Configure SonarQube analysis in CI - #9
Closed
trly wants to merge 1 commit into
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Configures SonarQube static analysis for this project, based on the setup in deprecated-java-api-demo-1.
Gradle projects get the
org.sonarqubeplugin and asonarconfiguration block; Maven projects get thesonar-maven-pluginand Sonar project properties inpom.xmlplus a dedicated analysis workflow on JDK 17. Repositories that already had part of this setup only receive the difference.Projects imported through the SonarQube GitHub App are assigned a generated project key of the form
<org>_<repo>_<uuid>, which cannot be derived from GitHub context. A shared helper,.github/scripts/resolve-sonar-project-key.sh, therefore looks the key up through the SonarQube API at analysis time and passes it to the scanner. If no bound project is found the scan is skipped rather than allowed to auto-create a second, unbound project.Analysis runs as its own step marked
continue-on-error, so an unsuccessful or unconfigured scan never fails the build. Analysis requires theSONAR_HOST_URL(including thehttps://scheme) andSONAR_TOKENsecrets; without them the step logs the reason and exits cleanly.Created by Sourcegraph agentic batch change.