SQQGGHA-12: surface SonarQube error message on background task … (#71)

* feat(SQQGGHA-12): surface SonarQube error message on background task failure

Report the analysis error message when the background task status is not SUCCESS, instead of only failing at the quality gate lookup step.

* fix: surface CANCELED SonarQube task status with clear message

Co-authored-by: Amaury Wyart <285676107+amaurywyart-sq@users.noreply.github.com>

* fix: use octal ANSI escape codes for bash 3.2 compatibility

\e is not interpreted by echo -e on bash 3.2 (e.g. macOS/self-hosted
runners), which printed raw escape sequences instead of colored output.
\033 works on both bash 3.2 and modern bash.

---------

Co-authored-by: Gitar <noreply@gitar.ai>
Co-authored-by: Amaury Wyart <285676107+amaurywyart-sq@users.noreply.github.com>

.github/workflows/PullRequestClosed.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   PullRequestMerged_job:
     name: Pull Request Merged
-    runs-on: ubuntu-latest
+    runs-on: github-ubuntu-latest-s
     permissions:
       id-token: write
       pull-requests: read

.github/workflows/PullRequestCreated.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   PullRequestCreated_job:
     name: Pull Request Created
-    runs-on: ubuntu-latest
+    runs-on: github-ubuntu-latest-s
     permissions:
       id-token: write
     # For external PR, ticket should be created manually

.github/workflows/RequestReview.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   RequestReview_job:
     name: Request review
-    runs-on: ubuntu-latest
+    runs-on: github-ubuntu-latest-s
     permissions:
       id-token: write
     # For external PR, ticket should be moved manually

.github/workflows/SubmitReview.yml

@@ -7,10 +7,9 @@ on:
 jobs:
   SubmitReview_job:
     name: Submit Review
-    runs-on: ubuntu-latest
+    runs-on: github-ubuntu-latest-s
     permissions:
       id-token: write
-      pull-requests: read
     # For external PR, ticket should be moved manually
     if: |
         github.event.pull_request.head.repo.full_name == github.repository
@@ -21,10 +20,11 @@ jobs:
         uses: SonarSource/vault-action-wrapper@v3
         with:
           secrets: |
+            development/github/token/{REPO_OWNER_NAME_DASH}-jira token | GITHUB_TOKEN;
             development/kv/data/jira user | JIRA_USER;
             development/kv/data/jira token | JIRA_TOKEN;
       - uses: sonarsource/gh-action-lt-backlog/SubmitReview@v2
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
           jira-user: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_USER }}
           jira-token: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}

.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: CI
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_call:
+
+jobs:
+  run-unit-tests:
+    uses: ./.github/workflows/unit-tests.yml
+  run-sqc-eu-analysis:
+    needs: run-unit-tests
+    uses: ./.github/workflows/sonar-scan.yml
+    with:
+      platform_name: "SQC-EU"
+      host_url: "https://sonarcloud.io"
+      vault_path: "development/kv/data/sonarcloud"
+    permissions:
+      id-token: write
+      contents: read

.github/workflows/sonar-scan.yml

@@ -0,0 +1,46 @@
+name: SonarQube Scan
+on:
+  workflow_call:
+    inputs:
+      platform_name:
+        description: 'Platform name (e.g., Next, SQC-EU, SQC-US)'
+        required: true
+        type: string
+      host_url:
+        description: 'SonarQube Server/Cloud host URL'
+        required: true
+        type: string
+      vault_path:
+        description: 'Vault path to retrieve the Sonar token'
+        required: true
+        type: string
+
+jobs:
+  sonar-scan:
+    name: Run ${{ inputs.platform_name }} Analysis
+    runs-on: github-ubuntu-latest-s
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+      - name: Vault
+        id: secrets
+        uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # 3.1.0
+        with:
+          secrets: |
+            ${{ inputs.vault_path }} token | SONAR_TOKEN;
+      - name: Run SonarQube Analysis
+        uses: SonarSource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ inputs.host_url }}
+        with:
+          args: >
+            -Dsonar.projectKey=SonarSource_sonarqube-quality-gate-action
+            -Dsonar.organization=sonarsource
+            -Dsonar.sources=script
+            -Dsonar.sourceEncoding=UTF-8
+            -Dsonar.sca.enabled=false

.github/workflows/unified-dogfooding.yml

@@ -0,0 +1,56 @@
+name: Unified Dogfooding scans
+on:
+  schedule:
+    - cron: '0 4 * * 1' # Run weekly on Monday at 04:00 UTC
+  workflow_dispatch:
+
+jobs:
+  run-ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      id-token: write
+      contents: read
+
+  run-next-analysis:
+    name: Next Scan
+    needs: run-ci
+    uses: ./.github/workflows/sonar-scan.yml
+    with:
+      platform_name: "Next"
+      host_url: "https://next.sonarqube.com/sonarqube"
+      vault_path: "development/kv/data/next"
+    permissions:
+      id-token: write
+      contents: read
+
+  run-sqc-us-analysis:
+    name: SQC US Scan
+    needs: run-ci
+    uses: ./.github/workflows/sonar-scan.yml
+    with:
+      platform_name: "SQC-US"
+      host_url: "https://sonarqube.us"
+      vault_path: "development/kv/data/sonarqube-us"
+    permissions:
+      id-token: write
+      contents: read
+
+  run-iris:
+    name: IRIS
+    needs: [run-ci, run-next-analysis, run-sqc-us-analysis]
+    runs-on: github-ubuntu-latest-s
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Run IRIS Analysis
+        uses: SonarSource/unified-dogfooding-actions/run-iris@v1
+        with:
+          primary_project_key: SonarSource_sonarqube-quality-gate-action
+          primary_platform: "SQC-EU"
+          shadow1_project_key: SonarSource_sonarqube-quality-gate-action
+          shadow1_platform: "Next"
+          shadow2_project_key: SonarSource_sonarqube-quality-gate-action
+          shadow2_platform: "SQC-US"

.github/workflows/unit-tests.yml

@@ -1,21 +1,19 @@
-name: QA
+name: Unit Tests
 on:
-  push:
-    branches:
-      - master
-  pull_request:
-    types: [opened, synchronize, reopened]
+  workflow_call:
+
 jobs:
   run-unit-tests:
-    runs-on: ubuntu-latest
+    name: Run Unit Tests
+    runs-on: github-ubuntu-latest-s
     steps:
       - name: checkout action
-        uses: actions/checkout@v2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: main
           fetch-depth: 0
       - name: checkout bats-core
-        uses: actions/checkout@v2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: bats-core
           repository: bats-core/bats-core

.gitignore

@@ -1,3 +1,3 @@
 .idea
 .DS_Store
-
+.vscode

.pre-commit-config.yaml

@@ -0,0 +1,6 @@
+repos:
+-   repo: https://github.com/SonarSource/sonar-secrets-pre-commit
+    rev: v2.32.0.9670
+    hooks:
+    -   id: sonar-secrets
+        stages: [pre-commit]

.sonarlint/connectedMode.json

@@ -0,0 +1,4 @@
+{
+    "sonarQubeUri": "https://next.sonarqube.com/sonarqube",
+    "projectKey": "SonarSource_sonarqube-quality-gate-action"
+}

README.md

@@ -1,4 +1,4 @@
-# SonarQube Quality Gate check [![QA](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/run-qa.yml/badge.svg)](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/run-qa.yml)
+# SonarQube Quality Gate check [![CI](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/ci.yml/badge.svg)](https://github.com/SonarSource/sonarqube-quality-gate-action/actions/workflows/ci.yml)
 
 Check the Quality Gate of your code with [SonarQube Server](https://www.sonarsource.com/products/sonarqube/) or [SonarQube Community Build](https://www.sonarsource.com/open-source-editions/sonarqube-community-edition/) to ensure your code meets your own quality standards before you release or deploy new features.
 

script/check-quality-gate.sh

@@ -29,7 +29,7 @@ else
    ceTaskUrl="$(sed -n 's/ceTaskUrl=\(.*\)/\1/p' "${metadataFile}")"
 fi
 
-if [ -z "${serverUrl}" ] || [ -z "${ceTaskUrl}" ]; then
+if [[ -z "${serverUrl}" || -z "${ceTaskUrl}" ]]; then
   echo "Invalid report metadata file."
   exit 1
 fi
@@ -59,6 +59,15 @@ if [[ ${status} == "PENDING" || ${status} == "IN_PROGRESS" ]] && [[ ${SECONDS} -
     exit 1
 fi
 
+if [[ ${status} == "CANCELED" ]]; then
+    fail "The SonarQube background task was CANCELED."
+fi
+
+if [[ ${status} == "FAILED" ]]; then
+    errorMessage="$(jq -r '.task.errorMessage // "No error message provided."' <<< "${task}")"
+    fail "The SonarQube background task ${status}.${reset}\n\n${errorMessage}"
+fi
+
 analysisId="$(jq -r '.task.analysisId' <<< "${task}")"
 qualityGateUrl="${serverUrl}/api/qualitygates/project_status?analysisId=${analysisId}"
 qualityGateStatus="$(curl --location --location-trusted --max-redirs 10 --silent --fail --show-error --user "${SONAR_TOKEN}": "${qualityGateUrl}" | jq -r '.projectStatus.status')"

script/common.sh

@@ -4,12 +4,12 @@
 set -e
 set -o pipefail
 
-gray="\\e[37m"
-blue="\\e[36m"
-red="\\e[31m"
-yellow="\\e[33m"
-green="\\e[32m"
-reset="\\e[0m"
+gray="\\033[37m"
+blue="\\033[36m"
+red="\\033[31m"
+yellow="\\033[33m"
+green="\\033[32m"
+reset="\\033[0m"
 
 info() { echo -e "${blue}INFO: $*${reset}"; }
 error() { echo -e "${red}ERROR: $*${reset}"; }

test/check-quality-gate-test.bats

@@ -105,6 +105,43 @@ teardown() {
   [[ "$output" = *"Quality Gate not set for the project. Please configure the Quality Gate in SonarQube or remove sonarqube-quality-gate action from the workflow."* ]]
 }
 
+@test "fail when Sonar background task failed with an error message" {
+  export SONAR_TOKEN="test"
+  echo "serverUrl=http://localhost:9000" >> metadata_tmp
+  echo "ceTaskUrl=http://localhost:9000/api/ce/task?id=AXlCe3jz9LkwR9Gs0pBY" >> metadata_tmp
+
+  #mock curl
+  function curl() {
+     echo '{"task":{"status":"FAILED","errorMessage":"Fact of life: analysis cannot be processed"}}'
+  }
+  export -f curl
+
+  run script/check-quality-gate.sh metadata_tmp 300
+
+  [ "$status" -eq 1 ]
+  [[ "$output" = *"The SonarQube background task FAILED."* ]]
+  [[ "$output" = *"Fact of life: analysis cannot be processed"* ]]
+}
+
+@test "fail when Sonar background task canceled" {
+  export SONAR_TOKEN="test"
+  echo "serverUrl=http://localhost:9000" >> metadata_tmp
+  echo "ceTaskUrl=http://localhost:9000/api/ce/task?id=AXlCe3jz9LkwR9Gs0pBY" >> metadata_tmp
+
+  #mock curl
+  function curl() {
+     echo '{"task":{"status":"CANCELED","errorMessage":"Analysis was canceled"}}'
+  }
+  export -f curl
+
+  run script/check-quality-gate.sh metadata_tmp 300
+
+  [ "$status" -eq 1 ]
+  [[ "$output" = *"The SonarQube background task was CANCELED."* ]]
+  [[ "$output" != *"Analysis was canceled"* ]]
+  [[ "$output" != *"No error message provided."* ]]
+}
+
 @test "fail when polling timeout is reached" {
   export SONAR_TOKEN="test"
   echo "serverUrl=http://localhost:9000" >> metadata_tmp