From b28b50f4c81692a6b6e9ee07acb6ed6277b50492 Mon Sep 17 00:00:00 2001 From: Jacek Date: Fri, 21 May 2021 14:34:28 +0200 Subject: [PATCH] Readme fixes --- README.md | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index e6af748..97c0cbb 100644 --- a/README.md +++ b/README.md @@ -8,11 +8,13 @@ SonarQube is the leading product for Continuous Code Quality & Code Security. It ## Requirements -Repository with SonarQube analysis results. +A previous step must have run an analysis on your code. + +Read more information on how to analyze your code [here](https://docs.sonarqube.org/latest/analysis/github-integration/) ## Usage -The workflow, usually declared in `.github/workflows/build.yml`, should look like this: +The workflow YAML file will usually look something like this:: ```yaml on: @@ -46,31 +48,36 @@ jobs: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} ``` +In case you are using Maven or Gradle scanner in your repository, you should alter the location of the report metadata file by using the optional `scanMetadataReportFile` input. -You can change the location of the report metadata file by using the optional `scanMetadataReportFile` input: +Typically, report metadata file will be located in: +- `target/sonar/report-task.txt` for Maven projects +- `build/sonar/report-task.txt` for Gradle projects +Example usage: ```yaml uses: sonarsource/sonarqube-quality-gate-action@master with: scanMetadataReportFile: target/sonar/report-task.txt ``` +Make sure to set up `timeout-minutes` property in your step, to avoid wasting action minutes per month. + ### Environment variables -- `SONAR_TOKEN` – **Required** – this token is used to authenticate access to SonarQube. You can read more about security tokens [here](https://docs.sonarqube.org/latest/user-guide/user-token/). You need to set the `SONAR_TOKEN` environment variable in the "Secrets" settings page of your repository. +- `SONAR_TOKEN` – **Required** this is the token used to authenticate access to SonarQube. You can read more about security tokens [here](https://docs.sonarqube.org/latest/user-guide/user-token/). You can set the `SONAR_TOKEN` environment variable in the "Secrets" settings page of your repository, or you can add them at the level of your GitHub organization (recommended). ## Quality Gate check run -## Do not use this GitHub action if you are in the following situations +## Limitations -* You want to analyze a .NET solution. Read the documentation about our [Scanner for .NET](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner-for-msbuild/). -* You want to analyze C/C++ code. Read the documentation on [analyzing C/C++ code](https://docs.sonarqube.org/latest/analysis/languages/cfamily/). +This action is not intended to be used with .NET or C/C++ scanner analysis results. ## Have questions or feedback? -To provide feedback (request a feature or report a bug), please post on the [SonarSource Community Forum](https://community.sonarsource.com/) with the tag `sonarqube`. +To provide feedback (requesting a feature or reporting a bug) please post on the [SonarSource Community Forum](https://community.sonarsource.com/tags/c/help/sq/github-actions). ## License