From 95b1cc6c02a15c8ecc00c07b1c2a75ed61a14055 Mon Sep 17 00:00:00 2001 From: Stanislav Date: Thu, 16 Oct 2025 16:02:11 +0200 Subject: [PATCH] SC-32488 Add sq analysis (#67) * SC-32488 Add sq analysis * SC-32488 Fix analysis issues --- .github/workflows/ci.yml | 22 ++++++++ .github/workflows/sonar-scan.yml | 46 +++++++++++++++ .github/workflows/unified-dogfooding.yml | 56 +++++++++++++++++++ .../workflows/{run-qa.yml => unit-tests.yml} | 14 ++--- .gitignore | 2 +- .sonarlint/connectedMode.json | 4 ++ README.md | 2 +- script/check-quality-gate.sh | 2 +- 8 files changed, 137 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/sonar-scan.yml create mode 100644 .github/workflows/unified-dogfooding.yml rename .github/workflows/{run-qa.yml => unit-tests.yml} (69%) create mode 100644 .sonarlint/connectedMode.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..414332c --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,22 @@ +name: CI +on: + push: + branches: + - master + pull_request: + types: [opened, synchronize, reopened] + workflow_call: + +jobs: + run-unit-tests: + uses: ./.github/workflows/unit-tests.yml + run-sqc-eu-analysis: + needs: run-unit-tests + uses: ./.github/workflows/sonar-scan.yml + with: + platform_name: "SQC-EU" + host_url: "https://sonarcloud.io" + vault_path: "development/kv/data/sonarcloud" + permissions: + id-token: write + contents: read diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml new file mode 100644 index 0000000..1661c15 --- /dev/null +++ b/.github/workflows/sonar-scan.yml @@ -0,0 +1,46 @@ +name: SonarQube Scan +on: + workflow_call: + inputs: + platform_name: + description: 'Platform name (e.g., Next, SQC-EU, SQC-US)' + required: true + type: string + host_url: + description: 'SonarQube Server/Cloud host URL' + required: true + type: string + vault_path: + description: 'Vault path to retrieve the Sonar token' + required: true + type: string + +jobs: + sonar-scan: + name: Run ${{ inputs.platform_name }} Analysis + runs-on: github-ubuntu-latest-s + permissions: + id-token: write + contents: read + steps: + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + fetch-depth: 0 + - name: Vault + id: secrets + uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # 3.1.0 + with: + secrets: | + ${{ inputs.vault_path }} token | SONAR_TOKEN; + - name: Run SonarQube Analysis + uses: SonarSource/sonarqube-scan-action@master + env: + SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} + SONAR_HOST_URL: ${{ inputs.host_url }} + with: + args: > + -Dsonar.projectKey=SonarSource_sonarqube-quality-gate-action + -Dsonar.organization=sonarsource + -Dsonar.sources=script + -Dsonar.sourceEncoding=UTF-8 + -Dsonar.sca.enabled=false diff --git a/.github/workflows/unified-dogfooding.yml b/.github/workflows/unified-dogfooding.yml new file mode 100644 index 0000000..5bd3793 --- /dev/null +++ b/.github/workflows/unified-dogfooding.yml @@ -0,0 +1,56 @@ +name: Unified Dogfooding scans +on: + schedule: + - cron: '0 4 * * 1' # Run weekly on Monday at 04:00 UTC + workflow_dispatch: + +jobs: + run-ci: + name: CI + uses: ./.github/workflows/ci.yml + permissions: + id-token: write + contents: read + + run-next-analysis: + name: Next Scan + needs: run-ci + uses: ./.github/workflows/sonar-scan.yml + with: + platform_name: "Next" + host_url: "https://next.sonarqube.com/sonarqube" + vault_path: "development/kv/data/next" + permissions: + id-token: write + contents: read + + run-sqc-us-analysis: + name: SQC US Scan + needs: run-ci + uses: ./.github/workflows/sonar-scan.yml + with: + platform_name: "SQC-US" + host_url: "https://sonarqube.us" + vault_path: "development/kv/data/sonarqube-us" + permissions: + id-token: write + contents: read + + run-iris: + name: IRIS + needs: [run-ci, run-next-analysis, run-sqc-us-analysis] + runs-on: github-ubuntu-latest-s + permissions: + id-token: write + contents: read + steps: + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - name: Run IRIS Analysis + uses: SonarSource/unified-dogfooding-actions/run-iris@v1 + with: + primary_project_key: SonarSource_sonarqube-quality-gate-action + primary_platform: "SQC-EU" + shadow1_project_key: SonarSource_sonarqube-quality-gate-action + shadow1_platform: "Next" + shadow2_project_key: SonarSource_sonarqube-quality-gate-action + shadow2_platform: "SQC-US" diff --git a/.github/workflows/run-qa.yml b/.github/workflows/unit-tests.yml similarity index 69% rename from .github/workflows/run-qa.yml rename to .github/workflows/unit-tests.yml index b90c791..8493663 100644 --- a/.github/workflows/run-qa.yml +++ b/.github/workflows/unit-tests.yml @@ -1,21 +1,19 @@ -name: QA +name: Unit Tests on: - push: - branches: - - master - pull_request: - types: [opened, synchronize, reopened] + workflow_call: + jobs: run-unit-tests: + name: Run Unit Tests runs-on: github-ubuntu-latest-s steps: - name: checkout action - uses: actions/checkout@v2 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: path: main fetch-depth: 0 - name: checkout bats-core - uses: actions/checkout@v2 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: path: bats-core repository: bats-core/bats-core diff --git a/.gitignore b/.gitignore index ed2304e..204755a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ .idea .DS_Store - +.vscode \ No newline at end of file diff --git a/.sonarlint/connectedMode.json b/.sonarlint/connectedMode.json new file mode 100644 index 0000000..8379949 --- /dev/null +++ b/.sonarlint/connectedMode.json @@ -0,0 +1,4 @@ +{ + "sonarQubeUri": "https://next.sonarqube.com/sonarqube", + "projectKey": "SonarSource_sonarqube-quality-gate-action" +} \ No newline at end of file diff --git a/README.md b/README.md index 8235922..af88d1b 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# SonarQube Quality Gate check [![QA](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/run-qa.yml/badge.svg)](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/run-qa.yml) +# SonarQube Quality Gate check [![CI](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/ci.yml/badge.svg)](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/ci.yml) Check the Quality Gate of your code with [SonarQube Server](https://www.sonarsource.com/products/sonarqube/) or [SonarQube Community Build](https://www.sonarsource.com/open-source-editions/sonarqube-community-edition/) to ensure your code meets your own quality standards before you release or deploy new features. diff --git a/script/check-quality-gate.sh b/script/check-quality-gate.sh index 5ae8c9b..5c51963 100755 --- a/script/check-quality-gate.sh +++ b/script/check-quality-gate.sh @@ -29,7 +29,7 @@ else ceTaskUrl="$(sed -n 's/ceTaskUrl=\(.*\)/\1/p' "${metadataFile}")" fi -if [ -z "${serverUrl}" ] || [ -z "${ceTaskUrl}" ]; then +if [[ -z "${serverUrl}" || -z "${ceTaskUrl}" ]]; then echo "Invalid report metadata file." exit 1 fi