ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Security & identity · #qodana
Running Qodana in CI calls for a hard ceiling on analysis time. The documented run.timeout option in qodana.yaml (mirrored by a --timeout CLI flag) provides one: when the limit expires, the run stops with a non-zero exit code and a partial report. The open design problem is making that termination — and SIGTERM-based job cancellation — behave gracefully rath
Qodana Docker Scanner: Custom CA Trust Store Reload Limitation When running Qodana in a Docker container, users often mount a private CA certificate into the image to allow Maven or NPM repositories to be accessed over HTTPS. The scanner will trust the certificate only after the image’s trust store has been updated and the container restarted. This behavior
Goal: Determine whether Qodana can continue to produce reliable analysis results after an inspection schema change without requiring manual baseline regeneration. Qodana stores a baseline file that records existing issues; when the underlying inspection schema changes (e.g., upgrading Qodana or modifying profiles), the baseline may become outdated. The tool
Baseline behavior under profile evolution Qodana baselines store suppressed issue fingerprints keyed to specific inspection IDs. When a team updates qodana.yaml to enable additional inspections — or syncs a revised IDE profile — the existing baseline file contains no entries for the newly activated inspection IDs. Consequently, code patterns that were previo
We run Qodana in CI with a pinned linter image tag and a versioned qodana.yaml to keep analysis repeatable across developer machines and pipelines. To adopt it on a legacy module, we generated a baseline file (qodana.sarif.json) so the quality gate only fails on new violations rather than the existing backlog. What we cannot pin down is the baseline's matchi
docker