From a6e7644685f701eaeb76ab3d63ff4a564553ade6 Mon Sep 17 00:00:00 2001 From: Tobias Meindl Date: Mon, 29 Jun 2026 16:14:40 +0200 Subject: [PATCH 1/5] add job for code analysis via sonarqube and mvn --- .github/workflows/sonar-scan.yaml.yml | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sonar-scan.yaml.yml b/.github/workflows/sonar-scan.yaml.yml index 239106ff2..8bfb11f20 100644 --- a/.github/workflows/sonar-scan.yaml.yml +++ b/.github/workflows/sonar-scan.yaml.yml @@ -9,5 +9,24 @@ jobs: name: SonarQube Scan runs-on: ubuntu-latest steps: - - name: Test - run: echo "test" + - name: Checkout Code + uses: actions/checkout@v4 + with: + fetch-depth: 0 # Disabling shallow clone is recommended for proper analysis + + - name: Set up JDK + uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: 'maven' + + - name: Build and Analyze with SonarQube + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} + run: | + mvn -B clean verify sonar:sonar \ + -Dsonar.host.url=$SONAR_HOST_URL \ + -Dsonar.token=$SONAR_TOKEN \ + -Dsonar.qualitygate.wait=true From c49b504dfb02b14d7fe82faa76851db59e6ec219 Mon Sep 17 00:00:00 2001 From: Tobias Meindl Date: Mon, 29 Jun 2026 16:27:07 +0200 Subject: [PATCH 2/5] vibe code functionality to post link to dashboard of sonar scan --- .github/workflows/sonar-scan.yaml.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/workflows/sonar-scan.yaml.yml b/.github/workflows/sonar-scan.yaml.yml index 8bfb11f20..fd6fc00a1 100644 --- a/.github/workflows/sonar-scan.yaml.yml +++ b/.github/workflows/sonar-scan.yaml.yml @@ -30,3 +30,27 @@ jobs: -Dsonar.host.url=$SONAR_HOST_URL \ -Dsonar.token=$SONAR_TOKEN \ -Dsonar.qualitygate.wait=true + - name: Post SonarQube Link to PR + if: github.event_name == 'pull_request' && always() # Runs even if the scan step fails + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SONAR_URL: ${{ secrets.SONAR_HOST_URL }} + PROJECT_KEY: "mega-backend" + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + # 1. Define the comment body with Markdown + COMMENT_BODY="### 🔍 SonarQube Analysis Report + The static analysis for this PR is complete. You can view the full dashboard, security hotspots, and code smells here: + 👉 **[View SonarQube Dashboard]($SONAR_URL/dashboard?id=$PROJECT_KEY)**" + + # 2. Check if we already posted a comment on this PR + EXISTING_COMMENT_ID=$(gh pr view $PR_NUMBER --json comments --jq ".comments[] | select(.body | contains(\"SonarQube Analysis Report\")) | .id" | head -n 1) + + # 3. If it exists, update it. If not, create a new one. + if [ -n "$EXISTING_COMMENT_ID" ]; then + echo "Updating existing PR comment..." + gh api -X PATCH "repos/${{ github.repository }}/issues/comments/$EXISTING_COMMENT_ID" -f body="$COMMENT_BODY" + else + echo "Creating a new PR comment..." + gh pr comment $PR_NUMBER --body "$COMMENT_BODY" + fi From faaca6ee093c378cf001876f4f9b338cbdd39489 Mon Sep 17 00:00:00 2001 From: Tobias Meindl Date: Mon, 29 Jun 2026 16:34:20 +0200 Subject: [PATCH 3/5] re trigger scan via whitespace addition --- .github/workflows/sonar-scan.yaml.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sonar-scan.yaml.yml b/.github/workflows/sonar-scan.yaml.yml index fd6fc00a1..318441233 100644 --- a/.github/workflows/sonar-scan.yaml.yml +++ b/.github/workflows/sonar-scan.yaml.yml @@ -38,7 +38,7 @@ jobs: PROJECT_KEY: "mega-backend" PR_NUMBER: ${{ github.event.pull_request.number }} run: | - # 1. Define the comment body with Markdown + # 1. Define the comment body with Markdown COMMENT_BODY="### 🔍 SonarQube Analysis Report The static analysis for this PR is complete. You can view the full dashboard, security hotspots, and code smells here: 👉 **[View SonarQube Dashboard]($SONAR_URL/dashboard?id=$PROJECT_KEY)**" From 4350310c8e7ed524c2b04ac71a04cedfc22d0ec2 Mon Sep 17 00:00:00 2001 From: Tobias Meindl Date: Mon, 29 Jun 2026 16:34:53 +0200 Subject: [PATCH 4/5] re trigger scan via whitespace addition --- .github/workflows/{sonar-scan.yaml.yml => sonar-scan.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{sonar-scan.yaml.yml => sonar-scan.yaml} (100%) diff --git a/.github/workflows/sonar-scan.yaml.yml b/.github/workflows/sonar-scan.yaml similarity index 100% rename from .github/workflows/sonar-scan.yaml.yml rename to .github/workflows/sonar-scan.yaml From a1b1134d9a57916eed344103b4971e3cc1cf8c2e Mon Sep 17 00:00:00 2001 From: Tobias Meindl Date: Mon, 29 Jun 2026 16:44:01 +0200 Subject: [PATCH 5/5] follow LLM blindly --- .github/workflows/sonar-scan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sonar-scan.yaml b/.github/workflows/sonar-scan.yaml index 318441233..10c531b2d 100644 --- a/.github/workflows/sonar-scan.yaml +++ b/.github/workflows/sonar-scan.yaml @@ -44,7 +44,7 @@ jobs: 👉 **[View SonarQube Dashboard]($SONAR_URL/dashboard?id=$PROJECT_KEY)**" # 2. Check if we already posted a comment on this PR - EXISTING_COMMENT_ID=$(gh pr view $PR_NUMBER --json comments --jq ".comments[] | select(.body | contains(\"SonarQube Analysis Report\")) | .id" | head -n 1) + EXISTING_COMMENT_ID=$(gh pr view $PR_NUMBER --json comments --jq ".comments[] | select(.body | contains(\"SonarQube Analysis Report\")) | .databaseId" | head -n 1) # 3. If it exists, update it. If not, create a new one. if [ -n "$EXISTING_COMMENT_ID" ]; then