Supported languages and tools#
Codacy uses industry-leading tools to perform automatic static code analysis over 40 supported languages:
-
For programming languages, Codacy provides static analysis as well as code duplication, code complexity, secret detection, dependency vulnerability scanning, and code coverage metrics for key languages.
-
For cloud infrastructure-as-code platforms, Codacy provides static analysis and secret detection to enforce security and compliance best practices.
The sections below group the tools that Codacy uses by scan type. Besides this, Codacy uses cloc to calculate the source lines of code for all supported languages and supports multiple code coverage report formats.
Important
Codacy runs security and other analysis tools when code changes are pushed to your repositories. These tools don't scan code for issues continuously.
Overview#
Static analysis#
See how Codacy calculates static analysis issues.
Secret detection#
| Language | Tools |
|---|---|
| Apex | Opengrep |
| AWS CloudFormation | Checkov, Opengrep 2, Trivy 2 |
| C | Opengrep, Trivy |
| C++ | Opengrep, Trivy |
| C# | Opengrep, Trivy |
| Dart | Trivy |
| Dockerfile | Opengrep, Trivy |
| Elixir | Trivy |
| GitHub Actions | Opengrep, Trivy |
| Go | Opengrep, Trivy |
| Helm | Opengrep 2, Trivy 2 |
| Java | PMD, Opengrep, Trivy |
| JavaScript | Opengrep, Trivy |
| JSON | Checkov, Trivy |
| Kotlin | Opengrep |
| Kubernetes | Checkov, Opengrep 2, Trivy 2 |
| PHP | Opengrep, Trivy |
| Python | Bandit, Prospector, Opengrep, Trivy |
| Ruby | Opengrep, Trivy |
| Rust | Opengrep, Trivy |
| Scala | Opengrep, Trivy |
| Shell | Opengrep |
| Swift | Opengrep, Trivy |
| Terraform | Checkov, Opengrep, Trivy |
| TypeScript | Opengrep, Trivy |
| XML | Trivy |
| YAML | Trivy |
Dependency vulnerability scanning#
| Language | Tools |
|---|---|
| C | Trivy, scans conan.lock (Conan) |
| C++ | Trivy, scans conan.lock (Conan) |
| C# | Trivy, scans .deps.json (.Net), packages.lock.json (NuGet) |
| Dart | Trivy, scans pubspec.lock |
| Elixir | Trivy, scans mix.lock (Mix) |
| Go | Trivy, scans go.mod |
| Java | Trivy, scans pom.xml and gradle.lockfile |
| JavaScript | Trivy, scans package.json and package-lock.json (npm), yarn.lock (Yarn) |
| Kotlin | Trivy, scans pom.xml and gradle.lockfile |
| PHP | Trivy, scans composer.lock (Composer) |
| Python | Trivy, scans requirements.txt (pip), Pipfile.lock (pipenv), poetry.lock (Poetry), uv.lock (UV) |
| Ruby | Trivy, scans Gemfile.lock (Bundler) |
| Rust | Trivy, scans Cargo.lock (Cargo) |
| Scala | Trivy, scans build.sbt.lock (sbt) 9 |
| Swift | Trivy, scans Package.resolved (SwiftPM) |
| TypeScript | Trivy, scans package.json and package-lock.json (npm), yarn.lock (Yarn) |
Malicious packages detection#
Malicious packages identified in the OpenSSF Malicious Packages database.
| Language | Tools |
|---|---|
| C# | Trivy, scans packages.lock.json for malicious packages published in NuGet |
| Go | Trivy, scans go.mod for malicious packages published in github.com |
| Java | Trivy, scans pom.xml and gradle.lockfile for malicious packages published in maven |
| JavaScript | Trivy, scans package.json and package-lock.json for malicious packages published in npm |
| Kotlin | Trivy, scans pom.xml and gradle.lockfile for malicious packages published in maven |
| Python | Trivy, scans requirements.txt (pip), Pipfile.lock (pipenv) for malicious packages published in PyPI |
| Ruby | Trivy, scans Gemfile.lock for malicious packages published in rubygems.org |
| Rust | Trivy, scans Cargo.lock for malicious packages published in crates.io |
| Scala | Trivy, scans build.sbt.lock for malicious packages published in maven 9 |
| TypeScript | Trivy, scans package.json and package-lock.json for malicious packages published in npm |
License scanning#
| Language | Package managers |
|---|---|
| C | Conan |
| C++ | Conan |
| C# | NuGet |
| Dart | Pub |
| Elixir | Hex |
| Go | Go modules |
| Java | Maven |
| JavaScript | npm |
| Kotlin | Maven |
| PHP | Composer |
| Python | PyPI |
| Ruby | Gem |
| Rust | Cargo |
| Scala | Maven |
| Swift | SwiftPM |
| TypeScript | npm |
Suggested fixes#
Codacy can suggest fixes for issues identified by these tools:
| Language | Tools |
|---|---|
| C | Opengrep |
| C# | Opengrep |
| Dockerfile | Opengrep |
| Go | Opengrep |
| Java | Opengrep |
| JavaScript | ESLint |
| Kubernetes | Opengrep |
| Markdown | markdownlint |
| Python | Opengrep |
| Ruby | Opengrep |
| TypeScript | ESLint |
Duplication#
See how Codacy calculates duplication.
| Language | Tools |
|---|---|
| Apex | PMD CPD 10 |
| C | PMD CPD 10 |
| C++ | PMD CPD 10 |
| C# | PMD CPD 10 |
| CoffeeScript | jscpd |
| Dart | jscpd |
| Elixir | jscpd |
| Go | PMD CPD 10 |
| Groovy | jscpd |
| Java | jscpd |
| JavaScript | PMD CPD 10 |
| JSP | PMD CPD 10 |
| Kotlin | jscpd |
| Objective-C | jscpd |
| PHP | PHPCPD |
| Python | PMD CPD 10 |
| Ruby | Flay |
| Rust | jscpd |
| Scala | PMD CPD 10 |
| Swift | PMD CPD 10 |
| TypeScript | jscpd |
| Visual Basic | jscpd |
| Visualforce | PMD CPD 10 |
Complexity#
See how Codacy calculates complexity.
| Language | Tools |
|---|---|
| C | Lizard |
| C++ | Lizard |
| C# | Lizard |
| Go | Lizard |
| Java | Lizard |
| JavaScript | Lizard |
| Kotlin | detekt 10 |
| Kubernetes | Lizard |
| Objective-C | Lizard |
| PHP | Lizard |
| Python | Lizard |
| Ruby | Lizard |
| Rust | Lizard |
| Scala | Lizard |
| Swift | Lizard |
| TypeScript | Lizard |
Docker images of supported tools#
Codacy adds support for new languages and tools by using a Docker image to run each tool.
The following table lists the Codacy GitHub repositories corresponding to each supported tool. Use these repositories to check the extra plugins supported by each tool or to submit GitHub issues related to each tool. To learn more about the tool versions used by Codacy, see the latest release notes.
See also#
-
This tool doesn't support custom file extensions. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩
-
Currently, only YAML file scanning is supported on this platform. ↩↩↩↩↩↩↩
-
Currently, Cppcheck only supports the MISRA guidelines for C. ↩↩
-
Currently, Codacy only supports including the packages lints and flutter_lints on dartanalyzer configuration files. ↩↩
-
Doesn't calculate the number of methods and the complexity per method for each file. ↩↩↩↩
-
Due to licensing limitations, Codacy doesn't support the latest version of Brakeman. To analyze your Ruby code for the latest security vulnerabilities, use Opengrep, which provides comprehensive and up-to-date security scanning. ↩↩
-
Supports reporting warnings or errors on functions above specific complexity thresholds. Enable the rule Cyclomatic Complexity on the Code patterns page, or use a configuration file to customize the thresholds. ↩
-
Requires the sbt-dependency-lock plugin for generating the lockfile. ↩↩
-
Codacy may use a different version of this tool for measuring complexity and duplication. ↩↩↩↩↩↩↩↩↩↩↩↩
Was this page helpful?
Your feedback helps us improve the documentation.
255 characters left
Thanks for helping improve Codacy documentation.
For more detailed feedback, open an issue on GitHub.