List the issues in every repository of a Codacy-analyzed organization, ranked by Codacy's false-positive probability. Useful for triaging which findings are worth a second look before you disable a pattern or ignore an issue in bulk.
Data comes straight from the Codacy API: the organization's repositories, then each repository's issues, filtered by default to only those Codacy flags as potential false positives.
- Python 3.8+
- A Codacy account API token with access to the organization
pip install -r requirements.txtSet CODACY_API_TOKEN, either in your shell or in a .env file (see
.env.example):
cp .env.example .env
# then edit .env and paste your tokenA token already set in the environment takes priority over .env.
./codacy_fp.py <provider> <organization> [options]provider is one of gh (GitHub), bb (Bitbucket) or gl (GitLab), and
organization is the org/group/workspace name as it appears on Codacy.
# Table on screen, potential false positives only (the default)
./codacy_fp.py gh my-org
# CSV file
./codacy_fp.py gl my-group --format csv --output fps.csv
# Every issue (not just potential false positives), above a probability floor
./codacy_fp.py bb my-workspace --all --min-probability 50
# Only specific repositories
./codacy_fp.py gh my-org -r repo-a -r repo-b| Flag | Description |
|---|---|
-f, --format {table,csv,json} |
Output format (default: table) |
-o, --output FILE |
Write to a file instead of stdout |
-r, --repo NAME |
Only scan this repository (repeatable) |
--all |
Include every issue, not only potential false positives |
--min-probability N |
Keep only issues with false-positive probability ≥ N |
--refresh |
Ignore the cache and refetch every repository |
--cache-ttl HOURS |
Reuse cached repositories younger than this (default: 24) |
--cache-dir DIR |
Where per-repository results are cached (default: .cache/codacy_fp) |
provider, organization, repository, file, line, tool, pattern,
category, severity, message, fp_probability, fp_threshold,
fp_reason.
The on-screen table drops category, fp_threshold and fp_reason to stay
readable, and shrinks the message column to fit your terminal. CSV and
JSON output include every column.
Large organizations can have hundreds of repositories, so results are cached per repository as soon as they're fetched (atomically, so an interrupted write can't corrupt the cache). If a run fails partway through or is interrupted, rerunning it skips repositories that already succeeded and retries only the ones that didn't — no need to start from zero.
Cached repositories are reused for --cache-ttl hours (default 24); pass
--refresh to ignore the cache and refetch everything. --min-probability
is applied after loading from the cache, so changing it alone never
triggers a refetch.
Requests that hit 429 or a 5xx response, or that time out, are retried
with exponential backoff (respecting Retry-After when the API sends it),
up to 6 attempts. A failure on one repository doesn't stop the run: it's
logged, skipped, and listed at the end so you can rerun to retry just those.
An invalid or expired token stops the run immediately, since there's no
point retrying that.