Codacy Overview PDF Report

Generates a 3-page PDF (Overview, Open Issues, Security and Risk Management) for a Codacy organization, styled after the Codacy dashboard. Built from swagger.yaml (https://api.codacy.com/api/api-docs/swagger.yaml).

Setup

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python -m playwright install chromium

Usage

export CODACY_API_TOKEN=xxxx   # account API token (Settings > API Tokens)
python report.py --provider gh --org my-org --output report.pdf

Try it without a real account first:

python report.py --mock --output report.pdf

Scope it to a single repository instead of the whole org:

python report.py --provider gh --org my-org --repository my-repo --output report.pdf

Options:

• --provider — git provider slug (gh, gl, bb)
• --org — remote organization name
• --repository — optional; scope every panel/chart/table to one repository
• --token — API token (defaults to CODACY_API_TOKEN env var)
• --days — lookback window for trend charts (default 90)
• --html-out — also dump the rendered HTML (useful for debugging layout)

What it pulls from the API

• GET /organizations/{provider}/{org} — org name
• GET /analysis/organizations/{provider}/{org}/repositories (paginated) — per-repo grade, issues, complexity, duplication, coverage; used for the KPI strip, "Last updated repositories" table, and "Repositories with the most issues"
• GET /organizations/{provider}/{org}/metrics/ready — which metrics are available for this org (features degrade gracefully if some aren't ready)
• POST /organizations/{provider}/{org}/metrics/openissues/latest-grouped (groupBy severity / category) — severity donut, category breakdown
• POST /organizations/{provider}/{org}/metrics/openissues/timerange (groupBy severity) — evolution chart
• POST /organizations/{provider}/{org}/metrics/{newissues,fixedissues,preventedissues}/timerange — code health sparklines
• POST /organizations/{provider}/{org}/security/dashboard — open findings, SLA status, and per-scan-type counters (page 3 KPI cards + scan types grid)
• POST /organizations/{provider}/{org}/security/dashboard/repositories/search — top 10 high-risk repositories by severity
• POST /organizations/{provider}/{org}/security/dashboard/categories/search — top 10 common security categories
• POST /organizations/{provider}/{org}/security/dashboard/history/search — open findings evolution + new-vs-fixed activity history (last 3 months)

If the organization has no SRM/security entitlement, the security endpoints return a 403/404 and page 3 is simply omitted from the report.

AI Policy compliance and AI Risk level panels from the dashboard are intentionally out of scope for this version.

Files

• report.py — CLI entrypoint / orchestration
• codacy_client.py — minimal Codacy API client (api-token header auth)
• charts.py — matplotlib chart generation (donut, sparklines, evolution chart)
• templates/report.html.j2 — Jinja2 HTML template rendered to PDF via Playwright/Chromium