Compare commits

..

2 Commits

Author SHA1 Message Date
Julien HENRY
f7c83de4ca Add debug logs 2025-02-10 16:33:52 +01:00
Julien HENRY
74a64e051e SQSCANGHA-81 Update SonarScanner CLI to 7.0.1.4817 2025-02-10 15:57:19 +01:00
27 changed files with 93 additions and 182 deletions

View File

@@ -0,0 +1,4 @@
docker.projectNameFormat=repositoryNameAndTag
docker.scanImages=true
wss.url=https://saas-eu.whitesourcesoftware.com/agent
productName=GitHubAction/SonarQubeScanAction

2
.github/CODEOWNERS vendored
View File

@@ -1 +1 @@
.github/* @sonarsource/orchestration-processing-squad .github/CODEOWNERS @sonarsource/orchestration-processing-squad

View File

@@ -5,15 +5,16 @@ on:
types: [closed] types: [closed]
jobs: jobs:
PullRequestClosed_job: PullRequestMerged_job:
name: Pull Request Closed name: Pull Request Merged
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
permissions: permissions:
id-token: write id-token: write
pull-requests: read pull-requests: read
# For external PR, ticket should be moved manually # For external PR, ticket should be moved manually
if: | if: |
github.event.pull_request.head.repo.full_name == github.repository github.event.pull_request.head.repo.full_name == github.repository
&& github.event.pull_request.merged
steps: steps:
- id: secrets - id: secrets
uses: SonarSource/vault-action-wrapper@v3 uses: SonarSource/vault-action-wrapper@v3

View File

@@ -7,7 +7,7 @@ on:
jobs: jobs:
PullRequestCreated_job: PullRequestCreated_job:
name: Pull Request Created name: Pull Request Created
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
permissions: permissions:
id-token: write id-token: write
# For external PR, ticket should be created manually # For external PR, ticket should be created manually

View File

@@ -7,7 +7,7 @@ on:
jobs: jobs:
RequestReview_job: RequestReview_job:
name: Request review name: Request review
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
permissions: permissions:
id-token: write id-token: write
# For external PR, ticket should be moved manually # For external PR, ticket should be moved manually

View File

@@ -7,7 +7,7 @@ on:
jobs: jobs:
SubmitReview_job: SubmitReview_job:
name: Submit Review name: Submit Review
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
permissions: permissions:
id-token: write id-token: write
pull-requests: read pull-requests: read

View File

@@ -12,7 +12,7 @@ jobs:
name: Action outputs name: Action outputs
strategy: strategy:
matrix: matrix:
os: [ubuntu-latest-large, windows-latest-large, macos-latest, macos-13] os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
cache: [true, false] cache: [true, false]
include: include:
- arch: X64 - arch: X64

View File

@@ -12,7 +12,7 @@ jobs:
name: Action outputs name: Action outputs
strategy: strategy:
matrix: matrix:
os: [ubuntu-latest-large, windows-latest-large, macos-latest, macos-13] os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
cache: [true, false] cache: [true, false]
include: include:
- arch: X64 - arch: X64

View File

@@ -11,15 +11,12 @@ jobs:
noInputsTest: noInputsTest:
name: > name: >
No inputs No inputs
strategy: runs-on: ubuntu-latest
matrix:
os: [ ubuntu-latest-large, macos-latest ]
runs-on: ${{ matrix.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
- name: Run action without args - name: Run action with args
uses: ./ uses: ./
env: env:
SONAR_HOST_URL: http://not_actually_used SONAR_HOST_URL: http://not_actually_used
@@ -32,7 +29,7 @@ jobs:
'args' input 'args' input
strategy: strategy:
matrix: matrix:
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ] os: [ ubuntu-latest, windows-latest, macos-latest ]
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@@ -41,45 +38,19 @@ jobs:
- name: Run action with args - name: Run action with args
uses: ./ uses: ./
with: with:
args: -Dsonar.someArg=aValue -Dsonar.anotherArgWithSpaces="Another Value" args: -Dsonar.someArg=aValue -Dsonar.scanner.internal.dumpToFile=./output.properties
env: env:
SONAR_HOST_URL: http://not_actually_used SONAR_HOST_URL: http://not_actually_used
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}' SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
- name: Assert - name: Assert
run: | run: |
./test/assertFileContains ./output.properties "sonar.someArg=aValue" ./test/assertFileContains ./output.properties "sonar.someArg=aValue"
./test/assertFileContains ./output.properties "sonar.anotherArgWithSpaces=Another Value"
argsInputInjectionTest:
name: >
'args' input with command injection will fail
strategy:
matrix:
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
- name: Run action with args
uses: ./
continue-on-error: true
with:
args: -Dsonar.someArg=aValue && echo "Injection"
env:
SONAR_HOST_URL: http://not_actually_used
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
- name: Fail if action succeeded
if: steps.runTest.outcome == 'success'
run: exit 1
- name: Assert the scanner was not called
run: |
./test/assertFileDoesntExist ./output.properties
projectBaseDirInputTest: projectBaseDirInputTest:
name: > name: >
'projectBaseDir' input 'projectBaseDir' input
strategy: strategy:
matrix: matrix:
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ] os: [ ubuntu-latest, windows-latest, macos-latest ]
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@@ -100,7 +71,7 @@ jobs:
scannerVersionTest: scannerVersionTest:
name: > name: >
'scannerVersion' input 'scannerVersion' input
runs-on: ubuntu-latest-large # assumes default RUNNER_ARCH for linux is X64 runs-on: ubuntu-latest # assumes default RUNNER_ARCH for linux is X64
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -120,7 +91,7 @@ jobs:
scannerBinariesUrlTest: scannerBinariesUrlTest:
name: > name: >
'scannerBinariesUrl' input with invalid URL 'scannerBinariesUrl' input with invalid URL
runs-on: ubuntu-latest-large # assumes default RUNNER_ARCH for linux is X64 runs-on: ubuntu-latest # assumes default RUNNER_ARCH for linux is X64
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -148,7 +119,7 @@ jobs:
scannerBinariesUrlIsEscapedWithWget: scannerBinariesUrlIsEscapedWithWget:
name: > name: >
'scannerBinariesUrl' is escaped with wget so special chars are not injected in the download command 'scannerBinariesUrl' is escaped with wget so special chars are not injected in the download command
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -169,7 +140,7 @@ jobs:
scannerBinariesUrlIsEscapedWithCurl: scannerBinariesUrlIsEscapedWithCurl:
name: > name: >
'scannerBinariesUrl' is escaped with curl so special chars are not injected in the download command 'scannerBinariesUrl' is escaped with curl so special chars are not injected in the download command
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -198,7 +169,7 @@ jobs:
dontFailGradleTest: dontFailGradleTest:
name: > name: >
Don't fail on Gradle project Don't fail on Gradle project
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -219,7 +190,7 @@ jobs:
dontFailGradleKotlinTest: dontFailGradleKotlinTest:
name: > name: >
Don't fail on Kotlin Gradle project Don't fail on Kotlin Gradle project
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -240,7 +211,7 @@ jobs:
dontFailMavenTest: dontFailMavenTest:
name: > name: >
Don't fail on Maven project Don't fail on Maven project
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -259,7 +230,7 @@ jobs:
run: | run: |
./test/assertFileExists ./output.properties ./test/assertFileExists ./output.properties
runAnalysisTest: runAnalysisTest:
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
services: services:
sonarqube: sonarqube:
image: sonarqube:lts-community image: sonarqube:lts-community
@@ -294,7 +265,7 @@ jobs:
'RUNNER_DEBUG' is used 'RUNNER_DEBUG' is used
strategy: strategy:
matrix: matrix:
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ] os: [ ubuntu-latest, windows-latest, macos-latest ]
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@@ -312,7 +283,7 @@ jobs:
run: | run: |
./test/assertFileContains ./output.properties "sonar.verbose=true" ./test/assertFileContains ./output.properties "sonar.verbose=true"
runAnalysisWithCacheTest: runAnalysisWithCacheTest:
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
services: services:
sonarqube: sonarqube:
image: sonarqube:lts-community image: sonarqube:lts-community
@@ -353,7 +324,7 @@ jobs:
'SONARCLOUD_URL' is used 'SONARCLOUD_URL' is used
strategy: strategy:
matrix: matrix:
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ] os: [ ubuntu-latest, windows-latest, macos-latest ]
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@@ -362,7 +333,7 @@ jobs:
- name: Run action with SONARCLOUD_URL - name: Run action with SONARCLOUD_URL
uses: ./ uses: ./
with: with:
args: -Dsonar.scanner.apiBaseUrl=api.mirror.sonarcloud.io -Dsonar.scanner.internal.dumpToFile=./output.properties args: -Dsonar.scanner.internal.dumpToFile=./output.properties
env: env:
SONARCLOUD_URL: mirror.sonarcloud.io SONARCLOUD_URL: mirror.sonarcloud.io
SONAR_TOKEN: FAKE_TOKEN SONAR_TOKEN: FAKE_TOKEN
@@ -372,7 +343,7 @@ jobs:
./test/assertFileContains ./output.properties "sonar.scanner.sonarcloudUrl=mirror.sonarcloud.io" ./test/assertFileContains ./output.properties "sonar.scanner.sonarcloudUrl=mirror.sonarcloud.io"
dontFailWhenMissingWgetButCurlAvailable: dontFailWhenMissingWgetButCurlAvailable:
name: Don't fail when missing wget but curl available name: Don't fail when missing wget but curl available
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -398,7 +369,7 @@ jobs:
./test/assertFileExists ./output.properties ./test/assertFileExists ./output.properties
dontFailWhenMissingCurlButWgetAvailable: dontFailWhenMissingCurlButWgetAvailable:
name: Don't fail when missing curl but wget available name: Don't fail when missing curl but wget available
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -425,7 +396,7 @@ jobs:
./test/assertFileExists ./output.properties ./test/assertFileExists ./output.properties
failWhenBothWgetAndCurlMissing: failWhenBothWgetAndCurlMissing:
name: Fail when both wget and curl are missing name: Fail when both wget and curl are missing
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -458,7 +429,7 @@ jobs:
curlPerformsRedirect: curlPerformsRedirect:
name: > name: >
curl performs redirect when scannerBinariesUrl returns 3xx curl performs redirect when scannerBinariesUrl returns 3xx
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -478,8 +449,8 @@ jobs:
id: runTest id: runTest
uses: ./ uses: ./
with: with:
scannerVersion: 6.2.1.4610
scannerBinariesUrl: http://localhost:8080/clientRedirectToSonarBinaries scannerBinariesUrl: http://localhost:8080/clientRedirectToSonarBinaries
scannerVersion: 6.2.1.4610
env: env:
NO_CACHE: true NO_CACHE: true
SONAR_HOST_URL: http://not_actually_used SONAR_HOST_URL: http://not_actually_used
@@ -492,7 +463,7 @@ jobs:
'SONAR_ROOT_CERT' is converted to truststore 'SONAR_ROOT_CERT' is converted to truststore
strategy: strategy:
matrix: matrix:
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ] os: [ ubuntu-latest, windows-latest, macos-latest ]
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@@ -544,7 +515,7 @@ jobs:
analysisWithSslCertificate: analysisWithSslCertificate:
name: > name: >
Analysis takes into account 'SONAR_ROOT_CERT' Analysis takes into account 'SONAR_ROOT_CERT'
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -580,7 +551,7 @@ jobs:
SONAR_ROOT_CERT: ${{ env.SONAR_ROOT_CERT_VALID }} SONAR_ROOT_CERT: ${{ env.SONAR_ROOT_CERT_VALID }}
SONAR_HOST_URL: https://localhost:4443 SONAR_HOST_URL: https://localhost:4443
with: with:
args: -Dsonar.login=admin -Dsonar.password=admin args: -X -Dsonar.login=admin -Dsonar.password=admin
projectBaseDir: ./test/example-project projectBaseDir: ./test/example-project
- name: Clear imported SSL certificates - name: Clear imported SSL certificates
run: | run: |
@@ -652,7 +623,7 @@ jobs:
overridesScannerLocalFolderWhenPresent: # can happen in uncleaned self-hosted runners overridesScannerLocalFolderWhenPresent: # can happen in uncleaned self-hosted runners
name: > name: >
'SCANNER_LOCAL_FOLDER' is cleaned with warning when present 'SCANNER_LOCAL_FOLDER' is cleaned with warning when present
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -686,7 +657,7 @@ jobs:
updateTruststoreWhenPresent: # can happen in uncleaned self-hosted runners updateTruststoreWhenPresent: # can happen in uncleaned self-hosted runners
name: > name: >
truststore.p12 is updated when present truststore.p12 is updated when present
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -812,26 +783,3 @@ jobs:
[ -f "$SONAR_SSL_FOLDER/truststore.p12" ] || exit 1 [ -f "$SONAR_SSL_FOLDER/truststore.p12" ] || exit 1
TRUSTSTORE_P12_MOD_TIME_T3=$(stat -c %Y "$SONAR_SSL_FOLDER/truststore.p12") TRUSTSTORE_P12_MOD_TIME_T3=$(stat -c %Y "$SONAR_SSL_FOLDER/truststore.p12")
[ "$TRUSTSTORE_P12_MOD_TIME_T2" != "$TRUSTSTORE_P12_MOD_TIME_T3" ] || exit 1 [ "$TRUSTSTORE_P12_MOD_TIME_T2" != "$TRUSTSTORE_P12_MOD_TIME_T3" ] || exit 1
scannerVersionValidationTest:
name: >
'scannerVersion' input validation
runs-on: ubuntu-latest-large
steps:
- uses: actions/checkout@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
- name: Run action with invalid scannerVersion
id: invalid_version
uses: ./
continue-on-error: true
with:
scannerVersion: "7.1.0-SNAPSHOT"
args: -Dsonar.scanner.internal.dumpToFile=./output.properties
env:
NO_CACHE: true
SONAR_HOST_URL: http://not_actually_used
- name: Assert failure of previous step
if: steps.invalid_version.outcome == 'success'
run: |
echo "Action with invalid scannerVersion should have failed but succeeded"
exit 1

View File

@@ -10,7 +10,7 @@ on:
jobs: jobs:
create-install-dir-test: create-install-dir-test:
name: create_install_path.sh name: create_install_path.sh
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -107,7 +107,7 @@ jobs:
grep "=== Script failed ===" output grep "=== Script failed ===" output
setup-script-test: setup-script-test:
name: configure_paths.sh name: configure_paths.sh
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
env: env:
INSTALL_PATH: 'install-directory' INSTALL_PATH: 'install-directory'
SONAR_HOST_URL: 'http://sonar-host.com' SONAR_HOST_URL: 'http://sonar-host.com'
@@ -250,7 +250,7 @@ jobs:
grep "=== Script failed ===" output grep "=== Script failed ===" output
download-script-test: download-script-test:
name: download.sh name: download.sh
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -319,7 +319,7 @@ jobs:
grep "=== Script failed ===" output grep "=== Script failed ===" output
fetch-latest-version-test: fetch-latest-version-test:
name: fetch_latest_version.sh name: fetch_latest_version.sh
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:

View File

@@ -7,7 +7,7 @@ on:
jobs: jobs:
generate: generate:
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
permissions: permissions:
contents: write contents: write
@@ -16,7 +16,7 @@ jobs:
uses: actions/checkout@v4 uses: actions/checkout@v4
- name: Parse semver - name: Parse semver
uses: madhead/semver-utils@36d1e0ed361bd7b4b77665de8093092eaeabe6ba # v4.3.0 uses: madhead/semver-utils@v4
id: version id: version
with: with:
version: ${{ github.ref_name }} version: ${{ github.ref_name }}

View File

@@ -5,15 +5,15 @@ on:
- cron: '15 10 * * *' - cron: '15 10 * * *'
jobs: jobs:
check-version: update-version:
name: Check for sonar-scanner version update name: Prepare pull request for sonar-scanner version update
runs-on: ubuntu-latest-large runs-on: ubuntu-latest
outputs: permissions:
should_update: ${{ steps.version-check.outputs.should_update }} contents: write
latest_version: ${{ steps.latest-version.outputs.latest }} pull-requests: write
steps: steps:
- run: sudo apt install -y jq - run: sudo apt install -y jq
- run: sudo snap install yq
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
ref: master ref: master
@@ -25,50 +25,25 @@ jobs:
shell: bash shell: bash
run: cat sonar-scanner-version >> $GITHUB_OUTPUT run: cat sonar-scanner-version >> $GITHUB_OUTPUT
- name: "Fetch latest sonar-scanner version" - name: "Fetch lastest sonar-scanner version"
id: latest-version id: latest-version
shell: bash shell: bash
run: | run: |
./scripts/fetch_latest_version.sh > sonar-scanner-version ./scripts/fetch_latest_version.sh > sonar-scanner-version
echo "latest=$(cat sonar-scanner-version)" >> $GITHUB_OUTPUT cat sonar-scanner-version >> $GITHUB_OUTPUT
- name: "Determine if update is needed"
id: version-check
shell: bash
run: |
if [[ "${{ steps.tagged-version.outputs.sonar-scanner-version }}" != "${{ steps.latest-version.outputs.latest }}" ]]; then
echo "should_update=true" >> $GITHUB_OUTPUT
else
echo "should_update=false" >> $GITHUB_OUTPUT
fi
update-version:
name: Prepare pull request for sonar-scanner version update
needs: check-version
runs-on: ubuntu-latest-large
permissions:
contents: write
pull-requests: write
if: needs.check-version.outputs.should_update == 'true'
steps:
- name: "Update default version"
shell: bash
env:
NEW_VERSION: ${{ needs.check-version.outputs.latest-version }}
run: |
yq -i '.inputs.scannerVersion.default = strenv(NEW_VERSION)' action.yml
- name: "Create Pull Request for version update" - name: "Create Pull Request for version update"
if: steps.tagged-version.outputs.sonar-scanner-version != steps.latest-version.outputs.sonar-scanner-version
shell: bash shell: bash
env: env:
UPDATE_BRANCH: update-to-sonar-scanner-${{ needs.check-version.outputs.latest-version }} UPDATE_BRANCH: update-to-sonar-scanner-${{ steps.latest-version.outputs.sonar-scanner-version }}
TITLE: "Update SonarScanner CLI to ${{ needs.check-version.outputs.latest-version }}" TITLE: "Update SonarScanner CLI to ${{ steps.latest-version.outputs.sonar-scanner-version }}"
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: | run: |
git config --global user.name "SonarTech" git config --global user.name "SonarTech"
git config --global user.email "sonartech@sonarsource.com" git config --global user.email "sonartech@sonarsource.com"
git checkout -b ${UPDATE_BRANCH} git checkout -b ${UPDATE_BRANCH}
git add sonar-scanner-version git add sonar-scanner-version
git add action.yml
git commit -m "${TITLE}" git commit -m "${TITLE}"
git push --force-with-lease origin ${UPDATE_BRANCH} git push --force-with-lease origin ${UPDATE_BRANCH}
gh pr list gh pr list

View File

@@ -104,7 +104,7 @@ jobs:
- name: Install Build Wrapper - name: Install Build Wrapper
uses: SonarSource/sonarqube-scan-action/install-build-wrapper@<action version> uses: SonarSource/sonarqube-scan-action/install-build-wrapper@<action version>
env: env:
SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
- name: Run Build Wrapper - name: Run Build Wrapper
run: | run: |
# Here goes your compilation wrapped with Build Wrapper # Here goes your compilation wrapped with Build Wrapper
@@ -115,7 +115,7 @@ jobs:
uses: SonarSource/sonarqube-scan-action@<action version> uses: SonarSource/sonarqube-scan-action@<action version>
env: env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
SONAR_ROOT_CERT: ${{ secrets.SONAR_ROOT_CERT }} SONAR_ROOT_CERT: ${{ secrets.SONAR_ROOT_CERT }}
with: with:
# Consult https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/sonarscanner/ for more information and options # Consult https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/sonarscanner/ for more information and options

View File

@@ -1,8 +1,8 @@
name: Official SonarQube Scan name: Official SonarQube Scan
# Warning: changing name would change URL in the marketplace # Warning: changing name would change URL in the marketplace
description: > description: >
Scan your code with SonarQube Server and Cloud to detect issues in 30+ languages. (Formerly SonarQube and SonarCloud) Scan your code with SonarQube Server and Cloud to detect
issues in 30+ languages. (Formerly SonarQube and SonarCloud)
branding: branding:
icon: check icon: check
color: green color: green
@@ -17,7 +17,7 @@ inputs:
description: Version of the Sonar Scanner CLI to use description: Version of the Sonar Scanner CLI to use
required: false required: false
# to be kept in sync with sonar-scanner-version # to be kept in sync with sonar-scanner-version
default: 7.2.0.5079 default: 7.0.1.4817
scannerBinariesUrl: scannerBinariesUrl:
description: URL to download the Sonar Scanner CLI binaries from description: URL to download the Sonar Scanner CLI binaries from
required: false required: false
@@ -30,7 +30,6 @@ runs:
shell: bash shell: bash
env: env:
INPUT_PROJECTBASEDIR: ${{ inputs.projectBaseDir }} INPUT_PROJECTBASEDIR: ${{ inputs.projectBaseDir }}
INPUT_SCANNERVERSION: ${{ inputs.scannerVersion }}
- name: Load Sonar Scanner CLI from cache - name: Load Sonar Scanner CLI from cache
id: sonar-scanner-cli id: sonar-scanner-cli
uses: actions/cache@v4 uses: actions/cache@v4
@@ -51,10 +50,7 @@ runs:
run: echo "${RUNNER_TEMP}/sonar-scanner-cli-${{ inputs.scannerVersion }}-${{ runner.os }}-${{ runner.arch }}/bin" >> $GITHUB_PATH run: echo "${RUNNER_TEMP}/sonar-scanner-cli-${{ inputs.scannerVersion }}-${{ runner.os }}-${{ runner.arch }}/bin" >> $GITHUB_PATH
shell: bash shell: bash
- name: Run SonarScanner - name: Run SonarScanner
run: | run: ${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh ${{ inputs.args }}
args=(${{ inputs.args }})
cmd=(${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh "${args[@]}")
"${cmd[@]}"
shell: bash shell: bash
env: env:
INPUT_PROJECTBASEDIR: ${{ inputs.projectBaseDir }} INPUT_PROJECTBASEDIR: ${{ inputs.projectBaseDir }}

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
if [[ -n "${SONAR_ROOT_CERT}" ]]; then if [[ -n "${SONAR_ROOT_CERT}" ]]; then
echo "Adding custom root certificate to java certificate store" echo "Adding custom root certificate to java certificate store"

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
if [[ ${ARCH} != "X64" && ! (${ARCH} == "ARM64" && (${OS} == "macOS" || ${OS} == "Linux")) ]]; then if [[ ${ARCH} != "X64" && ! (${ARCH} == "ARM64" && (${OS} == "macOS" || ${OS} == "Linux")) ]]; then
echo "::error::Architecture '${ARCH}' is unsupported by build-wrapper" echo "::error::Architecture '${ARCH}' is unsupported by build-wrapper"

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
source "$(dirname -- "$0")/utils.sh" source "$(dirname -- "$0")/utils.sh"

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
source "$(dirname -- "$0")/utils.sh" source "$(dirname -- "$0")/utils.sh"

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
source "$(dirname -- "$0")/utils.sh" source "$(dirname -- "$0")/utils.sh"

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
set -eou pipefail set -eou pipefail

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
set -eo pipefail set -eo pipefail
@@ -77,5 +77,5 @@ scanner_args+=("$@")
set -ux set -ux
$SCANNER_BIN ${scanner_args[@]+"${scanner_args[@]}"} $SCANNER_BIN "${scanner_args[@]}"

View File

@@ -1,12 +1,7 @@
#!/usr/bin/env bash #!/bin/bash
set -eo pipefail set -eo pipefail
if [[ ! "${INPUT_SCANNERVERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "::error title=SonarScanner::Invalid scannerVersion format. Expected format: x.y.z.w (e.g., 7.1.0.4889)"
exit 1
fi
if [[ -z "${SONAR_TOKEN}" ]]; then if [[ -z "${SONAR_TOKEN}" ]]; then
echo "::warning title=SonarScanner::Running this GitHub Action without SONAR_TOKEN is not recommended" echo "::warning title=SonarScanner::Running this GitHub Action without SONAR_TOKEN is not recommended"
fi fi

View File

@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/bin/bash
check_status() { check_status() {
exit_status=$? exit_status=$?

View File

@@ -1,11 +1,11 @@
sonar-scanner-version=7.2.0.5079 sonar-scanner-version=7.0.1.4817
sonar-scanner-url-windows-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-windows-x64.zip sonar-scanner-url-windows-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.0.1.4817-windows-x64.zip
sonar-scanner-sha-windows-x64=71936f352206b63cb05ffbcd68e366e52d22916148cf4a2418789bc776f733ea sonar-scanner-sha-windows-x64=6b523587567af4170a4e0e0d02053d4a3f117e6612a11a4382ae45211b82383f
sonar-scanner-url-linux-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-linux-x64.zip sonar-scanner-url-linux-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.0.1.4817-linux-x64.zip
sonar-scanner-sha-linux-x64=da9f4e64a3d555f08ce38b5469ebd91fe2b311af473f7001a5ee5c1fd58b004b sonar-scanner-sha-linux-x64=b0643348eed1ec808d8c9b35b34bdf953ed9788978c38b32c577960bbef0a7f8
sonar-scanner-url-linux-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-linux-aarch64.zip sonar-scanner-url-linux-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.0.1.4817-linux-aarch64.zip
sonar-scanner-sha-linux-aarch64=803ca725d463e95eeb7537515706367bb8e52bf05ac32174daf9773bdb36d1e2 sonar-scanner-sha-linux-aarch64=f1def4b7f8fe5839ab185eee7e493551ed1bd5534707f8e02933579e2315ffaa
sonar-scanner-url-macosx-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-macosx-x64.zip sonar-scanner-url-macosx-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.0.1.4817-macosx-x64.zip
sonar-scanner-sha-macosx-x64=7b9e92248ca740fff41503bfe5459c460bac43c501d80043cc4fbebb72dfc5fa sonar-scanner-sha-macosx-x64=820100498148433db0674da3156eca5974e1b4f7dfc073d41df1f3ff49cd9b33
sonar-scanner-url-macosx-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-macosx-aarch64.zip sonar-scanner-url-macosx-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.0.1.4817-macosx-aarch64.zip
sonar-scanner-sha-macosx-aarch64=c8adb3fbfe5485c17de193a217be765b66cbc10d6540057655afa3c3b5be6f61 sonar-scanner-sha-macosx-aarch64=4903800165c59890b9859a212054bd55d0eb2a5682ce377fad70560be4b833f0

View File

@@ -1,14 +1,10 @@
#!/usr/bin/env bash #!/bin/bash
set -eou pipefail
error() { echo -e "\\e[31m✗ $*\\e[0m"; } error() { echo -e "\\e[31m✗ $*\\e[0m"; }
scriptDir=$(dirname -- "$(readlink -f -- "${BASH_SOURCE[0]}")") assertFileExists $1
$scriptDir/assertFileExists "$1" if ! grep -q $2 $1; then
if ! grep -q "$2" "$1"; then
error "'$2' not found in '$1'" error "'$2' not found in '$1'"
exit 1 exit 1
fi fi

View File

@@ -1,10 +1,8 @@
#!/usr/bin/env bash #!/bin/bash
set -eou pipefail
error() { echo -e "\\e[31m✗ $*\\e[0m"; } error() { echo -e "\\e[31m✗ $*\\e[0m"; }
if [ -f "$1" ]; then if [ -f $1 ]; then
error "File '$1' found" error "File '$1' found"
exit 1 exit 1
fi fi

View File

@@ -1,10 +1,8 @@
#!/usr/bin/env bash #!/bin/bash
set -eou pipefail
error() { echo -e "\\e[31m✗ $*\\e[0m"; } error() { echo -e "\\e[31m✗ $*\\e[0m"; }
if [ ! -f "$1" ]; then if [ ! -f $1 ]; then
error "File '$1' not found" error "File '$1' not found"
exit 1 exit 1
fi fi