sonarcloud #7480
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: sonarcloud | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - maintenance-v6 | |
| # workflow_run is triggered when sonarcloud-pr-build completes. | |
| # workflow_run always runs in the base repo context, so repository secrets | |
| # are available even for fork PRs. | |
| # Security note: this job checks out the PR head commit and runs the Maven | |
| # build, which means untrusted PR code executes with SONAR_TOKEN and | |
| # GITHUB_TOKEN present. The risk is accepted because both tokens have | |
| # minimal, read/write-constrained permissions (see the `permissions` block | |
| # below) and SonarCloud analysis is the explicit purpose of this workflow. | |
| workflow_run: | |
| workflows: ["sonarcloud-pr-build"] | |
| types: | |
| - completed | |
| jobs: | |
| build: | |
| name: sonarcloud | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read # required to download artifacts from the triggering workflow run | |
| contents: read # required to check out the repository | |
| statuses: write # required for SonarCloud to post commit status checks | |
| pull-requests: write # required for SonarCloud to post inline PR comments | |
| if: >- | |
| github.event_name == 'push' || | |
| github.event.workflow_run.conclusion == 'success' | |
| steps: | |
| - name: Download PR info | |
| if: github.event_name == 'workflow_run' | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: pr-info | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| run-id: ${{ github.event.workflow_run.id }} | |
| path: pr-info/ | |
| - name: Read PR info | |
| if: github.event_name == 'workflow_run' | |
| id: pr-info | |
| run: | | |
| echo "number=$(cat pr-info/pr-number.txt)" >> $GITHUB_OUTPUT | |
| echo "head-ref=$(cat pr-info/pr-head-ref.txt)" >> $GITHUB_OUTPUT | |
| echo "base-ref=$(cat pr-info/pr-base-ref.txt)" >> $GITHUB_OUTPUT | |
| echo "head-sha=$(cat pr-info/pr-head-sha.txt)" >> $GITHUB_OUTPUT | |
| - uses: actions/checkout@v2 | |
| if: github.event_name == 'push' | |
| with: | |
| fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis | |
| - uses: actions/checkout@v2 | |
| if: github.event_name == 'workflow_run' | |
| with: | |
| fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis | |
| ref: ${{ steps.pr-info.outputs.head-sha }} | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v1 | |
| with: | |
| java-version: 21 | |
| - name: Cache SonarCloud packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.sonar/cache | |
| key: ${{ runner.os }}-sonar | |
| restore-keys: ${{ runner.os }}-sonar | |
| - name: Cache Maven packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.m2 | |
| key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: ${{ runner.os }}-m2 | |
| - name: 'Create application.properties' | |
| run: | | |
| cp src/main/resources/application.properties.EXAMPLE src/main/resources/application.properties | |
| - name: 'Add host.testcontainers.internal to /etc/hosts' | |
| run: | | |
| echo "127.0.0.1 host.testcontainers.internal" | sudo tee -a /etc/hosts | |
| - name: Build, collect coverage and analyze (push) | |
| if: github.event_name == 'push' | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: mvn clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar | |
| - name: Build, collect coverage and analyze (pull request) | |
| if: github.event_name == 'workflow_run' | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ steps.pr-info.outputs.number }} | |
| PR_HEAD_REF: ${{ steps.pr-info.outputs.head-ref }} | |
| PR_BASE_REF: ${{ steps.pr-info.outputs.base-ref }} | |
| PR_HEAD_SHA: ${{ steps.pr-info.outputs.head-sha }} | |
| run: | | |
| mvn clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ | |
| -Dsonar.pullrequest.key="$PR_NUMBER" \ | |
| -Dsonar.pullrequest.branch="$PR_HEAD_REF" \ | |
| -Dsonar.pullrequest.base="$PR_BASE_REF" \ | |
| -Dsonar.scm.revision="$PR_HEAD_SHA" | |
| # TODO: decide if we want to keep this in the future, or remove it entirely | |
| # - name: 'Run integration tests' | |
| # run: | | |
| # mvn verify -Pintegration-test | |
| # - name: 'Run e2e tests' | |
| # run: | | |
| # mvn verify -Pe2e-test |