engineering/.github/workflows/sonar.yml at 250f84393eacc3215c78f7fd2ea8e14f080e4293 · seantrane/engineering · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
---
name: SonarSource, SonarCloud, SonarQube
# https://github.com/SonarSource/sonarcloud-github-action
# https://github.com/SonarSource/sonarqube-scan-action
# https://github.com/SonarSource/sonarqube-quality-gate-action

on:
  workflow_call:
    inputs:
      SONAR_HOST_URL:
        description: Specify the Sonar Host URL.
        type: string
        default: 'https://sonarcloud.io'
      SONAR_QUALITY_GATE_CHECK:
        description: Use Sonar Quality Gate in Status Checks?
        type: boolean
        default: false
      projectBaseDir:
        description: Directory in which to run Sonar Scanner.
        type: string
        default: ${{ $GITHUB_WORKSPACE }}
    secrets:
      # If SonarQube uses self-signed certificate, pass a root certificate (in PEM format).
      SONAR_ROOT_CERT: ''
      SONAR_TOKEN:
        required: true

permissions:
  contents: read
  statuses: write
  pull-requests: write

jobs:
  sonar:
    name: SonarSource
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Shallow clones should be disabled for a better relevancy of analysis
          fetch-depth: 0

      - name: SonarCloud Scan
        if: ${{ inputs.SONAR_HOST_URL == '' }}
        uses: SonarSource/sonarcloud-github-action@master
        with:
          projectBaseDir: ${{ inputs.projectBaseDir }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # SonarCloud access token should be generated from https://sonarcloud.io/account/security/
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: SonarQube Scan
        if: ${{ inputs.SONAR_HOST_URL != '' }}
        uses: sonarsource/sonarqube-scan-action@master
        with:
          projectBaseDir: ${{ inputs.projectBaseDir }}
        env:
          # SonarQube access token should be generated from https://sonarcloud.io/account/security/
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ inputs.SONAR_HOST_URL }}
          # SONAR_ROOT_CERT: ${{ secrets.SONAR_ROOT_CERT }}

      # Check the Quality Gate status.
      - name: SonarQube Quality Gate check
        id: sonarqube-quality-gate-check
        if: ${{ inputs.SONAR_HOST_URL != '' && inputs.SONAR_QUALITY_GATE_CHECK == true }}
        uses: sonarsource/sonarqube-quality-gate-action@master
        # Force to fail step after specific time.
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ inputs.SONAR_HOST_URL }}
          # SONAR_ROOT_CERT: ${{ secrets.SONAR_ROOT_CERT }}

      # Optionally you can use the output from the Quality Gate in another step.
      # The possible outputs of the `quality-gate-status` variable are `PASSED`, `WARN` or `FAILED`.
      - name: SonarQube Quality Gate Status
        if: ${{ inputs.SONAR_HOST_URL != '' && inputs.SONAR_QUALITY_GATE_CHECK == true }}
        run: echo "The Quality Gate status is ${{ steps.sonarqube-quality-gate-check.outputs.quality-gate-status }}"