Skip to content

Running ESLint#

To run ESLint as a client-side tool:

  1. Enable ESLint and configure the corresponding code patterns on your repository Code patterns page.

  2. Enable Run analysis on your build server on your repository Settings, tab General, Repository analysis on your server.

    This setting enables Codacy to wait for the results of the local analysis before resuming the analysis of your commits.

    Run analysis on your build server

  3. Set up an API token to authenticate on Codacy:

    • If you're setting up one repository, obtain a repository API token and set the following environment variable to specify your repository API token:

      export CODACY_PROJECT_TOKEN=<your repository API token>

    • If you're setting up multiple repositories, obtain an account API Token and set the following environment variable to specify the account API token:

      export CODACY_API_TOKEN=<your account API token>

    Warning

    Never write API tokens to your configuration files and keep your API tokens well protected, as they grant owner permissions to your projects on Codacy.

    It's a best practice to store API tokens as environment variables. Check the documentation of your CI/CD platform on how to do this.

Manual configuration#

Install the Codacy Analysis CLI and initialize the repository. Initialization writes .codacy/codacy.config.json, which analyze requires: pulling it from Codacy Cloud with init --remote means the local run uses the same ESLint patterns as your repository's Code patterns page.

npm i -g @codacy/analysis-cli
codacy-analysis init --remote <gh|gl|bb> <ORGANIZATION> <REPOSITORY>

Then run the analysis and upload the results:

codacy-analysis analyze --tool eslint9 --output-format sarif --output eslint.sarif
codacy-analysis upload eslint.sarif --commit $COMMIT_SHA

If you're using an account API token, you must also provide the --repository flag with your provider, organization, and repository name. You can obtain these values from the URL of your repository dashboard on Codacy:

codacy-analysis analyze --tool eslint9 --output-format sarif --output eslint.sarif
codacy-analysis upload eslint.sarif --commit $COMMIT_SHA --repository <gh|gl|bb> <ORGANIZATION> <REPOSITORY>

Note

--tool matches against the tool IDs in your .codacy/codacy.config.json, and only tools listed there run. If --tool eslint9 doesn't match your setup, check that file for the ID it recorded, which is ESLint9 for ESLint 9.x and ESLint8 for ESLint 8.x.

GitHub Action#

The Codacy Analysis CLI GitHub Action runs the same codacy-analysis CLI as the manual configuration above. If your repository has no committed .codacy/codacy.config.json, the action fetches the repository's configuration from Codacy with your token.

On pull_request events, the action uploads the results for the pull request's head commit. Check out that commit with ref: as in the examples below, otherwise line numbers can point at the wrong lines.

Using a project token#

- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.pull_request.head.sha || github.sha }}

- name: Run Codacy Analysis CLI
  uses: codacy/analysis-cli-action@v1
  with:
    project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
    tool: eslint9
    upload: true

Using an account API token#

The action takes the provider, organization, and repository from the workflow. Set provider, owner, and repository only if the repository is on Codacy under different names.

- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.pull_request.head.sha || github.sha }}

- name: Run Codacy Analysis CLI
  uses: codacy/analysis-cli-action@v1
  with:
    api-token: ${{ secrets.CODACY_API_TOKEN }}
    tool: eslint9
    upload: true

Tokens should be stored in the repository secrets.

Was this page helpful?

Your feedback helps us improve the documentation.

Edit this page on GitHub Contact support