ci: Qodana update

.github/workflows/qodana.yml

@@ -9,17 +9,37 @@ on:
 
 jobs:
   qodana:
+    name: Build and analyze
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      checks: write
     steps:
       - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}  # to check out the actual pull request commit, not the merge commit
           fetch-depth: 0  # a full history is required for pull request analysis
-      - name: 'Qodana Scan'
-        uses: JetBrains/qodana-action@v2023.3
+      - name: Set up JDK 17
+        uses: actions/setup-java@v3
+        with:
+          java-version: 17
+          distribution: 'zulu' # Alternative distribution options are available.
+      - name: Cache Maven packages
+        uses: actions/cache@v3
+        with:
+          path: ~/.m2
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: ${{ runner.os }}-m2
+      - name: Build and analyze
+        run: mvn -B clean verify -P coverage
         env:
-          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Archive coverage data
+        uses: actions/upload-artifact@v2
+        with:
+          name: maven-coverage-data-jacoco
+          path: target/site/jacoco
+      - name: Qodana Scan
+        uses: JetBrains/qodana-action@main
+        env:
+          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
+        with:
+          args: "-i,JVM/jacoco/maven,--linter,jetbrains/qodana-jvm:2023.3-eap"
+          pr-mode: false

qodana.yaml

@@ -1,2 +1,5 @@
 version: "1.0"
 linter: jetbrains/qodana-jvm-community:2023.3
+include:
+  - name: CheckDependencyLicenses
+  - name: VulnerableLibrariesGlobal