From b438cfa1bd19be07d375215418917b2a12b11c0c Mon Sep 17 00:00:00 2001
From: Nathan Reynolds <yibble@yibble.org>
Date: Tue, 18 Apr 2023 14:17:25 +0530
Subject: [PATCH] Include SONAR_ROOT_CERT option custom TRA certificates (#39)

---
 README.md                    | 2 ++
 script/check-quality-gate.sh | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/README.md b/README.md
index 450e89b..58a5a51 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,8 @@ Example usage:
 
 - `SONAR_HOST_URL` – **Optional** this tells the scanner where SonarQube is hosted, otherwise it will get the one from the scan report. You can set the `SONAR_HOST_URL` environment variable in the "Secrets" settings page of your repository, or you can add them at the level of your GitHub organization (recommended).
 
+- `SONAR_ROOT_CERT` – Holds an additional root certificate (in PEM format) that is used to validate the SonarQube server certificate. You can set the `SONAR_ROOT_CERT` environment variable in the "Secrets" settings page of your repository, or you can add them at the level of your GitHub organization (recommended).
+
 ## Quality Gate check run
 
 <img src="./images/QualityGate-check-screen.png">
diff --git a/script/check-quality-gate.sh b/script/check-quality-gate.sh
index bea66f2..3eafce8 100755
--- a/script/check-quality-gate.sh
+++ b/script/check-quality-gate.sh
@@ -27,6 +27,13 @@ if [ -z "${serverUrl}" ] || [ -z "${ceTaskUrl}" ]; then
   exit 1
 fi
 
+if [[ -n "${SONAR_ROOT_CERT}" ]]; then
+  echo "Adding custom root certificate to ~/.curlrc"
+  rm -f /tmp/tmpcert.pem
+  echo "${SONAR_ROOT_CERT}" > /tmp/tmpcert.pem
+  echo "--cacert /tmp/tmpcert.pem" >> ~/.curlrc
+fi
+
 task="$(curl --location --location-trusted --max-redirs 10  --silent --fail --show-error --user "${SONAR_TOKEN}": "${ceTaskUrl}")"
 status="$(jq -r '.task.status' <<< "$task")"