@codacy/analysis-runner 0.14.0 → 0.16.0

package/dist/index.d.ts

@@ -853,4 +853,174 @@ declare function discover(repositoryRoot: string, options?: DiscoverOptions): Pr
  */
 declare function getKnownDisplayNames(): Set<string>;
 
-export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type MergeOptions, type PatternMetadataLookup, type SeverityFilter, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, createNullLogger, deleteCredentials, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getKnownDisplayNames, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, loadCredentials, mergeConfigs, parseAutoFilters, pruneEmptyTools, readBaselineConfig, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveApiToken, resolveBaselinePath, resolveConfigPath, resolveEngineToAdapter, rotateLogFiles, saveCredentials, updateConfigIncremental, validateApiToken, writeBaselineConfig, writeCodacyConfig, writeCodacyConfigFile };
+/**
+ * Git repository introspection helpers used by commands that need to know
+ * *where* they are (repository root) and *what* they are looking at (the current
+ * commit SHA). Kept separate from `git-scope.ts` (which resolves file *sets* for
+ * `--staged`/`--diff`/`--pr`); this module answers point questions about the repo.
+ *
+ * Both helpers shell out with `execFileSync` (never a shell string) so paths and
+ * refs can't be interpreted by the shell.
+ */
+/**
+ * Resolves the absolute path to the enclosing git repository's root.
+ *
+ * Wraps `git rev-parse --show-toplevel`. Throws a clear error when `cwd` is not
+ * inside a git working tree, so callers can surface an actionable message rather
+ * than a raw git failure.
+ */
+declare function resolveRepositoryRoot(cwd?: string): string;
+/**
+ * Resolves the SHA of the current `HEAD` commit.
+ *
+ * Wraps `git rev-parse HEAD`. Used by `upload` to auto-detect the commit when the
+ * caller omits `--commit`. Throws when there is no commit yet (empty repo) or the
+ * directory is not a git repository, so the command can tell the user to pass
+ * `--commit` explicitly.
+ */
+declare function resolveHeadCommit(repositoryRoot: string): string;
+
+/**
+ * `upload` — sends an analysis report produced by this CLI to Codacy, attaching
+ * its issues to a commit so they surface on Codacy Cloud.
+ *
+ * ## What it uploads
+ *
+ * Only reports this CLI produced, in either output format:
+ * - `sarif` — our SARIF v2.1.0 document, where `run.tool.driver.name` is the tool
+ *   id and each `result.ruleId` is already a Codacy pattern id.
+ * - `json`  — the full `AnalysisResult`, whose `issues[]` carry `toolId`, `patternId`,
+ *   `severity`, etc.
+ *
+ * Because our reports already carry Codacy-native pattern ids, no online pattern
+ * lookup is needed (unlike the legacy Go CLI, which had to map raw tool rule ids to
+ * Codacy patterns). We normalize either format into a flat issue list and build the
+ * payload directly.
+ *
+ * ## Where it uploads
+ *
+ * The **legacy v2 API** (`https://api.codacy.com/2.0`), matching the Go CLI: one
+ * `issuesRemoteResults` POST per tool, then a single `resultsFinal` POST to close the
+ * commit. The backend stores the `issues` payload as an opaque blob and a separate
+ * downstream engine parses it, so the payload shape must match the Go CLI's exactly.
+ *
+ * ## Auth
+ *
+ * Two mutually exclusive modes (see {@link UploadAuth}): a repository token
+ * (`project-token` header, commit-scoped URL) or an account token (`api-token`
+ * header, provider/owner/repo-scoped URL).
+ */
+/**
+ * An issue flattened from either report format into the minimal fields the v2
+ * payload needs. `filePath` is relative to the repository root (both our SARIF and
+ * JSON emit repo-relative paths, so no recomputation is required).
+ */
+interface NormalizedIssue {
+    /** Tool id (our adapter id, e.g. "ESLint9"); becomes the payload's tool grouping. */
+    toolId: string;
+    /** Codacy pattern id (e.g. "ESLint9_accessor-pairs"). */
+    patternId: string;
+    /** Repository-relative file path. */
+    filePath: string;
+    /** 1-based line number. */
+    line: number;
+    /** Issue message text. */
+    message: string;
+    /** Codacy level string (Info/Warning/High/Error for json; Info/Warning/Error for sarif). */
+    level: string;
+}
+/** Authentication + routing for the upload. */
+type UploadAuth = {
+    kind: "repository-token";
+    /** Repository (a.k.a. project) token; sent as the `project-token` header. */
+    token: string;
+} | {
+    kind: "account-token";
+    /** Account/user token; sent as the `api-token` header. */
+    token: string;
+    provider: string;
+    owner: string;
+    repository: string;
+};
+/** Options for {@link uploadReport}. */
+interface UploadOptions {
+    /** Absolute or CWD-relative path to the report file (sarif or json). */
+    reportPath: string;
+    /** Commit SHA/UUID the results attach to. */
+    commitUuid: string;
+    auth: UploadAuth;
+    /** Progress callback for human-facing messages (stderr in the CLI). */
+    onProgress?: (message: string) => void;
+}
+/** Outcome of an upload. */
+interface UploadResult {
+    /** Tool short-names that had at least one issue uploaded. */
+    toolsUploaded: string[];
+    /** Total issues uploaded across all tools. */
+    issueCount: number;
+    /** Whether the final `resultsFinal` call succeeded. */
+    finalized: boolean;
+}
+/** The per-tool payload object (wrapped in a one-element array per request). */
+interface ToolPayload {
+    tool: string;
+    issues: {
+        Success: {
+            results: FileResults[];
+        };
+    };
+}
+interface FileResults {
+    filename: string;
+    results: Array<{
+        Issue: PayloadIssue;
+    }>;
+}
+interface PayloadIssue {
+    patternId: {
+        value: string;
+    };
+    filename: string;
+    message: {
+        text: string;
+    };
+    level: string;
+    location: {
+        LineLocation: {
+            line: number;
+        };
+    };
+}
+/**
+ * Resolves the base URL for the legacy v2 results API. Defaults to Codacy SaaS;
+ * override with `CODACY_RESULTS_API_BASE_URL` for self-hosted deployments. Note this
+ * is a different host from `CODACY_API_BASE_URL` (the v3 app API).
+ */
+declare function resolveResultsApiBaseUrl(): string;
+/**
+ * Detects the report format and flattens it into {@link NormalizedIssue}s.
+ * Accepts only reports produced by this CLI (our SARIF or our JSON `AnalysisResult`);
+ * throws a clear error otherwise.
+ */
+declare function parseReport(fileContents: string): NormalizedIssue[];
+/**
+ * Builds one v2 payload per tool, grouping issues by file. `resolveShortName` maps
+ * our internal tool id to the Codacy tool short-name expected in the `tool` field
+ * (which becomes an S3 key segment consumed downstream).
+ */
+declare function buildPayloads(issues: NormalizedIssue[], resolveShortName: (toolId: string) => string): ToolPayload[];
+/**
+ * Uploads an analysis report to Codacy. Reads and parses the report, resolves tool
+ * short-names, POSTs one `issuesRemoteResults` per tool, then a single `resultsFinal`.
+ *
+ * Throws on a failed `issuesRemoteResults` POST (partial uploads shouldn't be
+ * silently finalized). A failed `resultsFinal` is surfaced via `onProgress` and
+ * reflected in the returned {@link UploadResult}, matching the Go CLI's non-fatal
+ * treatment of finalization.
+ *
+ * Proxy/TLS is honored automatically — all `fetch` traffic goes through the global
+ * dispatcher installed by `configureProxy()`.
+ */
+declare function uploadReport(options: UploadOptions): Promise<UploadResult>;
+
+export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type MergeOptions, type NormalizedIssue, type PatternMetadataLookup, type SeverityFilter, type UploadAuth, type UploadOptions, type UploadResult, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildPayloads, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, createNullLogger, deleteCredentials, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getKnownDisplayNames, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, loadCredentials, mergeConfigs, parseAutoFilters, parseReport, pruneEmptyTools, readBaselineConfig, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveApiToken, resolveBaselinePath, resolveConfigPath, resolveEngineToAdapter, resolveHeadCommit, resolveRepositoryRoot, resolveResultsApiBaseUrl, rotateLogFiles, saveCredentials, updateConfigIncremental, uploadReport, validateApiToken, writeBaselineConfig, writeCodacyConfig, writeCodacyConfigFile };

package/dist/index.js

@@ -33,6 +33,7 @@ __export(index_exports, {
   analyze: () => analyze,
   applyCodacyYamlExcludes: () => applyCodacyYamlExcludes,
   applyConfigOperation: () => applyConfigOperation,
+  buildPayloads: () => buildPayloads,
   buildToolConfig: () => buildToolConfig,
   clearAdapters: () => clearAdapters,
   computePatternSummary: () => computePatternSummary,
@@ -64,6 +65,7 @@ __export(index_exports, {
   loadCredentials: () => loadCredentials,
   mergeConfigs: () => mergeConfigs,
   parseAutoFilters: () => parseAutoFilters,
+  parseReport: () => parseReport,
   pruneEmptyTools: () => pruneEmptyTools,
   readBaselineConfig: () => readBaselineConfig,
   readCodacyConfig: () => readCodacyConfig,
@@ -75,10 +77,14 @@ __export(index_exports, {
   resolveBaselinePath: () => resolveBaselinePath,
   resolveConfigPath: () => resolveConfigPath,
   resolveEngineToAdapter: () => resolveEngineToAdapter,
+  resolveHeadCommit: () => resolveHeadCommit,
   resolveProxyConfig: () => import_tooling6.resolveProxyConfig,
+  resolveRepositoryRoot: () => resolveRepositoryRoot,
+  resolveResultsApiBaseUrl: () => resolveResultsApiBaseUrl,
   rotateLogFiles: () => rotateLogFiles,
   saveCredentials: () => saveCredentials,
   updateConfigIncremental: () => updateConfigIncremental,
+  uploadReport: () => uploadReport,
   validateApiToken: () => validateApiToken,
   writeBaselineConfig: () => writeBaselineConfig,
   writeCodacyConfig: () => writeCodacyConfig,
@@ -89,6 +95,7 @@ module.exports = __toCommonJS(index_exports);
 // src/analyze.ts
 var import_os2 = __toESM(require("os"));
 var import_path4 = __toESM(require("path"));
+var import_fs3 = __toESM(require("fs"));
 var import_child_process3 = require("child_process");
 var import_util = require("util");
 var import_tooling3 = require("@codacy/tooling");
@@ -586,7 +593,7 @@ function routeFilesToTool(files, adapter, toolConfig) {
 }
 function filterByTargetFiles(allFiles, targetPatterns) {
   if (targetPatterns.length === 0) return allFiles;
-  const normalized = targetPatterns.map((p) => p.replace(/^\.\//, ""));
+  const normalized = targetPatterns.map((p) => p.replace(/\\/g, "/").replace(/^\.\//, ""));
   const exact = new Set(normalized);
   const globs = normalized.map((p) => new import_minimatch2.Minimatch(p, { dot: true, matchBase: false })).filter((m) => m.hasMagic());
   const dirPrefixes = normalized.filter((p) => p.endsWith("/"));
@@ -1053,6 +1060,26 @@ async function analyze(options) {
       []
     );
   }
+  const rootStat = import_fs3.default.statSync(options.repositoryRoot, { throwIfNoEntry: false });
+  if (!rootStat?.isDirectory()) {
+    return buildResult(
+      startedAt,
+      options.repositoryRoot,
+      mode,
+      emptyCapability,
+      [],
+      [
+        {
+          toolId: "runner",
+          phase: "requirementCheck",
+          kind: "RepositoryNotFound",
+          message: `${options.repositoryRoot} does not exist or is not a directory. Pass a path to an existing repository, or a quoted glob (e.g. "src/**/*.ts") to scope files.`,
+          level: "error"
+        }
+      ],
+      []
+    );
+  }
   try {
     await execFileAsync("git", ["rev-parse", "--is-inside-work-tree"], {
       cwd: options.repositoryRoot
@@ -2604,11 +2631,24 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   // --- Scala — Frameworks ---
   ["play-server", { displayName: "Play Framework", kind: "framework" }],
   ["akka-actor", { displayName: "Akka", kind: "framework" }],
+  ["spray-can", { displayName: "Spray", kind: "framework" }],
   // --- Scala — Libraries ---
   ["scalatest", { displayName: "ScalaTest", kind: "library" }],
   ["specs2-core", { displayName: "Specs2", kind: "library" }],
   ["cats-core", { displayName: "Cats", kind: "library" }],
   ["circe-core", { displayName: "Circe", kind: "library" }],
+  // --- Elixir — Frameworks ---
+  ["phoenix", { displayName: "Phoenix", kind: "framework" }],
+  ["plug", { displayName: "Plug", kind: "framework" }],
+  ["plug_cowboy", { displayName: "Plug", kind: "framework" }],
+  // --- Elixir — Libraries ---
+  ["ecto", { displayName: "Ecto", kind: "library" }],
+  ["ecto_sql", { displayName: "Ecto", kind: "library" }],
+  ["phoenix_ecto", { displayName: "Ecto", kind: "library" }],
+  // --- Crystal — Frameworks ---
+  ["amber", { displayName: "Amber", kind: "framework" }],
+  ["lucky", { displayName: "Lucky", kind: "framework" }],
+  ["kemal", { displayName: "Kemal", kind: "framework" }],
   // --- Dart — Frameworks ---
   // `flutter` and `angular` appear as plain keys in pubspec.yaml. NOTE: `angular`
   // here is Dart's AngularDart. The npm package `angular` is AngularJS (1.x) — a
@@ -2746,6 +2786,31 @@ var FILE_SIGNAL_RULES = [
     name: "suitecloud.config.js",
     matches: (f) => pathBasename(f) === "suitecloud.config.js",
     classification: { displayName: "SuiteScript", kind: "platform" }
+  },
+  {
+    name: ".github/workflows",
+    matches: (f) => f.startsWith(".github/workflows/"),
+    classification: { displayName: "GitHub Actions", kind: "framework" }
+  },
+  {
+    name: ".circleci",
+    matches: (f) => f.startsWith(".circleci/"),
+    classification: { displayName: "CircleCI", kind: "framework" }
+  },
+  {
+    name: ".gitlab-ci.yml",
+    matches: (f) => f === ".gitlab-ci.yml" || f.startsWith(".gitlab/"),
+    classification: { displayName: "GitLab CI", kind: "framework" }
+  },
+  {
+    name: "bitbucket-pipelines.yml",
+    matches: (f) => f === "bitbucket-pipelines.yml",
+    classification: { displayName: "Bitbucket Pipelines", kind: "framework" }
+  },
+  {
+    name: "azure-pipelines.yml",
+    matches: (f) => f === "azure-pipelines.yml" || f === "azure-pipelines.yaml",
+    classification: { displayName: "Azure Pipelines", kind: "framework" }
   }
 ];
 function detectFileSignals(files) {
@@ -2991,6 +3056,15 @@ function parseGemfile(content) {
   }
   return deps;
 }
+function parseMixExs(content) {
+  const deps = [];
+  const depRegex = /\{:([a-zA-Z_][a-zA-Z0-9_]*)\s*,\s*"([^"]*)"/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[1], version: match[2] || void 0 });
+  }
+  return deps;
+}
 function parseGoMod(content) {
   const deps = [];
   const singleRegex = /^require\s+(\S+)\s+(\S+)/gm;
@@ -3030,6 +3104,15 @@ function parseBuildGradle(content) {
   }
   return deps;
 }
+function parseBuildSbt(content) {
+  const deps = [];
+  const depRegex = /"([^"]+)"\s*%%?\s*"([^"]+)"\s*%\s*"([^"]+)"/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[2], version: match[3] });
+  }
+  return deps;
+}
 function parseCargoToml(content) {
   const deps = [];
   let inDepsSection = false;
@@ -3110,6 +3193,41 @@ function parsePubspecYaml(content) {
   }
   return deps;
 }
+function parseShardYml(content) {
+  const deps = [];
+  let inSection = false;
+  let depIndent = -1;
+  let current;
+  const flush = () => {
+    if (current) deps.push(current);
+    current = void 0;
+  };
+  for (const rawLine of content.split("\n")) {
+    const trimmed = rawLine.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const indent = rawLine.length - rawLine.trimStart().length;
+    if (indent === 0) {
+      flush();
+      inSection = /^(dependencies|development_dependencies):/.test(trimmed);
+      depIndent = -1;
+      continue;
+    }
+    if (!inSection) continue;
+    if (depIndent === -1) depIndent = indent;
+    if (indent === depIndent) {
+      flush();
+      const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*:/);
+      current = m ? { name: m[1] } : void 0;
+      continue;
+    }
+    if (indent > depIndent && current) {
+      const v = trimmed.match(/^version\s*:\s*["']?(?:~>|[~^])?\s*([0-9][^"'\s]*)/);
+      if (v) current.version = v[1];
+    }
+  }
+  flush();
+  return deps;
+}
 function parseXmlDependencyElements(content, elementRegex, nameAttr) {
   const deps = [];
   const nameRegex = new RegExp(`\\b${nameAttr}\\s*=\\s*["']([^"']+)["']`, "i");
@@ -3144,11 +3262,14 @@ var MANIFEST_PARSERS = /* @__PURE__ */ new Map([
   ["pom.xml", parsePomXml],
   ["build.gradle", parseBuildGradle],
   ["build.gradle.kts", parseBuildGradle],
+  ["build.sbt", parseBuildSbt],
   ["Cargo.toml", parseCargoToml],
   ["composer.json", parseComposerJson],
   ["Podfile", parsePodfile],
   ["Package.swift", parsePackageSwift],
   ["pubspec.yaml", parsePubspecYaml],
+  ["mix.exs", parseMixExs],
+  ["shard.yml", parseShardYml],
   ["packages.config", parsePackagesConfig],
   ["Directory.Packages.props", parseCsproj]
 ]);
@@ -7197,6 +7318,11 @@ async function initContainerConfig(repositoryRoot, adapters) {
   }
   return createCodacyConfig({ source: "container", tools, includeFiles });
 }
+function hasMatchingFiles(files, filePatterns) {
+  const matcher = new CompiledMatcher(filePatterns);
+  if (matcher.matchAll) return files.length > 0;
+  return files.some((file) => matcher.matches(file, file.split("/").pop() ?? ""));
+}
 async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, onDiscoveryComplete, rawFilterString, loadUnsupportedPatterns) {
   const discoveryResult = await discover(repositoryRoot);
   onDiscoveryComplete?.(discoveryResult);
@@ -7206,6 +7332,7 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
   for (const lib of discoveryResult.libraries) detectedKeys.add(lib.displayName);
   const repoLanguages = new Set(discoveryResult.languages);
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
+  const repoFiles = listRepoFiles(repositoryRoot);
   const descriptorMap = new Map(descriptors.map((d) => [d.id, d]));
   const candidates = [];
   for (const adapter of adapters) {
@@ -7213,6 +7340,7 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
       const hasOverlap = adapter.languages.some((lang) => repoLanguages.has(lang));
       if (!hasOverlap) continue;
     }
+    if (!hasMatchingFiles(repoFiles, adapter.filePatterns)) continue;
     candidates.push(adapter);
   }
   const deduped = deduplicateToolFamilies(candidates, localConfigs);
@@ -7256,6 +7384,7 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
     }
     const family = toolFamily(desc.id);
     if (selectedFamilies.has(family)) continue;
+    if (!hasMatchingFiles(repoFiles, desc.filePatterns)) continue;
     const patternsMetadata = loadUnsupportedPatterns(desc.id);
     if (patternsMetadata.length === 0) continue;
     const selectedPatterns = filterAutoPatterns(
@@ -7540,11 +7669,255 @@ async function resolveApiToken() {
   if (stored) return stored;
   throw new Error("No API token found. Set CODACY_API_TOKEN or run 'codacy-analysis login'.");
 }
+
+// src/git-info.ts
+var import_child_process5 = require("child_process");
+function resolveRepositoryRoot(cwd = process.cwd()) {
+  try {
+    return (0, import_child_process5.execFileSync)("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8"
+    }).trim();
+  } catch {
+    throw new Error(`Not inside a git repository: ${cwd}`);
+  }
+}
+function resolveHeadCommit(repositoryRoot) {
+  try {
+    return (0, import_child_process5.execFileSync)("git", ["rev-parse", "HEAD"], {
+      cwd: repositoryRoot,
+      encoding: "utf-8"
+    }).trim();
+  } catch {
+    throw new Error(
+      "Could not resolve the current commit from git (no commits yet, or not a git repository). Pass the commit explicitly with --commit <sha>."
+    );
+  }
+}
+
+// src/upload.ts
+var import_promises6 = require("fs/promises");
+var DEFAULT_RESULTS_API_BASE_URL = "https://api.codacy.com/2.0";
+function resolveResultsApiBaseUrl() {
+  const raw = process.env.CODACY_RESULTS_API_BASE_URL || DEFAULT_RESULTS_API_BASE_URL;
+  return raw.replace(/\/+$/, "");
+}
+function mapSarifLevelToCodacy(level) {
+  switch (level) {
+    case "error":
+      return "Error";
+    case "warning":
+      return "Warning";
+    case "note":
+      return "Info";
+    default:
+      return "Warning";
+  }
+}
+function parseReport(fileContents) {
+  let parsed;
+  try {
+    parsed = JSON.parse(fileContents);
+  } catch (err) {
+    throw new Error(
+      `Report is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error(
+      "Unrecognized report format; expected SARIF or JSON produced by `codacy-analysis analyze`."
+    );
+  }
+  const obj = parsed;
+  const looksSarif = Array.isArray(obj.runs) && (typeof obj.version === "string" && obj.version.startsWith("2.1") || typeof obj.$schema === "string" && obj.$schema.includes("sarif"));
+  if (looksSarif) {
+    return parseSarif(obj.runs);
+  }
+  if (Array.isArray(obj.issues)) {
+    return parseAnalysisResult(obj);
+  }
+  throw new Error(
+    "Unrecognized report format; expected SARIF or JSON produced by `codacy-analysis analyze`."
+  );
+}
+function parseSarif(runs) {
+  const issues = [];
+  for (const run of runs) {
+    const toolId = run.tool?.driver?.name;
+    if (!toolId) continue;
+    for (const result of run.results ?? []) {
+      const patternId = result.ruleId;
+      if (!patternId) continue;
+      const level = mapSarifLevelToCodacy(result.level);
+      const message = result.message?.text ?? "";
+      for (const loc of result.locations ?? []) {
+        const filePath = loc.physicalLocation?.artifactLocation?.uri;
+        const line = loc.physicalLocation?.region?.startLine;
+        if (!filePath || !line) continue;
+        issues.push({ toolId, patternId, filePath, line, message, level });
+      }
+    }
+  }
+  return issues;
+}
+function parseAnalysisResult(result) {
+  return (result.issues ?? []).map((issue) => ({
+    toolId: issue.toolId,
+    patternId: issue.patternId,
+    filePath: issue.filePath,
+    line: issue.line,
+    message: issue.message,
+    // JSON carries the authoritative Codacy severity; pass it through unchanged.
+    level: issue.severity
+  }));
+}
+function buildPayloads(issues, resolveShortName) {
+  const byTool = /* @__PURE__ */ new Map();
+  for (const issue of issues) {
+    const list = byTool.get(issue.toolId);
+    if (list) list.push(issue);
+    else byTool.set(issue.toolId, [issue]);
+  }
+  const payloads = [];
+  for (const [toolId, toolIssues] of byTool) {
+    const byFile = /* @__PURE__ */ new Map();
+    for (const issue of toolIssues) {
+      const entry = {
+        Issue: {
+          patternId: { value: issue.patternId },
+          filename: issue.filePath,
+          message: { text: issue.message },
+          level: issue.level,
+          location: { LineLocation: { line: issue.line } }
+        }
+      };
+      const list = byFile.get(issue.filePath);
+      if (list) list.push(entry);
+      else byFile.set(issue.filePath, [entry]);
+    }
+    const results = [];
+    for (const [filename, fileIssues] of byFile) {
+      results.push({ filename, results: fileIssues });
+    }
+    payloads.push({
+      tool: resolveShortName(toolId),
+      issues: { Success: { results } }
+    });
+  }
+  return payloads;
+}
+async function buildShortNameResolver(onProgress) {
+  const byName = /* @__PURE__ */ new Map();
+  try {
+    const tools = await listTools();
+    for (const tool of tools) {
+      if (tool.name && tool.shortName) byName.set(tool.name.toLowerCase(), tool.shortName);
+    }
+  } catch (err) {
+    onProgress?.(
+      `Warning: could not fetch Codacy tools list (${err instanceof Error ? err.message : String(err)}); falling back to tool ids as-is.`
+    );
+  }
+  return (toolId) => byName.get(toolId.toLowerCase()) ?? toolId.toLowerCase();
+}
+var COORDINATE_PATTERN = /^[A-Za-z0-9._-]+$/;
+function assertValidCoordinate(kind, value) {
+  if (!COORDINATE_PATTERN.test(value)) {
+    throw new Error(
+      `Invalid ${kind} "${value}": expected only letters, digits, and the characters . _ -`
+    );
+  }
+}
+function buildUrls(base, auth, commitUuid) {
+  const commit = encodeURIComponent(commitUuid);
+  if (auth.kind === "repository-token") {
+    return {
+      results: `${base}/commit/${commit}/issuesRemoteResults`,
+      final: `${base}/commit/${commit}/resultsFinal`
+    };
+  }
+  assertValidCoordinate("provider", auth.provider);
+  assertValidCoordinate("owner", auth.owner);
+  assertValidCoordinate("repository", auth.repository);
+  const p = encodeURIComponent(auth.provider);
+  const o = encodeURIComponent(auth.owner);
+  const r = encodeURIComponent(auth.repository);
+  return {
+    results: `${base}/${p}/${o}/${r}/commit/${commit}/issuesRemoteResults`,
+    final: `${base}/${p}/${o}/${r}/commit/${commit}/resultsFinal`
+  };
+}
+function authHeader(auth) {
+  return auth.kind === "repository-token" ? { "project-token": auth.token } : { "api-token": auth.token };
+}
+async function uploadReport(options) {
+  const { reportPath, commitUuid, auth, onProgress } = options;
+  onProgress?.(`Reading report ${reportPath}...`);
+  const contents = await (0, import_promises6.readFile)(reportPath, "utf-8");
+  const issues = parseReport(contents);
+  if (issues.length === 0) {
+    onProgress?.("No issues found in the report; nothing to upload.");
+  }
+  const resolveShortName = await buildShortNameResolver(onProgress);
+  const payloads = buildPayloads(issues, resolveShortName);
+  const base = resolveResultsApiBaseUrl();
+  const urls = buildUrls(base, auth, commitUuid);
+  const headers = { "content-type": "application/json", ...authHeader(auth) };
+  for (const payload of payloads) {
+    const issuesInTool = payload.issues.Success.results.reduce(
+      (sum, f) => sum + f.results.length,
+      0
+    );
+    onProgress?.(`Uploading ${issuesInTool} issue(s) for ${payload.tool}...`);
+    const res = await fetch(urls.results, {
+      method: "POST",
+      headers,
+      // The body is a one-element array per tool, matching the Go CLI.
+      body: JSON.stringify([payload])
+    });
+    if (!res.ok) {
+      const body = await safeReadBody(res);
+      throw new Error(
+        `Failed to upload results for ${payload.tool}: ${res.status} ${res.statusText}${body ? ` \u2014 ${body}` : ""}`
+      );
+    }
+  }
+  onProgress?.("Finalizing results...");
+  let finalized = false;
+  try {
+    const res = await fetch(urls.final, { method: "POST", headers });
+    finalized = res.ok;
+    if (!res.ok) {
+      const body = await safeReadBody(res);
+      onProgress?.(
+        `Warning: resultsFinal returned ${res.status} ${res.statusText}${body ? ` \u2014 ${body}` : ""}`
+      );
+    }
+  } catch (err) {
+    onProgress?.(
+      `Warning: resultsFinal request failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return {
+    toolsUploaded: payloads.map((p) => p.tool),
+    issueCount: issues.length,
+    finalized
+  };
+}
+async function safeReadBody(res) {
+  try {
+    const text = await res.text();
+    return text.length > 500 ? text.slice(0, 500) + "\u2026" : text;
+  } catch {
+    return "";
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   analyze,
   applyCodacyYamlExcludes,
   applyConfigOperation,
+  buildPayloads,
   buildToolConfig,
   clearAdapters,
   computePatternSummary,
@@ -7576,6 +7949,7 @@ async function resolveApiToken() {
   loadCredentials,
   mergeConfigs,
   parseAutoFilters,
+  parseReport,
   pruneEmptyTools,
   readBaselineConfig,
   readCodacyConfig,
@@ -7587,10 +7961,14 @@ async function resolveApiToken() {
   resolveBaselinePath,
   resolveConfigPath,
   resolveEngineToAdapter,
+  resolveHeadCommit,
   resolveProxyConfig,
+  resolveRepositoryRoot,
+  resolveResultsApiBaseUrl,
   rotateLogFiles,
   saveCredentials,
   updateConfigIncremental,
+  uploadReport,
   validateApiToken,
   writeBaselineConfig,
   writeCodacyConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/analysis-runner",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Core orchestration engine for Codacy analysis",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,11 +12,11 @@
     "cli-table3": "^0.6",
     "minimatch": "10.2.4",
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.14.0"
+    "@codacy/tooling": "0.16.0"
   },
   "devDependencies": {
     "@codacy/openapi-typescript-codegen": "0.0.9",
-    "@codacy/tools-dummy-1": "0.14.0"
+    "@codacy/tools-dummy-1": "0.16.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",