1+ # This workflow uses actions that are not certified by GitHub.
2+ # They are provided by a third-party and are governed by
3+ # separate terms of service, privacy policy, and support
4+ # documentation.
5+
6+ name : pmd
7+
8+ on :
9+ push :
10+ branches : [ "develop" ]
11+ pull_request :
12+ branches : [ "develop" ]
13+ schedule :
14+ - cron : ' 41 12 * * 3'
15+
16+ permissions :
17+ contents : read
18+
19+ jobs :
20+ pmd-code-scan :
21+ permissions :
22+ contents : read # for actions/checkout to fetch code
23+ security-events : write # for github/codeql-action/upload-sarif to upload SARIF results
24+ actions : read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
25+ runs-on : ubuntu-latest
26+ env :
27+ FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 : true
28+ steps :
29+ - uses : actions/checkout@v5
30+ with :
31+ fetch-depth : 0 # 必须拉取完整历史,才能比较分支差异
32+ - name : Set up JDK 17
33+ uses : actions/setup-java@v5
34+ with :
35+ java-version : ' 17'
36+ distribution : ' temurin'
37+ - name : Run PMD on changed Java files only
38+ id : pmd
39+ run : |
40+ # 1. 确定目标分支(从环境变量获取)
41+ if [ -n "$GITHUB_BASE_REF" ]; then
42+ BASE_BRANCH="$GITHUB_BASE_REF"
43+ else
44+ # 如果是 push 事件,回退到 main 或 develop
45+ BASE_BRANCH="develop" # 或 main,根据项目调整
46+ fi
47+
48+ # 2. 确保目标分支的远程引用存在
49+ git fetch origin "$BASE_BRANCH" --depth=1 || true
50+
51+ # 3. 获取变更的 Java 文件(比较当前 HEAD 与目标分支)
52+ CHANGED_FILES=$(git diff --name-only "origin/$BASE_BRANCH" HEAD | grep '\.java$' || true)
53+
54+ echo "📝 变更的 Java 文件列表:"
55+ if [ -n "$CHANGED_FILES" ]; then
56+ echo "$CHANGED_FILES"
57+ else
58+ echo "(无)"
59+ fi
60+ echo "----------------------------------------"
61+
62+ if [ -z "$CHANGED_FILES" ]; then
63+ echo "No Java files changed, skipping PMD."
64+ echo "violations=0" >> $GITHUB_OUTPUT
65+ exit 0
66+ fi
67+
68+ # 4. 生成文件列表(绝对路径)
69+ > changed-files.txt
70+ for file in $CHANGED_FILES; do
71+ echo "$PWD/$file" >> changed-files.txt
72+ done
73+
74+ # 5. 下载 PMD
75+ PMD_VERSION="6.55.0"
76+ curl -L "https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip" -o pmd.zip
77+ unzip -q pmd.zip
78+ mv pmd-bin-${PMD_VERSION} pmd
79+ PMD_CMD="$PWD/pmd/bin/run.sh"
80+ chmod +x "$PMD_CMD"
81+
82+ # 6. 扫描变更的 Java 文件
83+ "$PMD_CMD" pmd --no-cache \
84+ --file-list changed-files.txt \
85+ -f sarif \
86+ -R rulesets/java/quickstart.xml \
87+ -r pmd-report.sarif || true
88+
89+ # 7. 统计违规数
90+ if [ -f pmd-report.sarif ]; then
91+ violations=$(jq '.runs[0].results | length' pmd-report.sarif)
92+ else
93+ violations=0
94+ fi
95+ echo "violations=$violations" >> $GITHUB_OUTPUT
96+
97+ # 清理
98+ rm -f changed-files.txt
99+
100+
101+ - name : Install sarif-tools and convert to HTML
102+ run : |
103+ pip install sarif-tools
104+ sarif html pmd-report.sarif --output pmd-report.html
105+
106+ - name : Upload SARIF file
107+ uses : github/codeql-action/upload-sarif@v4
108+ with :
109+ sarif_file : pmd-report.sarif
110+
111+ - name : Upload SARIF file as artifact
112+ uses : actions/upload-artifact@v7
113+ with :
114+ name : pmd-sarif-report # 给工件起一个有意义的名字
115+ path : pmd-report.sarif
116+
117+ - name : Upload HTML report
118+ uses : actions/upload-artifact@v7
119+ with :
120+ name : pmd-html-report
121+ path : pmd-report.html
122+
123+ - name : Check PMD violations
124+ run : |
125+ if [[ ${{ steps.pmd.outputs.violations }} -eq 0 ]]; then
126+ echo "✅ PMD 未发现代码问题,构建通过。"
127+ exit 0
128+ else
129+ echo "❌ PMD 发现 ${{ steps.pmd.outputs.violations }} 个代码问题,构建失败。"
130+ exit 1
131+ fi
0 commit comments