ci: SonarCloud static analysis, report-only !248
2 files changed, +53 −0
Layout: unified · split
.gitbay/ci.yml +32
| @@ -23,3 +23,35 @@ jobs: | ||
| 23 | 23 | vuln: |
| 24 | 24 | steps: |
| 25 | 25 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| 26 | # SonarCloud static analysis. Report-only: unlike vuln this does not | |
| 27 | # gate, so a first scan of an existing codebase does not turn every | |
| 28 | # build red before anyone has read what it says. Flip the trailing | |
| 29 | # `|| true` off to make the quality gate binding. | |
| 30 | # | |
| 31 | # One step, because each step runs in its own `sh -c` and an export | |
| 32 | # would not survive to the next. The scanner is cached under the | |
| 33 | # runner's home rather than re-downloading ~50MB per build, and the | |
| 34 | # linux-x64 bundle carries its own JRE, which is why the host needs no | |
| 35 | # Java. | |
| 36 | sonar: | |
| 37 | steps: | |
| 38 | - | | |
| 39 | set -eu | |
| 40 | if [ -z "${SONAR_TOKEN:-}" ]; then | |
| 41 | echo "no SONAR_TOKEN in this build's environment; skipping." | |
| 42 | echo "A merge request from a fork is built without secrets on purpose," | |
| 43 | echo "so this is expected there and is not a failure." | |
| 44 | exit 0 | |
| 45 | fi | |
| 46 | VERSION=8.1.0.6389 | |
| 47 | HOME_DIR="${HOME:-/var/lib/gitbay-runner}" | |
| 48 | SCANNER="$HOME_DIR/.sonar/sonar-scanner-$VERSION-linux-x64" | |
| 49 | if [ ! -x "$SCANNER/bin/sonar-scanner" ]; then | |
| 50 | echo "installing sonar-scanner $VERSION" | |
| 51 | curl --create-dirs -fsSLo "$HOME_DIR/.sonar/sonar-scanner.zip" \ | |
| 52 | "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$VERSION-linux-x64.zip" | |
| 53 | unzip -q -o "$HOME_DIR/.sonar/sonar-scanner.zip" -d "$HOME_DIR/.sonar/" | |
| 54 | rm -f "$HOME_DIR/.sonar/sonar-scanner.zip" | |
| 55 | fi | |
| 56 | SONAR_HOST_URL=https://sonarcloud.io \ | |
| 57 | "$SCANNER/bin/sonar-scanner" -Dsonar.scm.revision="${GITBAY_SHA:-}" || true | |
sonar-project.properties added +21
| @@ -0,0 +1,21 @@ | ||
| 1 | # SonarCloud analysis. Only SONAR_TOKEN is a secret; it is a gitbay build | |
| 2 | # secret (`repo secret set krz/gitbay SONAR_TOKEN`, value on stdin) and | |
| 3 | # never appears here. Everything below is public configuration and is | |
| 4 | # checked in so a scan is reproducible from the repository alone. | |
| 5 | sonar.organization=krz | |
| 6 | sonar.projectKey=krz_gitbay | |
| 7 | sonar.projectName=gitbay | |
| 8 | ||
| 9 | sonar.sources=. | |
| 10 | sonar.tests=. | |
| 11 | sonar.test.inclusions=**/*_test.go | |
| 12 | ||
| 13 | # dist/ is release output, testdata is fixtures meant to be malformed, and | |
| 14 | # the fonts are third-party binaries. | |
| 15 | sonar.exclusions=dist/**,**/testdata/**,internal/web/static/fonts/** | |
| 16 | ||
| 17 | # No sonar.go.coverage.reportPaths yet. Most of this repository's coverage | |
| 18 | # comes from the e2e suite, and re-running that under -coverprofile would | |
| 19 | # double the CI time; unit-only coverage would report misleadingly low | |
| 20 | # numbers for packages e2e exercises heavily. Reporting none is more | |
| 21 | # honest than reporting the wrong number. | |