docs: replace Codacy CLI v2 with the Analysis CLI [OD-742]

docs/chart/whats-available-on-codacy-self-hosted.md

@@ -36,7 +36,7 @@ These features aren't available on Codacy Self-hosted:
 
 -   **Security:** [Security and risk management](../security/index.md), including [findings](../security/findings.md), [reports](../security/reports.md), [dependencies](../security/dependencies.md), [app scanning](../security/app-scanning.md), and [container scanning](../security/container-scanning.md)
 -   **Codacy AI:** [Codacy AI](../codacy-ai/codacy-ai.md) and the [AI risk hub](../organizations/ai-risk-hub.md)
--   **Developer tools:** [Codacy Guardrails](../codacy-guardrails/codacy-guardrails-getting-started.md), the [Visual Studio Code](../getting-started/integrating-codacy-with-visual-studio-code.md) and [IntelliJ](../getting-started/integrating-codacy-with-intellij-ides.md) extensions, the [Codacy Cloud CLI](../codacy-cloud-cli/index.md), [Codacy CLI v2](https://github.com/codacy/codacy-cli-v2), which connects only to Codacy Cloud, and [Codacy Skills](../codacy-skills/index.md)
+-   **Developer tools:** [Codacy Guardrails](../codacy-guardrails/codacy-guardrails-getting-started.md), the [Visual Studio Code](../getting-started/integrating-codacy-with-visual-studio-code.md) and [IntelliJ](../getting-started/integrating-codacy-with-intellij-ides.md) extensions, the [Codacy Cloud CLI](../codacy-cloud-cli/index.md), and [Codacy Skills](../codacy-skills/index.md)
 -   **Organizations:** [gate policies](../organizations/using-gate-policies.md), [segments](../organizations/segments.md), [audit logs](../organizations/audit-logs-for-organizations.md), [Issues metrics](../organizations/reporting/issues-metrics.md), [Codacy usage](../organizations/reporting/codacy-usage.md), organization-level [Jira](../organizations/integrations/jira-integration.md), [Slack](../organizations/integrations/slack-integration.md), and [webhooks](../organizations/integrations/webhooks.md), and [default Git provider settings](../organizations/integrations/default-git-provider-integration-settings.md)
 -   **Your account:** [user session management](../account/user-session-management.md)
 -   **Enterprise Cloud:** [GitHub Enterprise Cloud](../enterprise-cloud/github-enterprise-cloud.md)

docs/codacy-analysis-cli/index.md

@@ -129,6 +129,8 @@ Configurations created with `init --remote` are always re-synced in full, becaus
 !!! note
     `init` and `update-config` read the `exclude_paths` in your [Codacy configuration file](../repositories-configure/codacy-configuration-file.md) and record them in `codacy.config.json`, which is where `analyze` reads them from. Editing `.codacy.yaml` on its own doesn't change what `analyze` covers — run `update-config` afterward.
 
+    To check that file for mistakes first, run `codacy-analysis validate-configuration`.
+
 ## Analyze
 
 With the configuration in place, analyze the repository:
@@ -218,13 +220,18 @@ codacy-analysis analyze --tool-timeout 1800000
 
 # Log every tool invocation to stderr
 codacy-analysis analyze --log-level debug
+
+# Analyze files up to 1 MB instead of skipping those over 150 KB
+codacy-analysis analyze --max-file-size 1MB
 ```
 
+By default `analyze` skips files over 150 KB, like [Codacy Cloud](../faq/troubleshooting/why-is-my-file-over-150-kb-missing.md), and lists them in its output. Dependency manifests and lockfiles are always analyzed, whatever their size.
+
 Logs are written to `~/.codacy/logs/` as JSON lines and rotate at 10 MB. Add `--no-log` to disable file logging, which is worth doing in CI.
 
 ## Upload results to Codacy {: id="upload-results-to-codacy"}
 
-`upload` sends a report produced by `analyze` to Codacy and attaches its issues to a commit. Only reports from this CLI are accepted, because they already carry Codacy pattern IDs.
+`upload` sends a report to Codacy and attaches its issues to a commit. Reports produced by `analyze` already carry Codacy pattern IDs. A SARIF report from another tool is mapped to the matching Codacy tool by its driver name; if the CLI can't tell which tool produced it, name it with `--tool`.
 
 ```bash
 codacy-analysis analyze --output-format sarif --output results.sarif
@@ -239,6 +246,24 @@ With an account API token instead of a repository API token, name the repository
 codacy-analysis upload results.sarif --repository gh my-org my-repo --commit <sha>
 ```
 
+## Scan container images {: id="scan-container-images"}
+
+`container-scan` scans a container image for known vulnerabilities with Trivy, which the CLI downloads on first use. It reads the image from your local Docker daemon first and pulls it from the registry only if it isn't there:
+
+```bash
+codacy-analysis container-scan myorg/app:1.4.2
+```
+
+By default it reports `HIGH` and `CRITICAL` vulnerabilities in operating system packages that have a fix available. Change that with `--severity`, `--pkg-types library`, and `--no-ignore-unfixed`. It exits `1` when it finds vulnerabilities, so it can fail a pipeline.
+
+To have Codacy track the image's vulnerabilities over time instead, `upload-sbom` generates the image's SBOM and uploads it to [Container scanning](../security/container-scanning.md) in one step. It needs an [account API token](../codacy-api/api-tokens.md#account-api-tokens), from `CODACY_API_TOKEN` or `codacy-analysis login`:
+
+```bash
+codacy-analysis upload-sbom myorg/app:1.4.2 -p gh -o my-org -r my-repo -e production
+```
+
+Add `--tag` to record the SBOM under a different tag from the image's own, such as a rolling `prod` tag. See [How tagging affects your findings](../security/container-scanning.md#how-tagging-affects-your-findings).
+
 ## Inspect and combine configurations
 
 `discover` reports the languages, frameworks, libraries, and notable files the CLI finds, which is what `init --auto` bases its selection on:

docs/codacy-api/examples/uploading-container-image-sboms.md

@@ -4,7 +4,7 @@ description: Instructions on how to upload container image SBOMs to Codacy using
 
 # Uploading container image SBOMs to Codacy
 
-Codacy scans your container images for known vulnerabilities from an SBOM (Software Bill of Materials) that you upload. If your pipeline already produces an SBOM, or you generate one with a tool other than the [Codacy CLI v2](https://github.com/codacy/codacy-cli-v2), you can upload it directly through the API and monitor the results as findings under [Container scanning](../../security/container-scanning.md).
+Codacy scans your container images for known vulnerabilities from an SBOM (Software Bill of Materials) that you upload. If your pipeline already produces an SBOM, or you generate one with a tool other than the [Codacy Analysis CLI](../../codacy-analysis-cli/index.md#scan-container-images), you can upload it directly through the API and monitor the results as findings under [Container scanning](../../security/container-scanning.md).
 
 Before you automate this, read [how tagging affects your findings](../../security/container-scanning.md#how-tagging-affects-your-findings). The tag you upload to decides whether Codacy keeps one set of findings for the image or starts a new set with every release, and it's the choice that's hardest to reverse.
 

docs/faq/troubleshooting/why-is-my-file-over-150-kb-missing.md

@@ -10,4 +10,15 @@ As a solution to this problem, we placed a size limit to the files that Codacy w
 
 ## What if I need to analyze a file that exceeds this limit?
 
-While Codacy will ignore your file by default, you can still analyze it by running the analysis locally using the [Codacy Analysis CLI](https://github.com/codacy/codacy-analysis-cli). The Codacy Analysis CLI doesn't have any limitation on file size.
+While Codacy will ignore your file by default, you can still analyze it locally with the [Codacy Analysis CLI](../../codacy-analysis-cli/index.md). The CLI applies the same 150 KB limit by default, so that local results match Codacy Cloud's. Raise it with `--max-file-size`:
+
+```bash
+codacy-analysis analyze --max-file-size 1MB
+```
+
+To send those results to Codacy, write them to a file and [upload them](../../codacy-analysis-cli/index.md#upload-results-to-codacy):
+
+```bash
+codacy-analysis analyze --max-file-size 1MB --output-format sarif --output results.sarif
+codacy-analysis upload results.sarif
+```

docs/repositories-configure/codacy-configuration-file.md

@@ -72,12 +72,14 @@ To use a Codacy configuration file:
       - "**/tests/integration/**"
     ```
 
-1.  Optionally, validate the syntax of your configuration file with the [Codacy Analysis CLI](https://github.com/codacy/codacy-analysis-cli#install) by running the following command in the same folder as the Codacy configuration file:
+1.  Optionally, validate your configuration file with the [Codacy Analysis CLI](../codacy-analysis-cli/index.md) by running the following command in the same folder as the Codacy configuration file:
 
     ```bash
-    codacy-analysis-cli validate-configuration --directory `pwd`
+    codacy-analysis validate-configuration
     ```
 
+    The command lists every setting that doesn't follow the format above, and exits with a non-zero code if it finds any. It also warns about engine and language names it doesn't recognize.
+
 ## Ignoring files using a Codacy configuration file {: id="ignore-files"}
 
 The Codacy configuration file gives you more flexibility in [ignoring or excluding files](ignoring-files.md) from the Codacy analysis.

docs/repositories-configure/local-analysis/running-dartanalyzer.md

@@ -16,68 +16,93 @@ To run Dart Analyzer as a [client-side tool](client-side-tools.md):
     end="<!--instructions-end-->"
 %}
 
-## Important Concepts
+## Dart SDK and dependencies
 
-- **`.codacy/codacy.yaml`**: Configuration file to specify `dart`, or `flutter`, and `dartanalyzer` versions for the CLI.
+The [Codacy Analysis CLI](../../codacy-analysis-cli/index.md) runs `dart analyze` from a Dart SDK. It uses the SDK that Codacy manages for you, if you have installed it, and otherwise the `dart` command on your `PATH`:
 
-```yaml
-runtimes:
-    - [email protected]
-tools:
-    - [email protected]
-```
+-   **Codacy-managed SDK:** Add `--install-dependencies` to `analyze` and the CLI downloads the pinned Dart SDK, about 210 MB, into `~/.codacy/tools/dartanalyzer/`.
+-   **Your own SDK:** Install [Dart](https://dart.dev/get-dart), or Flutter, which bundles Dart, and make sure `dart` is on your `PATH`.
+
+Before analyzing, resolve your project's packages with `dart pub get`, or `flutter pub get` for a Flutter project. The CLI never runs it for you. Without the resolved packages, every `package:` import is unresolvable: the CLI warns and skips the checks that depend on them for that run.
 
-or 
+## Manual configuration
 
-```yaml
-runtimes:
-    - [email protected]
-tools:
-    - [email protected]
+Install the Codacy Analysis CLI and initialize the repository. Initialization writes `.codacy/codacy.config.json`, which `analyze` requires: pulling it from Codacy Cloud with `init --remote` means the local run uses the same Dart Analyzer patterns as your repository's **Code patterns** page.
+
+```bash
+npm i -g @codacy/analysis-cli
+codacy-analysis init --remote <gh|gl|bb> <ORGANIZATION> <REPOSITORY>
 ```
 
-## Manual configuration
+Then resolve your packages, run the analysis, and upload the results:
 
 ```bash
-codacy-cli install
-codacy-cli analyze -t dartanalyzer -o dartanalyzer.sarif
-codacy-cli upload -s dartanalyzer.sarif -c $COMMIT_SHA -t CODACY_PROJECT_TOKEN
+dart pub get
+codacy-analysis analyze --tool dartanalyzer --output-format sarif --output dartanalyzer.sarif
+codacy-analysis upload dartanalyzer.sarif --commit $COMMIT_SHA
 ```
 
- **If you're using an account API token**, you must also provide the flags `-p`, `-o`, and `-r`. You can obtain the values for these flags from the URL of your repository dashboard on Codacy:
+ **If you're using an account API token**, you must also provide the `--repository` flag with your provider, organization, and repository name. You can obtain these values from the URL of your repository dashboard on Codacy:
 
 ```bash
-codacy-cli install
-codacy-cli analyze -t dartanalyzer -o dartanalyzer.sarif
-codacy-cli analyze -t dartanalyzer -o dartanalyzer.sarif -c $COMMIT_SHA -a CODACY_API_TOKEN -p provider (gh|gl|bb) -o ORGANIZATION -r REPOSITORY
+dart pub get
+codacy-analysis analyze --tool dartanalyzer --output-format sarif --output dartanalyzer.sarif
+codacy-analysis upload dartanalyzer.sarif --commit $COMMIT_SHA --repository <gh|gl|bb> <ORGANIZATION> <REPOSITORY>
 ```
 
+!!! note
+    `--tool` matches against the tool IDs in your `.codacy/codacy.config.json`, and only tools listed there run. If `--tool dartanalyzer` doesn't match your setup, check that file for the ID it recorded.
+
 ## GitHub Action
 
+The [Codacy Analysis CLI GitHub Action](https://github.com/codacy/analysis-cli-action) runs the same `codacy-analysis` CLI as the manual configuration above. If your repository has no committed `.codacy/codacy.config.json`, the action fetches the repository's configuration from Codacy with your token.
+
+On `pull_request` events, the action uploads the results for the pull request's head commit. Check out that commit with `ref:` as in the examples below, otherwise line numbers can point at the wrong lines.
+
+The examples set up Dart and resolve the packages before running the action. For a Flutter project, use a Flutter setup action and `flutter pub get` instead.
 
 ### Using a project token
+
+{% raw %}
 ```yml
-- name: Run Codacy CLI
-  uses: codacy/codacy-cli-v2-action@main
+- uses: actions/checkout@v4
   with:
-    project-token: CODACY_PROJECT_TOKEN
+    ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+- uses: dart-lang/setup-dart@v1
+
+- run: dart pub get
+
+- name: Run Codacy Analysis CLI
+  uses: codacy/analysis-cli-action@v1
+  with:
+    project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
     tool: dartanalyzer
-    upload_report: true
+    upload: true
 ```
+{% endraw %}
 
 ### Using an account API token
 
+The action takes the provider, organization, and repository from the workflow. Set `provider`, `owner`, and `repository` only if the repository is on Codacy under different names.
+
+{% raw %}
 ```yml
-- name: Run Codacy CLI
-  uses: codacy/codacy-cli-v2-action@main
+- uses: actions/checkout@v4
   with:
-    api_token: CODACY_API_TOKEN
+    ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+- uses: dart-lang/setup-dart@v1
+
+- run: dart pub get
+
+- name: Run Codacy Analysis CLI
+  uses: codacy/analysis-cli-action@v1
+  with:
+    api-token: ${{ secrets.CODACY_API_TOKEN }}
     tool: dartanalyzer
-    upload_report: true
-    provider: gh
-    owner: codacy-acme
-    repository: sample-dart-project
+    upload: true
 ```
+{% endraw %}
 
 !!! warning "Tokens should be stored in the repository secrets."
-