🐛 QD-11538: qodana-clang fails to send report (#574)

* 🧱 QD-11538: Update publisher to latest

* 🐛 QD-11538: Fix qodana cloud endpoint

* ✨ QD-11538: Bundle publisher-cli as part of executable

* 🧱 QD-11538: Add generate step to CI build

* 🐛 QD-11538: Fix typo

* ♻️ QD-11538: Remove unused code

* ✨ QD-11538: Create a unified system for downloading public resources

* 🐛 QD-11538: Fix custom endpoints not being used

* ♻️ QD-11538: Fix nitpicks

Author: bindreams

.github/workflows/ci.yml

@@ -37,9 +37,6 @@ jobs:
           touch cdnet/clt.zip tooling/baseline-cli.jar tooling/intellij-report-converter.jar tooling/qodana-fuser.jar
           rm go.work && mv go.work.github go.work
         shell: bash
-      - name: Download config-loader-cli.jar
-        run: chmod +x download_deps.sh && ./download_deps.sh
-        shell: bash
       - name: Set up gotestfmt
         uses: gotesttools/gotestfmt-action@v2
         with:
@@ -50,6 +47,13 @@ jobs:
           registry: registry.jetbrains.team
           username: ${{ secrets.SPACE_USERNAME }}
           password: ${{ secrets.SPACE_PASSWORD }}
+      - name: Build
+        # Build everything that will be tested. Although go test performs a build itself, gotestfmt will panic on a
+        # failed build.
+        run: |
+          go generate -v $(go list -f '{{.Dir}}/...' -m)
+          go build -v $(go list -f '{{.Dir}}/...' -m)
+        shell: bash
       - name: Run tests (with coverage)
         if: ${{ matrix.os != 'windows-latest' }}
         run: |

cmd/send.go

@@ -27,7 +27,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/spf13/cobra"
 	"os"
-	"path/filepath"
 )
 
 // newShowCommand returns a new instance of the show command.
@@ -57,9 +56,6 @@ If you are using other Qodana Cloud instance than https://qodana.cloud/, overrid
 				cliOptions.ConfigName,
 			)
 
-			var publisherPath string
-			publisherPath = filepath.Join(commonCtx.ConfDirPath(), platform.PublisherJarName)
-
 			publisher := platform.Publisher{
 				ResultsDir: commonCtx.ResultsDir,
 				LogDir:     commonCtx.LogDir(),
@@ -73,7 +69,6 @@ If you are using other Qodana Cloud instance than https://qodana.cloud/, overrid
 			platform.SendReport(
 				publisher,
 				tokenloader.ValidateCloudToken(commonCtx, false),
-				publisherPath,
 				java,
 			)
 		},

download_checksum_of_deps.sh

@@ -23,46 +23,47 @@
 package platform
 
 import (
-	"crypto/md5"
-	"encoding/hex"
+	"os"
+
 	"github.com/JetBrains/qodana-cli/v2025/cloud"
 	"github.com/JetBrains/qodana-cli/v2025/platform/qdenv"
 	"github.com/JetBrains/qodana-cli/v2025/platform/utils"
+	"github.com/JetBrains/qodana-cli/v2025/tooling"
 	log "github.com/sirupsen/logrus"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
 )
 
-const PublisherJarName = "publisher-cli.jar"
-const PublisherVersion = "2.1.31"
-
 type Publisher struct {
 	ResultsDir string
 	LogDir     string
 	AnalysisId string
 }
 
 // SendReport sends report to Qodana Cloud.
-func SendReport(publisher Publisher, token string, publisherPath string, javaPath string) {
-	if _, err := os.Stat(publisherPath); os.IsNotExist(err) {
-		err := os.MkdirAll(filepath.Dir(publisherPath), os.ModePerm)
-		if err != nil {
-			log.Fatalf("failed to create directory: %v", err)
-		}
-		fetchPublisher(publisherPath)
+func SendReport(publisher Publisher, token string, javaPath string) {
+	file, err := os.CreateTemp("", "qodana-publisher.jar")
+	if err != nil {
+		log.Fatalf("Failed to create a temporary file: %s", err)
 	}
-	if _, err := os.Stat(publisherPath); os.IsNotExist(err) {
-		log.Fatalf("Not able to send the report: %s is missing", publisherPath)
+	publisherPath := file.Name()
+	err = file.Close()
+	if err != nil {
+		log.Fatalf("Failed to close temporary file %q: %s", file.Name(), err)
 	}
+	defer func() {
+		err = os.Remove(file.Name())
+		if err != nil {
+			log.Fatalf("Failed to remove temporary file %q: %s", file.Name(), err)
+		}
+	}()
+
+	extractPublisher(publisherPath)
 
 	publisherCommand := getPublisherArgs(
 		javaPath,
 		publisherPath,
 		publisher,
 		token,
-		cloud.GetCloudApiEndpoints().CloudApiUrl,
+		cloud.GetCloudRootEndpoint().Url,
 	)
 	if _, _, res, err := utils.LaunchAndLog(publisher.LogDir, "publisher", publisherCommand...); res > 0 || err != nil {
 		os.Exit(res)
@@ -90,69 +91,25 @@ func getPublisherArgs(java string, publisherPath string, publisher Publisher, to
 		}
 	}
 	if endpoint != "" {
-		publisherArgs = append(publisherArgs, "--endpoint", endpoint)
+		publisherArgs = append(publisherArgs, "--qodana-endpoint", endpoint)
 	}
 	return publisherArgs
 }
 
-func getPublisherUrl(version string) string {
-	return "https://packages.jetbrains.team/maven/p/ij/intellij-dependencies/org/jetbrains/qodana/publisher-cli/" + version + "/publisher-cli-" + version + ".jar"
-}
-
-func fetchPublisher(path string) {
-	jarVersion := PublisherVersion
-	if _, err := os.Stat(path); err == nil {
-		return
-	}
-	err := utils.DownloadFile(path, getPublisherUrl(jarVersion), nil)
-	if err != nil {
-		log.Fatal(err)
-	}
-	verifyMd5Hash(jarVersion, path)
-}
-
-func verifyMd5Hash(version string, path string) {
-	if _, err := os.Stat(path); err != nil {
-		log.Fatal(err)
-	}
-	url := getPublisherUrl(version) + ".md5"
-	resp, err := http.Get(url)
+func extractPublisher(path string) {
+	file, err := os.Create(path)
 	if err != nil {
-		log.Fatalf("Error downloading md5 hash: %v", err)
+		log.Fatalf("Error while creating %q: %s", path, err)
 	}
-	defer func(Body io.ReadCloser) {
-		err := Body.Close()
+	defer func() {
+		err := file.Close()
 		if err != nil {
-			log.Fatal(err)
+			log.Fatalf("Error while closing %q: %s", path, err)
 		}
-	}(resp.Body)
+	}()
 
-	body, err := io.ReadAll(resp.Body)
+	_, err = file.Write(tooling.PublisherCli)
 	if err != nil {
-		log.Fatalf("Error reading md5 hash: %v", err)
-	}
-
-	downloadedMd5 := string(body)
-	fileContent, err := os.ReadFile(path)
-	if err != nil {
-		log.Fatalf("Error reading file: %v", err)
-	}
-
-	hasher := md5.New()
-	_, err = hasher.Write(fileContent)
-	if err != nil {
-		log.Fatalf("Error computing md5 hash: %v", err)
-	}
-
-	computedMd5 := hex.EncodeToString(hasher.Sum(nil))
-
-	if computedMd5 != downloadedMd5 {
-		err = os.Remove(path)
-		if err != nil {
-			log.Fatalf("Please remove file, since md5 doesn't match: %s", path)
-		}
-		log.Fatal("The provided file and the file from the link have different md5 hashes")
-	} else {
-		log.Debug("Obtained publisher " + version + " and successfully checked md5 hash")
+		log.Fatalf("Error while writing %q: %s", path, err)
 	}
 }

download_deps.sh

@@ -38,7 +38,7 @@ func TestFetchPublisher(t *testing.T) {
 		}
 	}(tempDir) // clean up
 	path := filepath.Join(tempDir, "publisher.jar")
-	fetchPublisher(path)
+	extractPublisher(path)
 
 	if _, err := os.Stat(path); os.IsNotExist(err) {
 		t.Fatalf("fetchPublisher() failed, expected %v to exists, got error: %v", path, err)
@@ -72,7 +72,7 @@ func TestGetPublisherArgs(t *testing.T) {
 		"--report-path", filepath.FromSlash("/path/to/results"),
 		"--token", "test-token",
 		"--tool", "test-tool",
-		"--endpoint", "test-endpoint",
+		"--qodana-endpoint", "test-endpoint",
 	}
 	if !reflect.DeepEqual(publisherArgs, expectedArgs) {
 		t.Errorf("getPublisherArgs returned incorrect arguments: got %v, expected %v", publisherArgs, expectedArgs)

platform/publisher.go

@@ -217,10 +217,10 @@ func sendReportToQodanaServer(c thirdpartyscan.Context) {
 			LogDir:     c.LogDir(),
 			AnalysisId: c.AnalysisId(),
 		}
+
 		SendReport(
 			publisher,
 			cloud.Token.Token,
-			utils.QuoteForWindows(filepath.Join(c.CacheDir(), PublisherJarName)),
 			utils.QuoteForWindows(c.MountInfo().JavaPath),
 		)
 	} else {

platform/publisher_test.go

@@ -17,7 +17,10 @@
 package utils
 
 import (
+	"crypto/sha256"
+	"errors"
 	log "github.com/sirupsen/logrus"
+	"io"
 	"os"
 	"path/filepath"
 )
@@ -83,3 +86,28 @@ func CopyDir(src string, dst string) error {
 	}
 	return nil
 }
+
+// GetSha256 computes a hash sum for a byte stream.
+func GetSha256(stream io.Reader) (result [32]byte, err error) {
+	hasher := sha256.New()
+	_, err = io.Copy(hasher, stream)
+	if err != nil {
+		return result, err
+	}
+
+	copy(result[:], hasher.Sum(nil))
+	return result, nil
+}
+
+// GetFileSha256 computes a hash sum from an existing file.
+func GetFileSha256(path string) (result [32]byte, err error) {
+	reader, err := os.Open(path)
+	if err != nil {
+		return result, err
+	}
+	defer func() {
+		err = errors.Join(err, reader.Close())
+	}()
+
+	return GetSha256(reader)
+}

platform/run.go

@@ -18,8 +18,6 @@ package tooling
 
 import _ "embed"
 
-// execute [./download_deps.sh] to load config-loader-cli.jar
-// source code: https://github.com/JetBrains/qodana-configuration
-
+//go:generate go run scripts/download-resource.go config-loader-cli.jar
 //go:embed config-loader-cli.jar
 var ConfigLoaderCli []byte