The instructions should say to install the codacy github app, which then prompts for permissions, grant perms to one repo, then return to codacy and add the repo. There is then an optional step around configuring rulesets while it performs analysis but this can be ignored.
Weirdly some people had differing numbers of violations despite analysing the same code.