Adopt Qodana Community Edition for Multi-Language Code Quality Checks

[miroslavpojer]

Adopt Qodana Community Edition for Multi-Language Code Quality Checks

Update:

• compare Qodana with concurrent solutions

Issue description is universal - will be used for more repos.

Goal

Integrate JetBrains Qodana (Community Edition) into CI/CD to establish code quality gates across all primary languages used in this repository:

• Terraform → covered by tflint (already in place)
• Python → analyzed by qodana-python
• Scala (JVM) → analyzed by qodana-jvm-community + org.intellij.scala plugin
• JavaScript/TypeScript → analyzed by qodana-js

The purpose is to block new issues in PRs while progressively reducing the existing backlog.

---

Implementation Steps

1. Qodana configuration

• Create qodana.yaml in the root with basic excludes and plugin config for Scala.
• Define excludes for generated/build folders, dependencies, and legacy paths.

2. Initial baselines

• Run local scans and create baselines:

  qodana scan --linter jetbrains/qodana-jvm-community --baseline qodana-baselines/jvm.sarif.json --save-report
  qodana scan --linter jetbrains/qodana-python --baseline qodana-baselines/python.sarif.json --save-report
  qodana scan --linter jetbrains/qodana-js --project-dir web --baseline qodana-baselines/js.sarif.json --save-report

• Commit qodana.yaml and all .sarif.json baseline files.

3. GitHub Actions workflow

• Add new job in .github/workflows/test.yml.
• Set --fail-threshold 0 to fail only when new issues are introduced.

4. Branch protection rules

• Require successful completion of all Qodana jobs for PR merge.

---

📊 Expected Benefits

Area	Impact
PR Quality Gate	No new technical debt (new issues fail CI)
Multi-language Coverage	Consistent inspection across Python, Scala, and JS
Developer Experience	Inline annotations in PRs via SARIF integration

---

🔧 References

• JetBrains Qodana Docs
• JetBrains Qodana GitHub Action
• Qodana Community Linters
• Scala Plugin for Qodana

[tmikula-dev]

Qodana Community SPIKE

Qodana versions comparison

Qodana Community

Programming Languages: Groovy, Java, Kotlin, Python, C, C++, C#
Markup & Scripting Language: HTML, JSON, Shell, TOML, XML, YAML
Frameworks: Angular, JavaBeans, JUnit
Features: CI/CD integrations, Custom plugin support, Monorepo support
Historical Data Storage: 30 days

Qodana Paid

Programming Languages: + Golang, JavaScript, PHP, Ruby, TypeScript
Markup & Scripting Language: + CSS, FreeMarker, Markdown, XPath
Databases: MongoDB, MySQL, Oracle, PostgreSQL, SQL
Frameworks: + .NET, Node.js, React, Ruby on Rails, Spring
Features: + Code coverage, Docker/K8s, License audit, Public API, SSO
Historical Data Storage: 180 days - unlimited

Competition for CI/CD implementation

SonarQube

• pretty similar, both can export SARIF file
• broad multi-language scanning, better for projects that use many different tech
• better for any project with UI (JS, TS)
• better for larger codebases
• advanced dashboards, long-term metrics

Other options are not in the conversation IMHO.

Answer for the Qodana Goal

Integrate JetBrains Qodana (Community Edition) into CI/CD to establish code quality gates across all primary languages used in this repository:

Terraform → covered by tflint (already in place)
Python → analyzed by qodana-python
Scala (JVM) → analyzed by qodana-jvm-community + org.intellij.scala plugin
JavaScript/TypeScript → analyzed by qodana-js

Terraform: Use of TFlint not use of Qodana.
Python: Qodana Community supports Python in the full range.
Scala: qodana-jvm-community does not include the Scala lang in the default. We can use mentioned plugin org.intellij.scala, but full Scala inspections needs an Ultimate version. Community version supports partially.

The community coverage contains:

• Basic syntax errors, type checks
• Simple type issues
• Basic warnings

Is missing:

• Code smells
• Null-safety
• Security (taint)
• Code Coverage

UI: Not supported at all by the community version.

[miroslavpojer]

ok, I will check Licence of SonaQube.

[tmikula-dev]

QoDana from JetBrains does not fulfill our expectations to implement the tooling into our projects from the QA pov. Interesting option is a main competitor SonarQube, which will be spiked in the following issue https://github.com/absa-group/cps-qa/issues/65.