Commit 11c4aee7c5
11c4aee7c528f9507c6d42de80d4d342b25a0c25
parent: 1371d96586
Verified · cmc ci/build: success ci/test: success
cmc <hello@cleberg.net> · 2026-09-20 06:16 UTC
ci: drop the sonar job and its config
The SonarCloud project is deleted. The nightly job would download the
~50MB scanner and push a report at a project that no longer exists,
swallowed by its own `|| true`.
The SONAR_TOKEN build secret is now unused, and the SonarCloud user
token it holds still authenticates against the krz organisation — both
want removing by hand.
.gitbay/ci.yml
−53
| @@ -37,56 +37,3 @@ jobs: |
| 37 | 37 | schedule: "0 3 * * *" |
| 38 | 38 | steps: |
| 39 | 39 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| 40 | | # SonarCloud static analysis. Report-only: unlike vuln this does not |
| 41 | | # gate, so a first scan of an existing codebase does not turn every |
| 42 | | # build red before anyone has read what it says. Flip the trailing |
| 43 | | # `|| true` off to make the quality gate binding. |
| 44 | | # |
| 45 | | # Also nightly (#177). Report-only means it cannot fail a build, so |
| 46 | | # analysing every push of a branch that is about to be squashed away |
| 47 | | # informs nobody, and a stack being rebased analysed the same tree four |
| 48 | | # times. A scheduled job is registered by a default-branch push, so |
| 49 | | # this now tracks main — which is what the per-branch handling in the |
| 50 | | # step below was protecting in the first place (#154). It still works |
| 51 | | # on a branch when triggered by hand. |
| 52 | | # |
| 53 | | # One step, because each step runs in its own `sh -c` and an export |
| 54 | | # would not survive to the next. The scanner is cached under the |
| 55 | | # runner's home rather than re-downloading ~50MB per build, and the |
| 56 | | # linux-x64 bundle carries its own JRE, which is why the host needs no |
| 57 | | # Java. |
| 58 | | sonar: |
| 59 | | image: localhost/gitbay-ci:2 |
| 60 | | schedule: "30 3 * * *" |
| 61 | | steps: |
| 62 | | - | |
| 63 | | set -eu |
| 64 | | if [ -z "${SONAR_TOKEN:-}" ]; then |
| 65 | | echo "no SONAR_TOKEN in this build's environment; skipping." |
| 66 | | echo "A merge request from a fork is built without secrets on purpose," |
| 67 | | echo "so this is expected there and is not a failure." |
| 68 | | exit 0 |
| 69 | | fi |
| 70 | | VERSION=8.1.0.6389 |
| 71 | | HOME_DIR="${HOME:-/var/lib/gitbay-runner}" |
| 72 | | SCANNER="$HOME_DIR/.sonar/sonar-scanner-$VERSION-linux-x64" |
| 73 | | if [ ! -x "$SCANNER/bin/sonar-scanner" ]; then |
| 74 | | echo "installing sonar-scanner $VERSION" |
| 75 | | curl --create-dirs -fsSLo "$HOME_DIR/.sonar/sonar-scanner.zip" \ |
| 76 | | "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$VERSION-linux-x64.zip" |
| 77 | | unzip -q -o "$HOME_DIR/.sonar/sonar-scanner.zip" -d "$HOME_DIR/.sonar/" |
| 78 | | rm -f "$HOME_DIR/.sonar/sonar-scanner.zip" |
| 79 | | fi |
| 80 | | # Analyse each branch as itself. Without this every branch is |
| 81 | | # recorded against the project's main branch, so a feature branch |
| 82 | | # replaces main's results — a branch that removes findings makes |
| 83 | | # main look clean before its fix is merged, and one that adds |
| 84 | | # findings makes main look broken when it is not (#154). |
| 85 | | BRANCH="${GITBAY_REF:-}" |
| 86 | | BRANCH="${BRANCH#refs/heads/}" |
| 87 | | BRANCH_ARG="" |
| 88 | | if [ -n "$BRANCH" ] && [ "$BRANCH" != "main" ]; then |
| 89 | | BRANCH_ARG="-Dsonar.branch.name=$BRANCH" |
| 90 | | fi |
| 91 | | SONAR_HOST_URL=https://sonarcloud.io \ |
| 92 | | "$SCANNER/bin/sonar-scanner" -Dsonar.scm.revision="${GITBAY_SHA:-}" $BRANCH_ARG || true |
sonar-project.properties
deleted
−27
| @@ -1,27 +0,0 @@ |
| 1 | | # SonarCloud analysis. Only SONAR_TOKEN is a secret; it is a gitbay build |
| 2 | | # secret (`repo secret set krz/gitbay SONAR_TOKEN`, value on stdin) and |
| 3 | | # never appears here. Everything below is public configuration and is |
| 4 | | # checked in so a scan is reproducible from the repository alone. |
| 5 | | sonar.organization=krz |
| 6 | | sonar.projectKey=krz_gitbay |
| 7 | | sonar.projectName=gitbay |
| 8 | | |
| 9 | | sonar.sources=. |
| 10 | | sonar.tests=. |
| 11 | | sonar.test.inclusions=**/*_test.go |
| 12 | | |
| 13 | | # dist/ is release output, testdata is fixtures meant to be malformed, and |
| 14 | | # the fonts are third-party binaries. |
| 15 | | # |
| 16 | | # The migrations are excluded because they are SQLite and the analyser |
| 17 | | # reads .sql as PL/SQL, where '' is NULL. That turns `WHERE col = ''` on a |
| 18 | | # NOT NULL DEFAULT '' column — correct SQLite, and the shape used |
| 19 | | # throughout — into a NullComparison finding. Excluding them is the fix; |
| 20 | | # dismissing the same false positive after every migration is not. |
| 21 | | sonar.exclusions=dist/**,**/testdata/**,internal/web/static/fonts/**,internal/store/migrations/** |
| 22 | | |
| 23 | | # No sonar.go.coverage.reportPaths yet. Most of this repository's coverage |
| 24 | | # comes from the e2e suite, and re-running that under -coverprofile would |
| 25 | | # double the CI time; unit-only coverage would report misleadingly low |
| 26 | | # numbers for packages e2e exercises heavily. Reporting none is more |
| 27 | | # honest than reporting the wrong number. |