Java Qodana

name: Java - Qodana Analysis

on:
  workflow_call:
    inputs:
      runner:
        description: 'Runner type'
        required: false
        type: string
        default: 'ubuntu-latest'

    secrets:
      QODANA_TOKEN:
        required: true

# Least privilege for what this workflow actually does. Without it the
# job inherits whatever the calling repository's default happens to be,
# which on older repositories is write-all.
permissions:
  contents: read

jobs:
  qodana:
    name: Qodana Analysis
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      - name: Run Qodana analysis
        uses: JetBrains/qodana-action@10be11607eb323a180e2b76b26c9c5cdceac3e77  # v2026.2.1
        with:
          args: --apply-fixes
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}

      - name: Qodana Summary
        run: |
          echo "### Qodana Analysis" >> $GITHUB_STEP_SUMMARY
          echo "Analysis completed. Check [Qodana Cloud](https://qodana.cloud) for details." >> $GITHUB_STEP_SUMMARY