diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml
new file mode 100644
index 000000000..415a92aa9
--- /dev/null
+++ b/.github/workflows/codacy.yml
@@ -0,0 +1,35 @@
+name: Codacy Analysis CLI
+
+on: ["push"]
+
+jobs:
+  codacy-analysis-cli:
+    name: Codacy Analysis CLI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@main
+
+      # coursier cache action caches both coursier and sbt caches
+      - name: coursier-cache-action
+        uses: coursier/cache-action@v5
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'temurin'
+          java-version: 17
+
+      - name: Compile
+        id: sbt-compile
+        run: sbt compile
+
+      - name: Run Codacy Analysis CLI
+        uses: codacy/codacy-analysis-cli-action@master
+        with:
+          tool: spotbugs
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          # or
+          # api-token: ${{ secrets.CODACY_API_TOKEN }}
+          upload: true
+          max-allowed-issues: 2147483647
diff --git a/.gitignore b/.gitignore
index 45fc88d66..5500be56c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -100,3 +100,4 @@ codegen_java_old/*
 
 # Ignore generated credentials from google-github-actions/auth
 gha-creds-*.json
+.vscode/settings.json