ctm/.github/workflows/sonar.yml at main · RandomCodeSpace/ctm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
# SonarCloud quality gate + coverage upload.
#
# Triggers: push to main (full-history scan) and PRs (incremental scan
# against the base branch). Concurrency-gated per-ref so reruns cancel
# in-flight scans.
#
# Coverage is collected fresh in this workflow rather than reused from
# CI — Sonar needs both go-coverprofile and lcov in the same workspace
# pass, and the existing CI job runs `go test` without -coverprofile.
# Adding coverage there would slow every PR build; keeping it here
# isolates the cost to the Sonar job.

name: SonarCloud

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: sonar-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Sonar uses git blame for new-code detection — shallow
          # checkouts (default fetch-depth=1) attribute every line to
          # the latest commit, breaking the quality-gate "new code"
          # signal. fetch-depth: 0 grabs the full history.
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Set up pnpm
        # Pinned to commit SHA (v4) per supply-chain hygiene — third-party
        # actions can be rewritten under a moving tag. Bump by re-running
        # `gh api repos/pnpm/action-setup/git/refs/tags/v4`.
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 10.33.0

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: ui/pnpm-lock.yaml

      - name: Build UI bundle
        # Required before any Go test run: //go:embed all:dist in
        # internal/serve/assets.go errors out if internal/serve/dist/
        # is empty. Same as ci.yml.
        run: make ui

      - name: Go test with coverage
        run: |
          go test -tags sqlite_fts5 \
            -coverprofile=coverage.out \
            -covermode=atomic \
            ./...

      - name: UI install
        # --ignore-scripts: refuse to execute lifecycle scripts from
        # transitive deps (Sonar S6505). vitest + the React stack don't
        # require any postinstall; esbuild ships per-platform binaries
        # via optional deps. If a future dep needs a build step, add it
        # to `pnpm.onlyBuiltDependencies` in ui/package.json instead.
        run: pnpm -C ui install --frozen-lockfile --ignore-scripts

      - name: UI test with coverage
        run: pnpm -C ui exec vitest run --coverage

      - name: Detect SONAR_TOKEN
        id: token
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |
          if [ -n "$SONAR_TOKEN" ]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "present=false" >> "$GITHUB_OUTPUT"
            echo "::warning::SONAR_TOKEN secret is not set; skipping SonarCloud scan. Add the token in repo Settings → Secrets and variables → Actions."
          fi

      - name: SonarCloud Scan
        if: steps.token.outputs.present == 'true'
        # v6 — v5 emits a deprecation/security warning on every run.
        # Pinned to commit SHA per supply-chain hygiene. Bump by
        # re-running `gh api repos/SonarSource/sonarqube-scan-action/git/refs/tags/v6`.
        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}