@codacy/analysis-runner 0.15.0 → 0.17.0

package/dist/index.d.ts

@@ -586,7 +586,12 @@ interface InitAutoStats {
  *
  * Severity and category filters are ANDed across dimensions, ORed within.
  *
- * **Known limitation (v1):** When both TypeScript and JavaScript are detected,
+ * Tool-level overlap (two *different* tools that lint the same stack, e.g.
+ * ESLint and Biome) is resolved by `deduplicateToolFamilies` via each
+ * descriptor's `alternativeGroup` — only one member of a group is selected.
+ *
+ * **Known limitation (v1):** *Pattern*-level overlap within a single tool is
+ * not yet resolved — e.g. when both TypeScript and JavaScript are detected,
  * ESLint core rules and their `@typescript-eslint` equivalents may both be
  * enabled, potentially causing duplicate findings. This will be addressed in v2
  * via conflict-resolution metadata in the mapping files.
@@ -853,4 +858,174 @@ declare function discover(repositoryRoot: string, options?: DiscoverOptions): Pr
  */
 declare function getKnownDisplayNames(): Set<string>;
 
-export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type MergeOptions, type PatternMetadataLookup, type SeverityFilter, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, createNullLogger, deleteCredentials, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getKnownDisplayNames, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, loadCredentials, mergeConfigs, parseAutoFilters, pruneEmptyTools, readBaselineConfig, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveApiToken, resolveBaselinePath, resolveConfigPath, resolveEngineToAdapter, rotateLogFiles, saveCredentials, updateConfigIncremental, validateApiToken, writeBaselineConfig, writeCodacyConfig, writeCodacyConfigFile };
+/**
+ * Git repository introspection helpers used by commands that need to know
+ * *where* they are (repository root) and *what* they are looking at (the current
+ * commit SHA). Kept separate from `git-scope.ts` (which resolves file *sets* for
+ * `--staged`/`--diff`/`--pr`); this module answers point questions about the repo.
+ *
+ * Both helpers shell out with `execFileSync` (never a shell string) so paths and
+ * refs can't be interpreted by the shell.
+ */
+/**
+ * Resolves the absolute path to the enclosing git repository's root.
+ *
+ * Wraps `git rev-parse --show-toplevel`. Throws a clear error when `cwd` is not
+ * inside a git working tree, so callers can surface an actionable message rather
+ * than a raw git failure.
+ */
+declare function resolveRepositoryRoot(cwd?: string): string;
+/**
+ * Resolves the SHA of the current `HEAD` commit.
+ *
+ * Wraps `git rev-parse HEAD`. Used by `upload` to auto-detect the commit when the
+ * caller omits `--commit`. Throws when there is no commit yet (empty repo) or the
+ * directory is not a git repository, so the command can tell the user to pass
+ * `--commit` explicitly.
+ */
+declare function resolveHeadCommit(repositoryRoot: string): string;
+
+/**
+ * `upload` — sends an analysis report produced by this CLI to Codacy, attaching
+ * its issues to a commit so they surface on Codacy Cloud.
+ *
+ * ## What it uploads
+ *
+ * Only reports this CLI produced, in either output format:
+ * - `sarif` — our SARIF v2.1.0 document, where `run.tool.driver.name` is the tool
+ *   id and each `result.ruleId` is already a Codacy pattern id.
+ * - `json`  — the full `AnalysisResult`, whose `issues[]` carry `toolId`, `patternId`,
+ *   `severity`, etc.
+ *
+ * Because our reports already carry Codacy-native pattern ids, no online pattern
+ * lookup is needed (unlike the legacy Go CLI, which had to map raw tool rule ids to
+ * Codacy patterns). We normalize either format into a flat issue list and build the
+ * payload directly.
+ *
+ * ## Where it uploads
+ *
+ * The **legacy v2 API** (`https://api.codacy.com/2.0`), matching the Go CLI: one
+ * `issuesRemoteResults` POST per tool, then a single `resultsFinal` POST to close the
+ * commit. The backend stores the `issues` payload as an opaque blob and a separate
+ * downstream engine parses it, so the payload shape must match the Go CLI's exactly.
+ *
+ * ## Auth
+ *
+ * Two mutually exclusive modes (see {@link UploadAuth}): a repository token
+ * (`project-token` header, commit-scoped URL) or an account token (`api-token`
+ * header, provider/owner/repo-scoped URL).
+ */
+/**
+ * An issue flattened from either report format into the minimal fields the v2
+ * payload needs. `filePath` is relative to the repository root (both our SARIF and
+ * JSON emit repo-relative paths, so no recomputation is required).
+ */
+interface NormalizedIssue {
+    /** Tool id (our adapter id, e.g. "ESLint9"); becomes the payload's tool grouping. */
+    toolId: string;
+    /** Codacy pattern id (e.g. "ESLint9_accessor-pairs"). */
+    patternId: string;
+    /** Repository-relative file path. */
+    filePath: string;
+    /** 1-based line number. */
+    line: number;
+    /** Issue message text. */
+    message: string;
+    /** Codacy level string (Info/Warning/High/Error for json; Info/Warning/Error for sarif). */
+    level: string;
+}
+/** Authentication + routing for the upload. */
+type UploadAuth = {
+    kind: "repository-token";
+    /** Repository (a.k.a. project) token; sent as the `project-token` header. */
+    token: string;
+} | {
+    kind: "account-token";
+    /** Account/user token; sent as the `api-token` header. */
+    token: string;
+    provider: string;
+    owner: string;
+    repository: string;
+};
+/** Options for {@link uploadReport}. */
+interface UploadOptions {
+    /** Absolute or CWD-relative path to the report file (sarif or json). */
+    reportPath: string;
+    /** Commit SHA/UUID the results attach to. */
+    commitUuid: string;
+    auth: UploadAuth;
+    /** Progress callback for human-facing messages (stderr in the CLI). */
+    onProgress?: (message: string) => void;
+}
+/** Outcome of an upload. */
+interface UploadResult {
+    /** Tool short-names that had at least one issue uploaded. */
+    toolsUploaded: string[];
+    /** Total issues uploaded across all tools. */
+    issueCount: number;
+    /** Whether the final `resultsFinal` call succeeded. */
+    finalized: boolean;
+}
+/** The per-tool payload object (wrapped in a one-element array per request). */
+interface ToolPayload {
+    tool: string;
+    issues: {
+        Success: {
+            results: FileResults[];
+        };
+    };
+}
+interface FileResults {
+    filename: string;
+    results: Array<{
+        Issue: PayloadIssue;
+    }>;
+}
+interface PayloadIssue {
+    patternId: {
+        value: string;
+    };
+    filename: string;
+    message: {
+        text: string;
+    };
+    level: string;
+    location: {
+        LineLocation: {
+            line: number;
+        };
+    };
+}
+/**
+ * Resolves the base URL for the legacy v2 results API. Defaults to Codacy SaaS;
+ * override with `CODACY_RESULTS_API_BASE_URL` for self-hosted deployments. Note this
+ * is a different host from `CODACY_API_BASE_URL` (the v3 app API).
+ */
+declare function resolveResultsApiBaseUrl(): string;
+/**
+ * Detects the report format and flattens it into {@link NormalizedIssue}s.
+ * Accepts only reports produced by this CLI (our SARIF or our JSON `AnalysisResult`);
+ * throws a clear error otherwise.
+ */
+declare function parseReport(fileContents: string): NormalizedIssue[];
+/**
+ * Builds one v2 payload per tool, grouping issues by file. `resolveShortName` maps
+ * our internal tool id to the Codacy tool short-name expected in the `tool` field
+ * (which becomes an S3 key segment consumed downstream).
+ */
+declare function buildPayloads(issues: NormalizedIssue[], resolveShortName: (toolId: string) => string): ToolPayload[];
+/**
+ * Uploads an analysis report to Codacy. Reads and parses the report, resolves tool
+ * short-names, POSTs one `issuesRemoteResults` per tool, then a single `resultsFinal`.
+ *
+ * Throws on a failed `issuesRemoteResults` POST (partial uploads shouldn't be
+ * silently finalized). A failed `resultsFinal` is surfaced via `onProgress` and
+ * reflected in the returned {@link UploadResult}, matching the Go CLI's non-fatal
+ * treatment of finalization.
+ *
+ * Proxy/TLS is honored automatically — all `fetch` traffic goes through the global
+ * dispatcher installed by `configureProxy()`.
+ */
+declare function uploadReport(options: UploadOptions): Promise<UploadResult>;
+
+export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type MergeOptions, type NormalizedIssue, type PatternMetadataLookup, type SeverityFilter, type UploadAuth, type UploadOptions, type UploadResult, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildPayloads, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, createNullLogger, deleteCredentials, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getKnownDisplayNames, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, loadCredentials, mergeConfigs, parseAutoFilters, parseReport, pruneEmptyTools, readBaselineConfig, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveApiToken, resolveBaselinePath, resolveConfigPath, resolveEngineToAdapter, resolveHeadCommit, resolveRepositoryRoot, resolveResultsApiBaseUrl, rotateLogFiles, saveCredentials, updateConfigIncremental, uploadReport, validateApiToken, writeBaselineConfig, writeCodacyConfig, writeCodacyConfigFile };

package/dist/index.js

@@ -33,6 +33,7 @@ __export(index_exports, {
   analyze: () => analyze,
   applyCodacyYamlExcludes: () => applyCodacyYamlExcludes,
   applyConfigOperation: () => applyConfigOperation,
+  buildPayloads: () => buildPayloads,
   buildToolConfig: () => buildToolConfig,
   clearAdapters: () => clearAdapters,
   computePatternSummary: () => computePatternSummary,
@@ -64,6 +65,7 @@ __export(index_exports, {
   loadCredentials: () => loadCredentials,
   mergeConfigs: () => mergeConfigs,
   parseAutoFilters: () => parseAutoFilters,
+  parseReport: () => parseReport,
   pruneEmptyTools: () => pruneEmptyTools,
   readBaselineConfig: () => readBaselineConfig,
   readCodacyConfig: () => readCodacyConfig,
@@ -75,10 +77,14 @@ __export(index_exports, {
   resolveBaselinePath: () => resolveBaselinePath,
   resolveConfigPath: () => resolveConfigPath,
   resolveEngineToAdapter: () => resolveEngineToAdapter,
+  resolveHeadCommit: () => resolveHeadCommit,
   resolveProxyConfig: () => import_tooling6.resolveProxyConfig,
+  resolveRepositoryRoot: () => resolveRepositoryRoot,
+  resolveResultsApiBaseUrl: () => resolveResultsApiBaseUrl,
   rotateLogFiles: () => rotateLogFiles,
   saveCredentials: () => saveCredentials,
   updateConfigIncremental: () => updateConfigIncremental,
+  uploadReport: () => uploadReport,
   validateApiToken: () => validateApiToken,
   writeBaselineConfig: () => writeBaselineConfig,
   writeCodacyConfig: () => writeCodacyConfig,
@@ -2314,6 +2320,7 @@ function updateConfigIncremental(base, current, next) {
 
 // src/init.ts
 var import_promises4 = __toESM(require("fs/promises"));
+var import_os3 = __toESM(require("os"));
 var import_path8 = __toESM(require("path"));
 var import_child_process4 = require("child_process");
 var import_tooling5 = require("@codacy/tooling");
@@ -7362,21 +7369,25 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
       filters
     );
     if (selectedPatterns.length > 0) {
-      tools.push({
+      const toolEntry = {
         toolId: adapter.id,
         patterns: selectedPatterns.map((p) => ({ patternId: p.id }))
-      });
+      };
+      tools.push(toolEntry);
+      await applyAdapterParameterSuggestions(adapter, toolEntry, repositoryRoot, repoFiles);
     }
   }
   let selectedUnsupported = 0;
-  const selectedFamilies = new Set(tools.map((t) => toolFamily(t.toolId)));
+  const selectedFamilies = new Set(
+    tools.map((t) => toolGroupKey(t.toolId, descriptorMap.get(t.toolId)?.alternativeGroup))
+  );
   for (const desc of descriptors) {
     if (!desc.unsupported) continue;
     if (!loadUnsupportedPatterns) break;
     if (!desc.languages.includes("*") && desc.languages.length > 0 && repoLanguages.size > 0 && !desc.languages.some((lang) => repoLanguages.has(lang))) {
       continue;
     }
-    const family = toolFamily(desc.id);
+    const family = toolGroupKey(desc.id, desc.alternativeGroup);
     if (selectedFamilies.has(family)) continue;
     if (!hasMatchingFiles(repoFiles, desc.filePatterns)) continue;
     const patternsMetadata = loadUnsupportedPatterns(desc.id);
@@ -7420,16 +7431,58 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
     }
   };
 }
+async function applyAdapterParameterSuggestions(adapter, toolEntry, repositoryRoot, repoFiles) {
+  if (!adapter.suggestParameters) return;
+  const logger = {
+    debug() {
+    },
+    info() {
+    },
+    warn(message, fields) {
+      console.error(`[init --auto] ${adapter.id}: ${message}`, fields ?? "");
+    },
+    error(message, fields) {
+      console.error(`[init --auto] ${adapter.id}: ${message}`, fields ?? "");
+    }
+  };
+  try {
+    const globalDir = import_path8.default.join(import_os3.default.homedir(), ".codacy");
+    const ctx = {
+      repositoryRoot,
+      generatedConfigDir: import_path8.default.join(repositoryRoot, ".codacy", "generated", adapter.id),
+      globalDir,
+      toolInstallDir: import_path8.default.join(globalDir, "tools", adapter.id),
+      targetFiles: routeFilesToTool(repoFiles, adapter, toolEntry),
+      platform: { os: process.platform, arch: process.arch },
+      logger,
+      runner: "local"
+    };
+    const suggestions = await adapter.suggestParameters(ctx);
+    if (!suggestions) return;
+    for (const pattern of toolEntry.patterns) {
+      const params = suggestions[pattern.patternId];
+      if (!params) continue;
+      pattern.parameters = { ...pattern.parameters, ...params };
+    }
+  } catch (err) {
+    logger.error("suggestParameters failed", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
 function toolFamily(id) {
   return id.replace(/\d+$/, "");
 }
+function toolGroupKey(id, alternativeGroup) {
+  return alternativeGroup ?? toolFamily(id);
+}
 function deduplicateToolFamilies(candidates, localConfigs) {
   const families = /* @__PURE__ */ new Map();
   for (const adapter of candidates) {
-    const family = toolFamily(adapter.id);
-    const group = families.get(family) ?? [];
+    const key = toolGroupKey(adapter.id, adapter.alternativeGroup);
+    const group = families.get(key) ?? [];
     group.push(adapter);
-    families.set(family, group);
+    families.set(key, group);
   }
   const result = [];
   for (const group of families.values()) {
@@ -7438,16 +7491,28 @@ function deduplicateToolFamilies(candidates, localConfigs) {
       continue;
     }
     const withConfig = group.filter((a) => localConfigs.has(a.id));
-    if (withConfig.length === 1) {
-      result.push(withConfig[0]);
+    const pool = withConfig.length > 0 ? withConfig : group;
+    if (pool.length === 1) {
+      result.push(pool[0]);
       continue;
     }
-    group.sort((a, b) => {
-      const majorA = parseInt(a.preferredVersion.split(".")[0], 10) || 0;
-      const majorB = parseInt(b.preferredVersion.split(".")[0], 10) || 0;
-      return majorB - majorA;
-    });
-    result.push(group[0]);
+    const preferred = pool.filter((a) => a.alternativeGroupDefault);
+    if (preferred.length === 1) {
+      result.push(preferred[0]);
+      continue;
+    }
+    const defaultFamilies = new Set(
+      group.filter((a) => a.alternativeGroupDefault).map((a) => toolFamily(a.id))
+    );
+    const defaultFamilyMembers = defaultFamilies.size === 1 ? pool.filter((a) => defaultFamilies.has(toolFamily(a.id))) : [];
+    const ranked = [...defaultFamilyMembers.length > 0 ? defaultFamilyMembers : pool].sort(
+      (a, b) => {
+        const majorA = parseInt(a.preferredVersion.split(".")[0], 10) || 0;
+        const majorB = parseInt(b.preferredVersion.split(".")[0], 10) || 0;
+        return majorB - majorA;
+      }
+    );
+    result.push(ranked[0]);
   }
   return result;
 }
@@ -7603,14 +7668,14 @@ var import_tooling6 = require("@codacy/tooling");
 // src/credentials.ts
 var import_crypto = __toESM(require("crypto"));
 var import_promises5 = __toESM(require("fs/promises"));
-var import_os3 = __toESM(require("os"));
+var import_os4 = __toESM(require("os"));
 var import_path9 = __toESM(require("path"));
 function credentialsPath() {
-  return import_path9.default.join(import_os3.default.homedir(), ".codacy", "credentials");
+  return import_path9.default.join(import_os4.default.homedir(), ".codacy", "credentials");
 }
 function deriveKey(salt) {
-  const info = import_os3.default.userInfo();
-  const machineKey = [import_os3.default.hostname(), info.username, import_os3.default.homedir(), import_os3.default.platform()].join("|");
+  const info = import_os4.default.userInfo();
+  const machineKey = [import_os4.default.hostname(), info.username, import_os4.default.homedir(), import_os4.default.platform()].join("|");
   return import_crypto.default.pbkdf2Sync(machineKey, salt, 1e5, 32, "sha512");
 }
 async function saveCredentials(token) {
@@ -7663,11 +7728,255 @@ async function resolveApiToken() {
   if (stored) return stored;
   throw new Error("No API token found. Set CODACY_API_TOKEN or run 'codacy-analysis login'.");
 }
+
+// src/git-info.ts
+var import_child_process5 = require("child_process");
+function resolveRepositoryRoot(cwd = process.cwd()) {
+  try {
+    return (0, import_child_process5.execFileSync)("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8"
+    }).trim();
+  } catch {
+    throw new Error(`Not inside a git repository: ${cwd}`);
+  }
+}
+function resolveHeadCommit(repositoryRoot) {
+  try {
+    return (0, import_child_process5.execFileSync)("git", ["rev-parse", "HEAD"], {
+      cwd: repositoryRoot,
+      encoding: "utf-8"
+    }).trim();
+  } catch {
+    throw new Error(
+      "Could not resolve the current commit from git (no commits yet, or not a git repository). Pass the commit explicitly with --commit <sha>."
+    );
+  }
+}
+
+// src/upload.ts
+var import_promises6 = require("fs/promises");
+var DEFAULT_RESULTS_API_BASE_URL = "https://api.codacy.com/2.0";
+function resolveResultsApiBaseUrl() {
+  const raw = process.env.CODACY_RESULTS_API_BASE_URL || DEFAULT_RESULTS_API_BASE_URL;
+  return raw.replace(/\/+$/, "");
+}
+function mapSarifLevelToCodacy(level) {
+  switch (level) {
+    case "error":
+      return "Error";
+    case "warning":
+      return "Warning";
+    case "note":
+      return "Info";
+    default:
+      return "Warning";
+  }
+}
+function parseReport(fileContents) {
+  let parsed;
+  try {
+    parsed = JSON.parse(fileContents);
+  } catch (err) {
+    throw new Error(
+      `Report is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error(
+      "Unrecognized report format; expected SARIF or JSON produced by `codacy-analysis analyze`."
+    );
+  }
+  const obj = parsed;
+  const looksSarif = Array.isArray(obj.runs) && (typeof obj.version === "string" && obj.version.startsWith("2.1") || typeof obj.$schema === "string" && obj.$schema.includes("sarif"));
+  if (looksSarif) {
+    return parseSarif(obj.runs);
+  }
+  if (Array.isArray(obj.issues)) {
+    return parseAnalysisResult(obj);
+  }
+  throw new Error(
+    "Unrecognized report format; expected SARIF or JSON produced by `codacy-analysis analyze`."
+  );
+}
+function parseSarif(runs) {
+  const issues = [];
+  for (const run of runs) {
+    const toolId = run.tool?.driver?.name;
+    if (!toolId) continue;
+    for (const result of run.results ?? []) {
+      const patternId = result.ruleId;
+      if (!patternId) continue;
+      const level = mapSarifLevelToCodacy(result.level);
+      const message = result.message?.text ?? "";
+      for (const loc of result.locations ?? []) {
+        const filePath = loc.physicalLocation?.artifactLocation?.uri;
+        const line = loc.physicalLocation?.region?.startLine;
+        if (!filePath || !line) continue;
+        issues.push({ toolId, patternId, filePath, line, message, level });
+      }
+    }
+  }
+  return issues;
+}
+function parseAnalysisResult(result) {
+  return (result.issues ?? []).map((issue) => ({
+    toolId: issue.toolId,
+    patternId: issue.patternId,
+    filePath: issue.filePath,
+    line: issue.line,
+    message: issue.message,
+    // JSON carries the authoritative Codacy severity; pass it through unchanged.
+    level: issue.severity
+  }));
+}
+function buildPayloads(issues, resolveShortName) {
+  const byTool = /* @__PURE__ */ new Map();
+  for (const issue of issues) {
+    const list = byTool.get(issue.toolId);
+    if (list) list.push(issue);
+    else byTool.set(issue.toolId, [issue]);
+  }
+  const payloads = [];
+  for (const [toolId, toolIssues] of byTool) {
+    const byFile = /* @__PURE__ */ new Map();
+    for (const issue of toolIssues) {
+      const entry = {
+        Issue: {
+          patternId: { value: issue.patternId },
+          filename: issue.filePath,
+          message: { text: issue.message },
+          level: issue.level,
+          location: { LineLocation: { line: issue.line } }
+        }
+      };
+      const list = byFile.get(issue.filePath);
+      if (list) list.push(entry);
+      else byFile.set(issue.filePath, [entry]);
+    }
+    const results = [];
+    for (const [filename, fileIssues] of byFile) {
+      results.push({ filename, results: fileIssues });
+    }
+    payloads.push({
+      tool: resolveShortName(toolId),
+      issues: { Success: { results } }
+    });
+  }
+  return payloads;
+}
+async function buildShortNameResolver(onProgress) {
+  const byName = /* @__PURE__ */ new Map();
+  try {
+    const tools = await listTools();
+    for (const tool of tools) {
+      if (tool.name && tool.shortName) byName.set(tool.name.toLowerCase(), tool.shortName);
+    }
+  } catch (err) {
+    onProgress?.(
+      `Warning: could not fetch Codacy tools list (${err instanceof Error ? err.message : String(err)}); falling back to tool ids as-is.`
+    );
+  }
+  return (toolId) => byName.get(toolId.toLowerCase()) ?? toolId.toLowerCase();
+}
+var COORDINATE_PATTERN = /^[A-Za-z0-9._-]+$/;
+function assertValidCoordinate(kind, value) {
+  if (!COORDINATE_PATTERN.test(value)) {
+    throw new Error(
+      `Invalid ${kind} "${value}": expected only letters, digits, and the characters . _ -`
+    );
+  }
+}
+function buildUrls(base, auth, commitUuid) {
+  const commit = encodeURIComponent(commitUuid);
+  if (auth.kind === "repository-token") {
+    return {
+      results: `${base}/commit/${commit}/issuesRemoteResults`,
+      final: `${base}/commit/${commit}/resultsFinal`
+    };
+  }
+  assertValidCoordinate("provider", auth.provider);
+  assertValidCoordinate("owner", auth.owner);
+  assertValidCoordinate("repository", auth.repository);
+  const p = encodeURIComponent(auth.provider);
+  const o = encodeURIComponent(auth.owner);
+  const r = encodeURIComponent(auth.repository);
+  return {
+    results: `${base}/${p}/${o}/${r}/commit/${commit}/issuesRemoteResults`,
+    final: `${base}/${p}/${o}/${r}/commit/${commit}/resultsFinal`
+  };
+}
+function authHeader(auth) {
+  return auth.kind === "repository-token" ? { "project-token": auth.token } : { "api-token": auth.token };
+}
+async function uploadReport(options) {
+  const { reportPath, commitUuid, auth, onProgress } = options;
+  onProgress?.(`Reading report ${reportPath}...`);
+  const contents = await (0, import_promises6.readFile)(reportPath, "utf-8");
+  const issues = parseReport(contents);
+  if (issues.length === 0) {
+    onProgress?.("No issues found in the report; nothing to upload.");
+  }
+  const resolveShortName = await buildShortNameResolver(onProgress);
+  const payloads = buildPayloads(issues, resolveShortName);
+  const base = resolveResultsApiBaseUrl();
+  const urls = buildUrls(base, auth, commitUuid);
+  const headers = { "content-type": "application/json", ...authHeader(auth) };
+  for (const payload of payloads) {
+    const issuesInTool = payload.issues.Success.results.reduce(
+      (sum, f) => sum + f.results.length,
+      0
+    );
+    onProgress?.(`Uploading ${issuesInTool} issue(s) for ${payload.tool}...`);
+    const res = await fetch(urls.results, {
+      method: "POST",
+      headers,
+      // The body is a one-element array per tool, matching the Go CLI.
+      body: JSON.stringify([payload])
+    });
+    if (!res.ok) {
+      const body = await safeReadBody(res);
+      throw new Error(
+        `Failed to upload results for ${payload.tool}: ${res.status} ${res.statusText}${body ? ` \u2014 ${body}` : ""}`
+      );
+    }
+  }
+  onProgress?.("Finalizing results...");
+  let finalized = false;
+  try {
+    const res = await fetch(urls.final, { method: "POST", headers });
+    finalized = res.ok;
+    if (!res.ok) {
+      const body = await safeReadBody(res);
+      onProgress?.(
+        `Warning: resultsFinal returned ${res.status} ${res.statusText}${body ? ` \u2014 ${body}` : ""}`
+      );
+    }
+  } catch (err) {
+    onProgress?.(
+      `Warning: resultsFinal request failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return {
+    toolsUploaded: payloads.map((p) => p.tool),
+    issueCount: issues.length,
+    finalized
+  };
+}
+async function safeReadBody(res) {
+  try {
+    const text = await res.text();
+    return text.length > 500 ? text.slice(0, 500) + "\u2026" : text;
+  } catch {
+    return "";
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   analyze,
   applyCodacyYamlExcludes,
   applyConfigOperation,
+  buildPayloads,
   buildToolConfig,
   clearAdapters,
   computePatternSummary,
@@ -7699,6 +8008,7 @@ async function resolveApiToken() {
   loadCredentials,
   mergeConfigs,
   parseAutoFilters,
+  parseReport,
   pruneEmptyTools,
   readBaselineConfig,
   readCodacyConfig,
@@ -7710,10 +8020,14 @@ async function resolveApiToken() {
   resolveBaselinePath,
   resolveConfigPath,
   resolveEngineToAdapter,
+  resolveHeadCommit,
   resolveProxyConfig,
+  resolveRepositoryRoot,
+  resolveResultsApiBaseUrl,
   rotateLogFiles,
   saveCredentials,
   updateConfigIncremental,
+  uploadReport,
   validateApiToken,
   writeBaselineConfig,
   writeCodacyConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/analysis-runner",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Core orchestration engine for Codacy analysis",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,11 +12,11 @@
     "cli-table3": "^0.6",
     "minimatch": "10.2.4",
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.15.0"
+    "@codacy/tooling": "0.17.0"
   },
   "devDependencies": {
     "@codacy/openapi-typescript-codegen": "0.0.9",
-    "@codacy/tools-dummy-1": "0.15.0"
+    "@codacy/tools-dummy-1": "0.17.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",