 @@ check_blocking_rules() { done < "$TMP_VIOLATIONS" rm -f "$TMP_VIOLATIONS" - - echo "" echo "" if [ "$(cat "$VIOLATIONS_FLAG")" -eq 1 ]; then echo "❌ BLOQUEIO: $p1_in_diff violação(ões) P1 encontrada(s) em linhas/arquivos alterados do PR" @@ -300,12 +261,9 @@ check_blocking_rules() { echo "✅ APROVADO: Nenhuma violação P1 em linhas/arquivos alterados do PR" [ "$p1_outside_diff" -gt 0 ] && echo "ℹ️ ${p1_outside_diff} violação(ões) P1 em código não modificado (não bloqueia)" fi - - echo "" echo "" } -# ========== EXECUÇÃO PRINCIPAL ========== if [ -n "${GITHUB_WORKSPACE}" ]; then cd "${GITHUB_WORKSPACE}/${INPUT_WORKDIR}" || exit git config --global --add safe.directory "$GITHUB_WORKSPACE" @@ -317,4 +275,4 @@ run_codenarc run_reviewdog check_blocking_rules -echo "🏁 Concluído com sucesso" \ No newline at end of file +echo "🏁 Concluído com sucesso"