diff --git a/.github/workflows/sonar-scan.yaml b/.github/workflows/sonar-scan.yaml new file mode 100644 index 000000000..10c531b2d --- /dev/null +++ b/.github/workflows/sonar-scan.yaml @@ -0,0 +1,56 @@ +name: sonar-scan.yaml + +on: + pull_request: + types: [opened, synchronize, reopened] + +jobs: + sonarqube: + name: SonarQube Scan + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v4 + with: + fetch-depth: 0 # Disabling shallow clone is recommended for proper analysis + + - name: Set up JDK + uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: 'maven' + + - name: Build and Analyze with SonarQube + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} + run: | + mvn -B clean verify sonar:sonar \ + -Dsonar.host.url=$SONAR_HOST_URL \ + -Dsonar.token=$SONAR_TOKEN \ + -Dsonar.qualitygate.wait=true + - name: Post SonarQube Link to PR + if: github.event_name == 'pull_request' && always() # Runs even if the scan step fails + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SONAR_URL: ${{ secrets.SONAR_HOST_URL }} + PROJECT_KEY: "mega-backend" + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + # 1. Define the comment body with Markdown + COMMENT_BODY="### 🔍 SonarQube Analysis Report + The static analysis for this PR is complete. You can view the full dashboard, security hotspots, and code smells here: + 👉 **[View SonarQube Dashboard]($SONAR_URL/dashboard?id=$PROJECT_KEY)**" + + # 2. Check if we already posted a comment on this PR + EXISTING_COMMENT_ID=$(gh pr view $PR_NUMBER --json comments --jq ".comments[] | select(.body | contains(\"SonarQube Analysis Report\")) | .databaseId" | head -n 1) + + # 3. If it exists, update it. If not, create a new one. + if [ -n "$EXISTING_COMMENT_ID" ]; then + echo "Updating existing PR comment..." + gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$EXISTING_COMMENT_ID" -f body="$COMMENT_BODY" + else + echo "Creating a new PR comment..." + gh pr comment $PR_NUMBER --body "$COMMENT_BODY" + fi diff --git a/.github/workflows/sonar-scan.yaml.yml b/.github/workflows/sonar-scan.yaml.yml deleted file mode 100644 index 239106ff2..000000000 --- a/.github/workflows/sonar-scan.yaml.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: sonar-scan.yaml - -on: - pull_request: - types: [opened, synchronize, reopened] - -jobs: - sonarqube: - name: SonarQube Scan - runs-on: ubuntu-latest - steps: - - name: Test - run: echo "test"