Violations Command Line

This is a command line tool that will find report files from static code analysis, present and optionally fail the command. It uses the Violations Lib.

The runnable can be found in Maven Central
or NPM.
The Docker image can be found in Dockerhub
- Can used like docker run --mount src="$(pwd)",target=/home/violations-command-line,type=bind tomasbjerre/violations-command-line:a.b.c -v "FINDBUGS" src/test/resources/findbugs/ ".*main\.xml$" "Spotbugs".
- Or open a shell to have a look docker run --rm -it --entrypoint sh tomasbjerre/violations-command-line:a.b.c

Version	Java Version
version < 2.0.0	8
2.0.0 <= version	11

Run it with:

npx violations-command-line -s ERROR -mv 0 \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
 -v "JSLINT" "." ".*jshint/report\.xml$" "JSHint"

It can parse results from static code analysis and:

Report violations in the build log.
Export to a normalized JSON format.

npx violations-command-line -vf violations-report.json \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"

Export to CodeClimate JSON.

npx violations-command-line -cc code-climate-report.json \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"

Export to Sarif JSON.

npx violations-command-line -sa sarif-report.json \
 -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle"

Optionally fail the build depending on violations found.

A snippet of the output may look like this:

...
se/bjurr/violations/lib/example/OtherClass.java
╔══════════╤════════════╤══════════╤══════╤════════════════════════════════════════════════════╗
║ Reporter │ Rule       │ Severity │ Line │ Message                                            ║
╠══════════╪════════════╪══════════╪══════╪════════════════════════════════════════════════════╣
║ Findbugs │ MS_SHOULD_ │ INFO     │ 7    │ Field isn't final but should be                    ║
║          │ BE_FINAL   │          │      │                                                    ║
║          │            │          │      │                                                    ║
║          │            │          │      │    <p>                                             ║
║          │            │          │      │ This static field public but not final, and        ║
║          │            │          │      │ could be changed by malicious code or              ║
║          │            │          │      │         by accident from another package.          ║
║          │            │          │      │         The field could be made final to avoid     ║
║          │            │          │      │         this vulnerability.</p>                    ║
╟──────────┼────────────┼──────────┼──────┼────────────────────────────────────────────────────╢
║ Findbugs │ NM_FIELD_N │ INFO     │ 6    │ Field names should start with a lower case letter  ║
║          │ AMING_CONV │          │      │                                                    ║
║          │ ENTION     │          │      │                                                    ║
║          │            │          │      │   <p>                                              ║
║          │            │          │      │ Names of fields that are not final should be in mi ║
║          │            │          │      │ xed case with a lowercase first letter and the fir ║
║          │            │          │      │ st letters of subsequent words capitalized.        ║
║          │            │          │      │ </p>                                               ║
╚══════════╧════════════╧══════════╧══════╧════════════════════════════════════════════════════╝

Summary of se/bjurr/violations/lib/example/OtherClass.java
╔══════════╤══════╤══════╤═══════╤═══════╗
║ Reporter │ INFO │ WARN │ ERROR │ Total ║
╠══════════╪══════╪══════╪═══════╪═══════╣
║ Findbugs │ 2    │ 0    │ 0     │ 2     ║
╟──────────┼──────┼──────┼───────┼───────╢
║          │ 2    │ 0    │ 0     │ 2     ║
╚══════════╧══════╧══════╧═══════╧═══════╝


Summary
╔════════════╤══════╤══════╤═══════╤═══════╗
║ Reporter   │ INFO │ WARN │ ERROR │ Total ║
╠════════════╪══════╪══════╪═══════╪═══════╣
║ Checkstyle │ 4    │ 1    │ 1     │ 6     ║
╟────────────┼──────┼──────┼───────┼───────╢
║ Findbugs   │ 2    │ 2    │ 5     │ 9     ║
╟────────────┼──────┼──────┼───────┼───────╢
║            │ 6    │ 3    │ 6     │ 15    ║
╚════════════╧══════╧══════╧═══════╧═══════╝

GitHub

GitHub is supported via SARIF. This tool can export SARIF format and it can be uploaded to Github to get feedback in pull-requests.

name: My workflow

on: [workflow_call, push, pull_request]

jobs:
  build:
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - name: Build
        run: |
          your-build-command-here
      - name: Transorm static code analysis to SARIF
        if: success() || failure()
        run: |
          npx violations-command-line -sarif sarif-report.json \
          -v "FINDBUGS" "." ".*spotbugs/main\.xml$" "Spotbugs" \
          -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
          -v "PMD" "." ".*pmd/main\.xml$" "PMD" \
          -v "JUNIT" "." ".*test/TEST-.*\.xml$" "JUNIT"
      - uses: github/codeql-action/upload-sarif@v3
        if: success() || failure()
        with:
          sarif_file: sarif-report.json
          category: violations-lib

GitLab

GitLab is supported via CodeClimate. This tool can export CodeClimate format and it can be uploaded to GitLab to get feedback in pull-requests.

If you export CodeClimate like this:

npx violations-command-line -cc code-climate-report.json \
  -v "FINDBUGS" "." ".*spotbugs/main\.xml$" "Spotbugs" \
  -v "CHECKSTYLE" "." ".*checkstyle/main\.xml$" "Checkstyle" \
  -v "PMD" "." ".*pmd/main\.xml$" "PMD" \
  -v "JUNIT" "." ".*test/TEST-.*\.xml$" "JUNIT"

You can upload it like this:

  artifacts:
    paths:
      - code-climate-report.json
    reports:
      codequality: code-climate-report.json

Formats

Example of supported reports are available here.

A number of parsers have been implemented. Some parsers can parse output from several reporters.

Reporter	Parser	Notes
ARM-GCC	`CLANG`
AndroidLint	`ANDROIDLINT`
Ansible-Later	`ANSIBLELATER`	With `json` format
AnsibleLint	`FLAKE8`	With `-p`
Bandit	`CLANG`	With `bandit -r examples/ -f custom -o bandit.out --msg-template "{abspath}:{line}: {severity}: {test_id}: {msg}"`
CLang	`CLANG`
CPD	`CPD`
CPPCheck	`CPPCHECK`	With `cppcheck test.cpp --output-file=cppcheck.xml --xml`
CPPLint	`CPPLINT`
CSSLint	`CSSLINT`
Checkstyle	`CHECKSTYLE`
CloudFormation Linter	`JUNIT`	`cfn-lint . -f junit --output-file report-junit.xml`
CodeClimate	`CODECLIMATE`
CodeNarc	`CODENARC`
Coverity	`COVERITY`
Dart	`MACHINE`	With `dart analyze --format=machine`
Dependency Check	`SARIF`	Using `--format SARIF`
Detekt	`CHECKSTYLE`	With `--output-format xml`.
DocFX	`DOCFX`
Doxygen	`CLANG`
ERB	`CLANG`	With `erb -P -x -T '-' "${it}" \| ruby -c 2>&1 >/dev/null \| grep '^-' \| sed -E 's/^-([a-zA-Z0-9:]+)/${filename}\1 ERROR:/p' > erbfiles.out`.
ESLint	`CHECKSTYLE`	With `format: 'checkstyle'`.
Findbugs	`FINDBUGS`
Flake8	`FLAKE8`
FxCop	`FXCOP`
GCC	`CLANG`
GHS	`GHS`
Gendarme	`GENDARME`
Generic reporter	`GENERIC`	Will create one single violation with all the content as message.
GoLint	`GOLINT`
GoVet	`GOLINT`	Same format as GoLint.
GolangCI-Lint	`CHECKSTYLE`	With `--out-format=checkstyle`.
GoogleErrorProne	`GOOGLEERRORPRONE`
HadoLint	`CHECKSTYLE`	With `-f checkstyle`
IAR	`IAR`	With `--no_wrap_diagnostics`
Infer	`PMD`	Facebook Infer. With `--pmd-xml`.
JACOCO	`JACOCO`
JCReport	`JCREPORT`
JSHint	`JSLINT`	With `--reporter=jslint` or the CHECKSTYLE parser with `--reporter=checkstyle`
JUnit	`JUNIT`	It only contains the failures.
KTLint	`CHECKSTYLE`
Klocwork	`KLOCWORK`
KotlinGradle	`KOTLINGRADLE`	Output from Kotlin Gradle Plugin.
KotlinMaven	`KOTLINMAVEN`	Output from Kotlin Maven Plugin.
Lint	`LINT`	A common XML format, used by different linters.
MSBuildLog	`MSBULDLOG`	With `-fileLogger` use `.*msbuild\\.log$` as pattern or `-fl -flp:logfile=MyProjectOutput.log;verbosity=diagnostic` for a custom output filename
MSCpp	`MSCPP`
Mccabe	`FLAKE8`
MyPy	`MYPY`
NullAway	`GOOGLEERRORPRONE`	Same format as Google Error Prone.
PCLint	`PCLINT`	PC-Lint using the same output format as the Jenkins warnings plugin, details here
PHPCS	`CHECKSTYLE`	With `phpcs api.php --report=checkstyle`.
PHPPMD	`PMD`	With `phpmd api.php xml ruleset.xml`.
PMD	`PMD`
Pep8	`FLAKE8`
PerlCritic	`PERLCRITIC`
PiTest	`PITEST`
ProtoLint	`PROTOLINT`
Puppet-Lint	`CLANG`	With `-log-format %{fullpath}:%{line}:%{column}: %{kind}: %{message}`
PyDocStyle	`PYDOCSTYLE`
PyFlakes	`FLAKE8`
PyLint	`PYLINT`	With `pylint --output-format=parseable`.
ReSharper	`RESHARPER`
RubyCop	`CLANG`	With `rubycop -f clang file.rb`
SARIF	`SARIF`	v2.x. Microsoft Visual C# can generate it with `ErrorLog="BuildErrors.sarif,version=2"`.
SbtScalac	`SBTSCALAC`
Scalastyle	`CHECKSTYLE`
Semgrep	`SEMGREP`	With `--json`.
Simian	`SIMIAN`
Sonar	`SONAR`	With `mvn sonar:sonar -Dsonar.analysis.mode=preview -Dsonar.report.export.path=sonar-report.json`. Removed in 7.7, see SONAR-11670 but can be retrieved with: `curl --silent 'http://sonar-server/api/issues/search?componentKeys=unique-key&resolved=false' \| jq -f sonar-report-builder.jq > sonar-report.json`.
Spotbugs	`FINDBUGS`
StyleCop	`STYLECOP`
SwiftLint	`CHECKSTYLE`	With `--reporter checkstyle`.
TSLint	`CHECKSTYLE`	With `-t checkstyle`
Valgrind	`VALGRIND`	With `--xml=yes`.
XMLLint	`XMLLINT`
XUnit	`XUNIT`	It only contains the failures.
YAMLLint	`YAMLLINT`	With `-f parsable`
ZPTLint	`ZPTLINT`

52 parsers and 79 reporters.

Missing a format? Open an issue here!

Usage

Available parsers are:
ANDROIDLINT, ANSIBLELATER, CHECKSTYLE, CODENARC, CLANG, COVERITY, CPD, CPPCHECK, CPPLINT, CSSLINT, GENERIC, GHS, FINDBUGS, FLAKE8, MACHINE, FXCOP, GENDARME, IAR, JACOCO, JCREPORT, JSLINT, JUNIT, LINT, KLOCWORK, KOTLINMAVEN, KOTLINGRADLE, MSCPP, MSBULDLOG, MYPY, GOLINT, GOOGLEERRORPRONE, PERLCRITIC, PITEST, PMD, PROTOLINT, PYDOCSTYLE, PYLINT, RESHARPER, SARIF, SBTSCALAC, SEMGREP, SIMIAN, SONAR, STYLECOP, XMLLINT, YAMLLINT, ZPTLINT, DOCFX, PCLINT, CODECLIMATE, XUNIT, VALGRIND

Usage: violations-command-line [-dpv] [--help] [-pv] [-show-debug-info]
                               [-show-json-config] [-cc=<codeClimateFileArg>]
                               [-cf=<configFileArg>] [-ddl=<diffDetailLevel>]
                               [-df=<diffFrom>] [-dl=<detailLevelArg>]
                               [-dmv=<diffMaxViolations>]
                               [-ds=<diffMinSeverity>] [-dt=<diffTo>]
                               [-gr=<gitRepoArg>] [-jmc=<jacocoMinCoverage>]
                               [-jmlc=<jacocoMinLineCount>]
                               [-mlcw=<maxLineColumnWidth>]
                               [-mmcw=<maxMessageColumnWidth>]
                               [-mrcw=<maxReporterColumnWidth>]
                               [-mrucw=<maxRuleColumnWidth>]
                               [-mscw=<maxSeverityColumnWidth>]
                               [-mv=<maxViolationsArg>] [-s=<minSeverityArg>]
                               [-ss=<sarifFileArg>] [-vf=<violationsFileArg>]
                               [-v=<violationsArg>]...
      -cc, -code-climate=<codeClimateFileArg>
                          Create a CodeClimate file with all the violations.
      -cf, -config-file=<configFileArg>
                          Will read config from given file. Can also be
                            configured with environment variable
                            VIOLATIONS_CONFIG. Format is what you get from
                            -show-json-config.
      -ddl, -diff-detail-level=<diffDetailLevel>
                          VERBOSE, COMPACT, PER_FILE_COMPACT
      -df, -diff-from=<diffFrom>
                          Can be empty (ignored), Git-commit or any
                            Git-reference
      -dl, -detail-level=<detailLevelArg>
                          Verbosity VERBOSE, COMPACT, PER_FILE_COMPACT
      -dmv, -diff-max-violations=<diffMaxViolations>
                          Will fail the build if total number of found
                            violations is higher
      -dpv, -diff-print-violations
                          Will print violations found in diff
      -ds, -diff-severity=<diffMinSeverity>
                          INFO, WARN, ERROR
      -dt, -diff-to=<diffTo>
                          Can be empty (ignored), Git-commit or any
                            Git-reference
      -gr, -git-repo=<gitRepoArg>
                          Where to look for Git.
      --help              display this help and exit
      -jmc, -jacoco-min-coverage=<jacocoMinCoverage>
                          Minimum coverage in Jacoco that will generate a
                            violation.
      -jmlc, -jacoco-min-line-count=<jacocoMinLineCount>
                          Minimum line count in Jacoco that will generate a
                            violation.
      -mlcw, -max-line-column-width=<maxLineColumnWidth>
                          0 means no limit
      -mmcw, -max-message-column-width=<maxMessageColumnWidth>
                          0 means no limit
      -mrcw, -max-reporter-column-width=<maxReporterColumnWidth>
                          0 means no limit
      -mrucw, -max-rule-column-width=<maxRuleColumnWidth>
                          0 means no limit
      -mscw, -max-severity-column-width=<maxSeverityColumnWidth>
                          0 means no limit
      -mv, -max-violations=<maxViolationsArg>
                          Will fail the build if total number of found
                            violations is higher.
      -pv, -print-violations
                          Will print violations found
  -s, -severity=<minSeverityArg>
                          Minimum severity level to report. INFO, WARN, ERROR
      -show-debug-info    Please run your command with this parameter and
                            supply output when reporting bugs.
      -show-json-config   Will print the given config as JSON.
      -ss, -sarif=<sarifFileArg>
                          Create a Sarif file with all the violations.
  -v, --violations=<violationsArg>
                          Format: <PARSER> <FOLDER> <REGEXP PATTERN> <NAME>,
                            Example: -v "JSLINT" "." ".*/jshint.xml$" "JSHint"
      -vf, -violations-file=<violationsFileArg>
                          Create a JSON file with all the violations.

Checkout the Violations Lib for more documentation.

Name		Name	Last commit message	Last commit date
Latest commit History 168 Commits
.github/workflows		.github/workflows
gradle/wrapper		gradle/wrapper
src/main/java/se/bjurr/violations/main		src/main/java/se/bjurr/violations/main
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
ISSUE_TEMPLATE		ISSUE_TEMPLATE
LICENSE		LICENSE
README.md		README.md
build-docker.sh		build-docker.sh
build.gradle		build.gradle
gradle.properties		gradle.properties
gradlew		gradlew
gradlew.bat		gradlew.bat
settings.gradle		settings.gradle

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Violations Command Line

GitHub

GitLab

Formats

Usage

About

Releases

Packages

Languages

License

tomasbjerre/violations-command-line

Folders and files

Latest commit

History

Repository files navigation

Violations Command Line

GitHub

GitLab

Formats

Usage

About

Topics

Resources

License

Stars

Watchers

Forks

Releases

Packages 0

Languages

Packages