Merge branch 'main' into dependabot/npm_and_yarn/actions/github-6.0.0

Author: adangel

.github/workflows/generate.yml

@@ -54,7 +54,7 @@ jobs:
           git add CHANGELOG.md && git commit -m 'Updated CHANGELOG.md' && git push origin main
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3.8.1
+        uses: actions/setup-node@v4.0.2
         with:
           node-version: 20
 

.github/workflows/publish.yml

@@ -19,7 +19,7 @@ jobs:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Setup Node
-        uses: actions/setup-node@v3.8.1
+        uses: actions/setup-node@v4.0.2
         with:
           node-version: 20
 

.github/workflows/test.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - name: Setup Node.js
-      uses: actions/setup-node@v3.8.1
+      uses: actions/setup-node@v4.0.2
       with:
         node-version: 20
     - run: npm ci

CHANGELOG.md

@@ -6,10 +6,33 @@
 
 **🚀 Implemented enhancements:**
 
+- Fix artifact upload, new parameter `uploadSarifReport` [\#250](https://github.com/pmd/pmd-github-action/pull/250) (@adangel)
 - Upgrade to node20 [\#221](https://github.com/pmd/pmd-github-action/pull/221) (@adangel)
 
 **📦 Dependency updates:**
 
+- Bump @actions/artifact from 2.0.1 to 2.1.4 [\#263](https://github.com/pmd/pmd-github-action/pull/263) (@dependabot[bot])
+- Bump nock from 13.5.0 to 13.5.4 [\#262](https://github.com/pmd/pmd-github-action/pull/262) (@dependabot[bot])
+- Bump eslint from 8.56.0 to 8.57.0 [\#259](https://github.com/pmd/pmd-github-action/pull/259) (@dependabot[bot])
+- Bump actions/setup-node from 4.0.1 to 4.0.2 [\#256](https://github.com/pmd/pmd-github-action/pull/256) (@dependabot[bot])
+- Bump semver from 7.5.4 to 7.6.0 [\#255](https://github.com/pmd/pmd-github-action/pull/255) (@dependabot[bot])
+- Bump nock from 13.4.0 to 13.5.0 [\#248](https://github.com/pmd/pmd-github-action/pull/248) (@dependabot[bot])
+- Bump @actions/artifact from 2.0.0 to 2.0.1 [\#247](https://github.com/pmd/pmd-github-action/pull/247) (@dependabot[bot])
+- Bump actions/setup-node from 4.0.0 to 4.0.1 [\#245](https://github.com/pmd/pmd-github-action/pull/245) (@dependabot[bot])
+- Bump eslint from 8.55.0 to 8.56.0 [\#244](https://github.com/pmd/pmd-github-action/pull/244) (@dependabot[bot])
+- Bump @actions/artifact from 1.1.2 to 2.0.0 [\#243](https://github.com/pmd/pmd-github-action/pull/243) (@dependabot[bot])
+- Bump eslint from 8.54.0 to 8.55.0 [\#242](https://github.com/pmd/pmd-github-action/pull/242) (@dependabot[bot])
+- Bump nock from 13.3.8 to 13.4.0 [\#241](https://github.com/pmd/pmd-github-action/pull/241) (@dependabot[bot])
+- Bump eslint from 8.53.0 to 8.54.0 [\#240](https://github.com/pmd/pmd-github-action/pull/240) (@dependabot[bot])
+- Bump eslint from 8.52.0 to 8.53.0 [\#238](https://github.com/pmd/pmd-github-action/pull/238) (@dependabot[bot])
+- Bump nock from 13.3.7 to 13.3.8 [\#237](https://github.com/pmd/pmd-github-action/pull/237) (@dependabot[bot])
+- Bump nock from 13.3.6 to 13.3.7 [\#236](https://github.com/pmd/pmd-github-action/pull/236) (@dependabot[bot])
+- Bump actions/setup-node from 3.8.1 to 4.0.0 [\#235](https://github.com/pmd/pmd-github-action/pull/235) (@dependabot[bot])
+- Bump eslint from 8.51.0 to 8.52.0 [\#234](https://github.com/pmd/pmd-github-action/pull/234) (@dependabot[bot])
+- Bump nock from 13.3.4 to 13.3.6 [\#233](https://github.com/pmd/pmd-github-action/pull/233) (@dependabot[bot])
+- Bump @vercel/ncc from 0.38.0 to 0.38.1 [\#232](https://github.com/pmd/pmd-github-action/pull/232) (@dependabot[bot])
+- Bump nock from 13.3.3 to 13.3.4 [\#230](https://github.com/pmd/pmd-github-action/pull/230) (@dependabot[bot])
+- Bump eslint from 8.50.0 to 8.51.0 [\#229](https://github.com/pmd/pmd-github-action/pull/229) (@dependabot[bot])
 - Bump @octokit/rest from 20.0.1 to 20.0.2 [\#227](https://github.com/pmd/pmd-github-action/pull/227) (@dependabot[bot])
 - Bump eslint from 8.49.0 to 8.50.0 [\#226](https://github.com/pmd/pmd-github-action/pull/226) (@dependabot[bot])
 - Bump jest from 29.6.4 to 29.7.0 [\#225](https://github.com/pmd/pmd-github-action/pull/225) (@dependabot[bot])
@@ -42,6 +65,10 @@
 - Bump convert-action from 0.2.0 to 0.2.2 [\#194](https://github.com/pmd/pmd-github-action/pull/194) (@dependabot[bot])
 - Bump eslint from 8.41.0 to 8.42.0 [\#192](https://github.com/pmd/pmd-github-action/pull/192) (@dependabot[bot])
 
+**✔️ Closed issues:**
+
+- Getting Warning in Node version only for PMD [\#253](https://github.com/pmd/pmd-github-action/issues/253)
+
 ## [v1.4.1](https://github.com/pmd/pmd-github-action/tree/v1.4.1) (2023-05-26)
 
 [Full Changelog](https://github.com/pmd/pmd-github-action/compare/v1.4.0...v1.4.1)

README.md

@@ -83,6 +83,7 @@ See also [Uploading a SARIF file to GitHub](https://docs.github.com/en/code-secu
 |`rulesets`  |yes|        |Comma separated list of ruleset names to use.|
 |`analyzeModifiedFilesOnly`|no|"true"|Instead of analyze all files under "sourcePath", only the files that have been touched in a pull request or push will be analyzed. This makes the analysis faster and helps especially bigger projects which gradually want to introduce PMD. This helps in enforcing that no new code violation is introduced.<br>Depending on the analyzed language, the results might be less accurate results. At the moment, this is not a problem, as PMD mostly analyzes each file individually, but that might change in the future.<br>If the change is very big, not all files might be analyzed. Currently the maximum number of modified files is 300.<br>Note: When using PMD as a code scanner in order to create "Code scanning alerts" on GitHub, all files should be analyzed in order to produce a complete picture of the project. Otherwise alerts might get closed too soon.|
 |`createGitHubAnnotations`|no|"true"|By default, all detected violations are added as annotations to the pull request. You can disable this by setting FALSE. This can be useful if you are using another tool for this purpose.|
+|`uploadSarifReport`|no|"true"|By default, the generated SARIF report will be uploaded as an artifact named "PMD Report". This can be disabled, e.g. if there are multiple executions on multiple os of this action.|
 
 ## Outputs
 

action.yml

@@ -82,6 +82,13 @@ inputs:
       are using another tool for this purpose.
     required: false
     default: 'true'
+  uploadSarifReport:
+    description: >-
+      By default, the generated SARIF report will be uploaded as an artifact
+      named "PMD Report". This can be disabled, e.g. if there are multiple
+      executions on multiple os of this action.
+    required: false
+    default: 'true'
 outputs:
   violations:
     description: Number of violations found