Skip to content

Commit 5874545

Browse files
lreimerlreimer
committed
Updated Sonar Cloud analysis.
1 parent 33a1347 commit 5874545

File tree

3 files changed

+57
-103
lines changed

3 files changed

+57
-103
lines changed

‎.github/workflows/gradle.yml

+26-42
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,34 @@
1-
# This workflow uses actions that are not certified by GitHub.
2-
3-
name: Java CI with Gradle
4-
1+
name: Gradle Build
52
on:
63
push:
7-
branches: [ "main" ]
4+
branches:
5+
- main
86
pull_request:
97
types: [opened, synchronize, reopened]
10-
branches: [ "main" ]
11-
12-
permissions:
13-
contents: read
14-
158
jobs:
169
build:
17-
10+
name: Build and analyze
1811
runs-on: ubuntu-latest
19-
2012
steps:
21-
- uses: actions/checkout@v3
22-
- name: Set up JDK 17
23-
uses: actions/setup-java@v3
24-
with:
25-
java-version: '17'
26-
distribution: 'temurin'
27-
28-
- name: Cache SonarCloud packages
29-
uses: actions/cache@v1
30-
with:
31-
path: ~/.sonar/cache
32-
key: ${{ runner.os }}-sonar
33-
restore-keys: ${{ runner.os }}-sonar
34-
- name: Cache Gradle packages
35-
uses: actions/cache@v1
36-
with:
37-
path: ~/.gradle/caches
38-
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
39-
restore-keys: ${{ runner.os }}-gradle
40-
41-
- name: Build with Gradle
42-
uses: gradle/gradle-build-action@67421db6bd0bf253fb4bd25b31ebb98943c375e1
43-
with:
44-
arguments: build
45-
46-
- name: Build and analyze
47-
env:
48-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
49-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
50-
run: ./gradlew build jacocoTestReport sonarqube --info
13+
- uses: actions/checkout@v4
14+
with:
15+
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
16+
- name: Set up JDK 17
17+
uses: actions/setup-java@v4
18+
with:
19+
java-version: 17
20+
distribution: 'temurin' # Alternative distribution options are available
21+
- name: Cache SonarQube packages
22+
uses: actions/cache@v4
23+
with:
24+
path: ~/.sonar/cache
25+
key: ${{ runner.os }}-sonar
26+
restore-keys: ${{ runner.os }}-sonar
27+
- name: Cache Gradle packages
28+
uses: actions/cache@v4
29+
with:
30+
path: ~/.gradle/caches
31+
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
32+
restore-keys: ${{ runner.os }}-gradle
33+
- name: Build
34+
run: ./gradlew build --info

‎.github/workflows/sonarcloud.yaml

+29-59
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,36 @@
1-
# This workflow uses actions that are not certified by GitHub.
2-
# They are provided by a third-party and are governed by
3-
# separate terms of service, privacy policy, and support
4-
# documentation.
5-
6-
# This workflow helps you trigger a SonarCloud analysis of your code and populates
7-
# GitHub Code Scanning alerts with the vulnerabilities found.
8-
# Free for open source project.
9-
10-
# 1. Login to SonarCloud.io using your GitHub account
11-
12-
# 2. Import your project on SonarCloud
13-
# * Add your GitHub organization first, then add your repository as a new project.
14-
# * Please note that many languages are eligible for automatic analysis,
15-
# which means that the analysis will start automatically without the need to set up GitHub Actions.
16-
# * This behavior can be changed in Administration > Analysis Method.
17-
#
18-
# 3. Follow the SonarCloud in-product tutorial
19-
# * a. Copy/paste the Project Key and the Organization Key into the args parameter below
20-
# (You'll find this information in SonarCloud. Click on "Information" at the bottom left)
21-
#
22-
# * b. Generate a new token and add it to your Github repository's secrets using the name SONAR_TOKEN
23-
# (On SonarCloud, click on your avatar on top-right > My account > Security
24-
# or go directly to https://sonarcloud.io/account/security/)
25-
26-
# Feel free to take a look at our documentation (https://docs.sonarcloud.io/getting-started/github/)
27-
# or reach out to our community forum if you need some help (https://community.sonarsource.com/c/help/sc/9)
28-
29-
name: SonarCloud Analysis
30-
1+
name: SonarQube
312
on:
323
push:
33-
branches: [ "main" ]
4+
branches:
5+
- main
346
pull_request:
35-
branches: [ "main" ]
36-
workflow_dispatch:
37-
38-
permissions:
39-
pull-requests: read # allows SonarCloud to decorate PRs with analysis results
40-
7+
types: [opened, synchronize, reopened]
418
jobs:
42-
analysis:
43-
if: ${{ false }} # disable for now
9+
build:
10+
name: Build and analyze
4411
runs-on: ubuntu-latest
45-
4612
steps:
47-
- name: Analyze with SonarCloud
48-
49-
# You can pin the exact commit or the version.
50-
uses: SonarSource/sonarcloud-github-action@de2e56b42aa84d0b1c5b622644ac17e505c9a049
51-
env:
52-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information
53-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Generate a token on Sonarcloud.io, add it to the secrets of this repo with the name SONAR_TOKEN (Settings > Secrets > Actions > add new repository secret)
13+
- uses: actions/checkout@v4
14+
with:
15+
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
16+
- name: Set up JDK 17
17+
uses: actions/setup-java@v4
18+
with:
19+
java-version: 17
20+
distribution: 'temurin' # Alternative distribution options are available
21+
- name: Cache SonarQube packages
22+
uses: actions/cache@v4
5423
with:
55-
# Additional arguments for the sonarcloud scanner
56-
args:
57-
-Dsonar.projectKey=lreimer_secure-devex22
58-
-Dsonar.organization=lreimer
59-
# Comma-separated paths to directories containing main source files.
60-
#-Dsonar.sources= # optional, default is project base directory
61-
# When you need the analysis to take place in a directory other than the one from which it was launched
62-
#-Dsonar.projectBaseDir= # optional, default is .
63-
# Comma-separated paths to directories containing test source files.
64-
#-Dsonar.tests= # optional. For more info about Code Coverage, please refer to https://docs.sonarcloud.io/enriching/test-coverage/overview/
65-
# Adds more detail to both client and server-side analysis logs, activating DEBUG mode for the scanner, and adding client-side environment variables and system properties to the server-side log of analysis report processing.
66-
#-Dsonar.verbose= # optional, default is false
24+
path: ~/.sonar/cache
25+
key: ${{ runner.os }}-sonar
26+
restore-keys: ${{ runner.os }}-sonar
27+
- name: Cache Gradle packages
28+
uses: actions/cache@v4
29+
with:
30+
path: ~/.gradle/caches
31+
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
32+
restore-keys: ${{ runner.os }}-gradle
33+
- name: Build and analyze
34+
env:
35+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
36+
run: ./gradlew build sonar --info

‎build.gradle

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ plugins {
77
id "org.owasp.dependencycheck" version "7.2.1"
88

99
id "jacoco"
10-
id "org.sonarqube" version "3.4.0.2513"
10+
id "org.sonarqube" version "6.0.1.5171"
1111
}
1212

1313
group = 'de.qaware.cloud'
@@ -73,7 +73,7 @@ jacocoTestReport {
7373
}
7474
}
7575

76-
sonarqube {
76+
sonar {
7777
properties {
7878
property "sonar.projectKey", "lreimer_secure-devex22"
7979
property "sonar.organization", "lreimer"

0 commit comments

Comments
 (0)