Static Analysis in CI — Delphi, Free Pascal & VB6

CI/CD Integration

Integrate LegacyLint into your build pipeline to catch issues early.

GitHub Actions

Use the LegacyLint GitHub Action to scan Delphi, Free Pascal and VB6 code and comment findings inline on every pull request:

name: LegacyLint
on:
  pull_request:
    paths: ['**/*.pas', '**/*.pp', '**/*.lpr', '**/*.bas', '**/*.cls', '**/*.frm', '**/*.ctl']

permissions:
  contents: read
  pull-requests: write

jobs:
  legacylint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: LegacyLint/LegacyLint@v1
        with:
          api-key: ${{ secrets.LEGACYLINT_API_KEY }}
          project-key: my-app

Azure DevOps

Scan Delphi, Free Pascal and VB6 code and comment findings inline on Azure Repos pull requests. The reporter posts inline threads plus a summary comment via the Azure DevOps REST API.

pr:
  branches: { include: ['main'] }
  paths: { include: ['**/*.pas', '**/*.pp', '**/*.lpr', '**/*.bas', '**/*.cls', '**/*.frm', '**/*.ctl'] }

pool: { vmImage: ubuntu-latest }

variables:
  LEGACYLINT_PROJECT_KEY: my-project-key   # add LegacyLintApiKey as a *secret* variable

steps:
  - checkout: self
    persistCredentials: true

  - script: |
      curl -fL -H "X-LegacyLint-Key: $(LegacyLintApiKey)" \
        -o legacylint.zip https://api.legacylint.com/api/downloads/cli/linux-x64
      unzip -o legacylint.zip && chmod +x legacylint
    displayName: 'Install LegacyLint CLI'

  - script: |
      ./legacylint scan . --format json --output legacylint-report.json \
        --project-key "$(LEGACYLINT_PROJECT_KEY)" --api-key "$(LegacyLintApiKey)" \
        --commit-sha "$(System.PullRequest.SourceCommitId)" || true
    displayName: 'Run LegacyLint scan'

  - script: |
      curl -fL -o legacylint-pr-comment.ps1 \
        https://raw.githubusercontent.com/LegacyLint/LegacyLint/v1/azure-devops/legacylint-pr-comment.ps1
    displayName: 'Fetch PR reporter'

  - pwsh: ./legacylint-pr-comment.ps1 -Scope changed-files -FailOn error
    displayName: 'Comment findings on the PR'
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

One-time setup for Azure Repos: add a secret variable LegacyLintApiKey; add this pipeline as a Build Validation branch policy; and grant the project's Build Service identity Contribute to pull requests on the repo so it can post comments.

Blocking merges on findings

Both integrations fail the check when a reported finding reaches a severity threshold, so you can stop a pull request from being merged until the code is clean. Control the threshold with fail-on: error (default), warning, or none (report only, never fail). By default only findings on the lines the PR changed are considered (report-scope: changed-lines).

GitHub: the Action sets the check to failed. In your repo, add a Branch protection rule (Settings → Branches) that requires the LegacyLint Delphi Scan status check to pass — GitHub then disables the merge button while it is red.

Azure DevOps: the reporter fails the task. Add the pipeline as a required Build Validation policy on the target branch — the PR cannot complete while the build is failing.

Plain CLI: pass --fail-on error (or warning) so a bare legacylint scan step exits non-zero and fails the pipeline. Without it the scan always exits 0 when it ran successfully, so uploading results never breaks an unrelated build.

# GitHub Action — fail the check on any warning or error
- uses: LegacyLint/LegacyLint@v1
  with:
    api-key: ${{ secrets.LEGACYLINT_API_KEY }}
    project-key: my-app
    fail-on: warning        # error (default) | warning | none

# Plain CLI — gate a build without the reporter
legacylint scan . --project-key my-app --api-key $LEGACYLINT_API_KEY --fail-on error