ci: drop the sonar job and its config !444
2 files changed, +0 −80
Layout: unified · split
.gitbay/ci.yml −53
| @@ -37,56 +37,3 @@ jobs: | |||
| 37 | schedule: "0 3 * * *" | 37 | schedule: "0 3 * * *" |
| 38 | steps: | 38 | steps: |
| 39 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... | 39 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| 40 | # SonarCloud static analysis. Report-only: unlike vuln this does not | ||
| 41 | # gate, so a first scan of an existing codebase does not turn every | ||
| 42 | # build red before anyone has read what it says. Flip the trailing | ||
| 43 | # `|| true` off to make the quality gate binding. | ||
| 44 | # | ||
| 45 | # Also nightly (#177). Report-only means it cannot fail a build, so | ||
| 46 | # analysing every push of a branch that is about to be squashed away | ||
| 47 | # informs nobody, and a stack being rebased analysed the same tree four | ||
| 48 | # times. A scheduled job is registered by a default-branch push, so | ||
| 49 | # this now tracks main — which is what the per-branch handling in the | ||
| 50 | # step below was protecting in the first place (#154). It still works | ||
| 51 | # on a branch when triggered by hand. | ||
| 52 | # | ||
| 53 | # One step, because each step runs in its own `sh -c` and an export | ||
| 54 | # would not survive to the next. The scanner is cached under the | ||
| 55 | # runner's home rather than re-downloading ~50MB per build, and the | ||
| 56 | # linux-x64 bundle carries its own JRE, which is why the host needs no | ||
| 57 | # Java. | ||
| 58 | sonar: | ||
| 59 | image: localhost/gitbay-ci:2 | ||
| 60 | schedule: "30 3 * * *" | ||
| 61 | steps: | ||
| 62 | - | | ||
| 63 | set -eu | ||
| 64 | if [ -z "${SONAR_TOKEN:-}" ]; then | ||
| 65 | echo "no SONAR_TOKEN in this build's environment; skipping." | ||
| 66 | echo "A merge request from a fork is built without secrets on purpose," | ||
| 67 | echo "so this is expected there and is not a failure." | ||
| 68 | exit 0 | ||
| 69 | fi | ||
| 70 | VERSION=8.1.0.6389 | ||
| 71 | HOME_DIR="${HOME:-/var/lib/gitbay-runner}" | ||
| 72 | SCANNER="$HOME_DIR/.sonar/sonar-scanner-$VERSION-linux-x64" | ||
| 73 | if [ ! -x "$SCANNER/bin/sonar-scanner" ]; then | ||
| 74 | echo "installing sonar-scanner $VERSION" | ||
| 75 | curl --create-dirs -fsSLo "$HOME_DIR/.sonar/sonar-scanner.zip" \ | ||
| 76 | "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$VERSION-linux-x64.zip" | ||
| 77 | unzip -q -o "$HOME_DIR/.sonar/sonar-scanner.zip" -d "$HOME_DIR/.sonar/" | ||
| 78 | rm -f "$HOME_DIR/.sonar/sonar-scanner.zip" | ||
| 79 | fi | ||
| 80 | # Analyse each branch as itself. Without this every branch is | ||
| 81 | # recorded against the project's main branch, so a feature branch | ||
| 82 | # replaces main's results — a branch that removes findings makes | ||
| 83 | # main look clean before its fix is merged, and one that adds | ||
| 84 | # findings makes main look broken when it is not (#154). | ||
| 85 | BRANCH="${GITBAY_REF:-}" | ||
| 86 | BRANCH="${BRANCH#refs/heads/}" | ||
| 87 | BRANCH_ARG="" | ||
| 88 | if [ -n "$BRANCH" ] && [ "$BRANCH" != "main" ]; then | ||
| 89 | BRANCH_ARG="-Dsonar.branch.name=$BRANCH" | ||
| 90 | fi | ||
| 91 | SONAR_HOST_URL=https://sonarcloud.io \ | ||
| 92 | "$SCANNER/bin/sonar-scanner" -Dsonar.scm.revision="${GITBAY_SHA:-}" $BRANCH_ARG || true | ||
sonar-project.properties deleted −27
| @@ -1,27 +0,0 @@ | |||
| 1 | # SonarCloud analysis. Only SONAR_TOKEN is a secret; it is a gitbay build | ||
| 2 | # secret (`repo secret set krz/gitbay SONAR_TOKEN`, value on stdin) and | ||
| 3 | # never appears here. Everything below is public configuration and is | ||
| 4 | # checked in so a scan is reproducible from the repository alone. | ||
| 5 | sonar.organization=krz | ||
| 6 | sonar.projectKey=krz_gitbay | ||
| 7 | sonar.projectName=gitbay | ||
| 8 | |||
| 9 | sonar.sources=. | ||
| 10 | sonar.tests=. | ||
| 11 | sonar.test.inclusions=**/*_test.go | ||
| 12 | |||
| 13 | # dist/ is release output, testdata is fixtures meant to be malformed, and | ||
| 14 | # the fonts are third-party binaries. | ||
| 15 | # | ||
| 16 | # The migrations are excluded because they are SQLite and the analyser | ||
| 17 | # reads .sql as PL/SQL, where '' is NULL. That turns `WHERE col = ''` on a | ||
| 18 | # NOT NULL DEFAULT '' column — correct SQLite, and the shape used | ||
| 19 | # throughout — into a NullComparison finding. Excluding them is the fix; | ||
| 20 | # dismissing the same false positive after every migration is not. | ||
| 21 | sonar.exclusions=dist/**,**/testdata/**,internal/web/static/fonts/**,internal/store/migrations/** | ||
| 22 | |||
| 23 | # No sonar.go.coverage.reportPaths yet. Most of this repository's coverage | ||
| 24 | # comes from the e2e suite, and re-running that under -coverprofile would | ||
| 25 | # double the CI time; unit-only coverage would report misleadingly low | ||
| 26 | # numbers for packages e2e exercises heavily. Reporting none is more | ||
| 27 | # honest than reporting the wrong number. | ||