porch/.github/workflows/sonarcloud.yml at main · kptdev/porch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: SonarCloud analysis

on:
  workflow_run:
    workflows: [CI test report]
    types: [completed]

jobs:
  check-artifacts:
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'
    permissions:
      actions: read
    outputs:
      has-artifacts: ${{ steps.check.outputs.has-artifacts }}
    steps:
      - name: Check for coverage artifact
        id: check
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: ${{ github.event.workflow_run.id }}
            });
            const hasCoverage = artifacts.data.artifacts.some(a => a.name === 'coverage-report');
            core.setOutput('has-artifacts', hasCoverage);

  sonarqube:
    needs: check-artifacts
    if: needs.check-artifacts.outputs.has-artifacts == 'true'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      pull-requests: read
    steps:
      - name: Download PR number artifact
        if: github.event.workflow_run.event == 'pull_request'
        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          workflow: CI test report
          run_id: ${{ github.event.workflow_run.id }}
          name: PR_NUMBER

      - name: Read PR_NUMBER.txt
        if: github.event.workflow_run.event == 'pull_request'
        id: pr_number
        uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1.1.8
        with:
          path: ./PR_NUMBER.txt

      - name: Request GitHub API for PR data
        if: github.event.workflow_run.event == 'pull_request'
        uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
        id: get_pr_data
        with:
          route: GET /repos/{full_name}/pulls/{number}
          number: ${{ steps.pr_number.outputs.content }}
          full_name: ${{ github.event.repository.full_name }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract PR metadata
        if: github.event.workflow_run.event == 'pull_request'
        id: pr_meta
        env:
          PR_DATA: ${{ steps.get_pr_data.outputs.data }}
        run: |
          echo "number=$(echo "$PR_DATA" | jq -r '.number')" >> "$GITHUB_OUTPUT"
          echo "head_ref=$(echo "$PR_DATA" | jq -r '.head.ref')" >> "$GITHUB_OUTPUT"
          echo "base_ref=$(echo "$PR_DATA" | jq -r '.base.ref')" >> "$GITHUB_OUTPUT"

      # Use SHA for checkout — immune to branch-name injection.
      # allow-unsafe-pr-checkout is safe here: we only scan (no script execution
      # from fork code) and persist-credentials is false.
      - name: Checkout PR head
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: ${{ github.event.workflow_run.head_repository.full_name }}
          ref: ${{ github.event.workflow_run.head_sha }}
          fetch-depth: 0
          persist-credentials: false
          allow-unsafe-pr-checkout: true

      # Branch names passed via env (not expression interpolation in run:)
      - name: Checkout base branch
        if: github.event.workflow_run.event == 'pull_request'
        env:
          BASE_REF: ${{ steps.pr_meta.outputs.base_ref }}
          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          CLONE_URL: ${{ github.event.repository.clone_url }}
        run: |
          git remote add upstream "$CLONE_URL"
          git fetch upstream
          git checkout -B "$BASE_REF" "upstream/$BASE_REF"
          git checkout "$HEAD_SHA"
          git clean -ffdx && git reset --hard HEAD

      - name: Download coverage artifact
        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          workflow: CI test report
          run_id: ${{ github.event.workflow_run.id }}
          name: coverage-report
          use_unzip: true

      - name: Fix Go module paths in coverage
        run: |
          sed -i 's|github.com/kptdev/porch|.|g' coverage.out

      - name: SonarQube Scan on PR
        if: github.event.workflow_run.event == 'pull_request'
        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args:
            -Dsonar.projectKey=kptdev_porch
            -Dsonar.organization=kptdev
            -Dproject.settings=sonar-project.properties
            -Dsonar.pullrequest.key=${{ steps.pr_meta.outputs.number }}
            -Dsonar.pullrequest.branch=${{ steps.pr_meta.outputs.head_ref }}
            -Dsonar.pullrequest.base=${{ steps.pr_meta.outputs.base_ref }}

      - name: SonarCloud Scan on push
        if: >-
          github.event.workflow_run.event == 'push' &&
          github.event.workflow_run.head_repository.full_name == github.event.repository.full_name
        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args:
            -Dsonar.projectKey=kptdev_porch
            -Dsonar.organization=kptdev
            -Dproject.settings=sonar-project.properties