Codacy | Blog - Automate your code quality

Introducing Codacy Skills (Part 3): Let your agent set up test coverage

Alejandro Rizzo — Thu, 06 Aug 2026 14:24:21 GMT

Codacy tracks four metrics on a repository: issues, duplication, complexity, and coverage.

Three of them we work out by analysing the code. Coverage is the one we cannot, because knowing which lines your tests reach means running the tests, and your tests run in your pipeline rather than ours. So coverage arrives by upload, and it feeds two of the six criteria you can put on a merge gate: Diff Coverage on the lines a pull request changed, and Coverage Variation on a drop in overall coverage.

By hand, that upload is a handful of stack-specific decisions. Getting your test runner to generate a format Codacy accepts, at a known path. Adding the reporter after the test step, with the project token wired in. Making sure it runs on the branch you compare against and not only on pull requests.

The coverage docs walk through all of it, but the answers differ from stack to stack: a Go repo and a Gradle repo, for example, want different report paths, while a monorepo wants a decision about the modules.

The new Setup Coverage Skill wires that up for you.

TL;DR

Coverage is the one Codacy metric that must come from the tests running on your CI
The details differ by stack: report format, output path, where the reporter goes
The Setup Coverage Skill handles that wiring for you, from report generation to upload

Best CodeRabbit Alternatives for AI Code Review, Code Quality, and AppSec Enforcement (2026)

Codacy — Thu, 30 Jul 2026 16:11:18 GMT

The best CodeRabbit alternatives for AI code review and code security fall into three categories:

How to Get Security Approval for AI Coding Tools: A Technical Governance Blueprint (2026)

Codacy — Wed, 22 Jul 2026 19:47:18 GMT

Getting security approval for AI coding tools requires replacing verbal assurances with repository-level evidence: a live inventory of which models, SDKs, and MCP servers exist in your codebase, enforced policy at the pull request stage, and exportable audit records.

Pre-Commit vs CI Quality Gates: When Fast-Shipping Moves The Checks Upstream

Codacy — Wed, 22 Jul 2026 15:22:17 GMT

Teams that ship dozens of pull requests a week eventually run into the same wall: CI-stage quality gates turn into a queue. A developer opens a PR, moves on to the next ticket, and twenty minutes later gets pinged that a linter failed or a dependency check flagged something trivial.

Fixing it now means reloading context on a branch they have mentally already closed. Multiply that across a team shipping fast, and the queue becomes the bottleneck, rather than the code itself.

Detecting Malicious Intent Across AI-Generated Pull Requests: A Governance Framework for Engineering Leaders

Codacy — Tue, 21 Jul 2026 16:01:52 GMT

No single pull request has to look malicious to create a serious security problem. One adds logging. Another introduces a background job. A third expands network access. Individually, each change is reasonable enough to pass review. Together, they assemble a capability no reviewer ever intended to approve.

AI Code Review Is Not Enough: How Engineering Leaders Should Gate AI-Generated Code

Codacy — Tue, 14 Jul 2026 14:16:37 GMT

The easiest pull requests to approve are often the ones that deserve the closest inspection. AI-generated code tends to arrive well formatted, well documented, and accompanied by a convincing explanation of what changed.

A Global CX Software Company Closed 1,200 Security Issues with 90% Accuracy Using Codacy

Codacy — Tue, 14 Jul 2026 11:04:55 GMT

This customer operates in a security-sensitive environment and has requested anonymity; all figures and quotes are as provided.

The company scales application security across 900+ repositories and 1,400 developers while significantly reducing false positives and accelerating remediation times. We spoke with its Manager of Security Operations, who leads vulnerability management, and its Senior Security Engineer, who owns SAST, DAST, and vulnerability scanning.

Why this Fintech Chose Codacy Over SonarQube, Semgrep, and GitHub Advanced Security

Codacy — Tue, 14 Jul 2026 10:29:52 GMT

Given the compliance-sensitive nature of financial services, this customer chose to share their story anonymously.

Learn how this fintech platform serving 70+ global financial institutions chose Codacy to move security from a periodic gate into a continuous habit for 150 engineers. We spoke with the company's Senior Director of Engineering about why point-in-time audits weren't enough, and how his team made secure coding part of the daily workflow.

Deterministic Static Analysis for AI Coding Workflows: How to Cut Token Cost Without Weakening Code Review

Codacy — Mon, 13 Jul 2026 13:31:08 GMT

An AI coding agent opens a pull request. Another agent reviews it, searches the repository, reads a few irrelevant files, pulls more context into the conversation, and tries again. By the time it reaches a useful conclusion, the team may have paid several times for context that had little to do with the final finding.

Why Engineering Teams Keep Building In-House AI Code Review Tools, and What It Really Costs

Codacy — Thu, 09 Jul 2026 13:44:00 GMT

LLMs made internal AI code review tools easy to prototype. They did, however, not make them easy to operate.