ci: drop the sonar job and its config !444
2 files changed, +0 −80
Layout: unified · split
.gitbay/ci.yml −53
| @@ -37,56 +37,3 @@ jobs: | ||
| 37 | 37 | schedule: "0 3 * * *" |
| 38 | 38 | steps: |
| 39 | 39 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| 40 | # SonarCloud static analysis. Report-only: unlike vuln this does not | |
| 41 | # gate, so a first scan of an existing codebase does not turn every | |
| 42 | # build red before anyone has read what it says. Flip the trailing | |
| 43 | # `|| true` off to make the quality gate binding. | |
| 44 | # | |
| 45 | # Also nightly (#177). Report-only means it cannot fail a build, so | |
| 46 | # analysing every push of a branch that is about to be squashed away | |
| 47 | # informs nobody, and a stack being rebased analysed the same tree four | |
| 48 | # times. A scheduled job is registered by a default-branch push, so | |
| 49 | # this now tracks main — which is what the per-branch handling in the | |
| 50 | # step below was protecting in the first place (#154). It still works | |
| 51 | # on a branch when triggered by hand. | |
| 52 | # | |
| 53 | # One step, because each step runs in its own `sh -c` and an export | |
| 54 | # would not survive to the next. The scanner is cached under the | |
| 55 | # runner's home rather than re-downloading ~50MB per build, and the | |
| 56 | # linux-x64 bundle carries its own JRE, which is why the host needs no | |
| 57 | # Java. | |
| 58 | sonar: | |
| 59 | image: localhost/gitbay-ci:2 | |
| 60 | schedule: "30 3 * * *" | |
| 61 | steps: | |
| 62 | - | | |
| 63 | set -eu | |
| 64 | if [ -z "${SONAR_TOKEN:-}" ]; then | |
| 65 | echo "no SONAR_TOKEN in this build's environment; skipping." | |
| 66 | echo "A merge request from a fork is built without secrets on purpose," | |
| 67 | echo "so this is expected there and is not a failure." | |
| 68 | exit 0 | |
| 69 | fi | |
| 70 | VERSION=8.1.0.6389 | |
| 71 | HOME_DIR="${HOME:-/var/lib/gitbay-runner}" | |
| 72 | SCANNER="$HOME_DIR/.sonar/sonar-scanner-$VERSION-linux-x64" | |
| 73 | if [ ! -x "$SCANNER/bin/sonar-scanner" ]; then | |
| 74 | echo "installing sonar-scanner $VERSION" | |
| 75 | curl --create-dirs -fsSLo "$HOME_DIR/.sonar/sonar-scanner.zip" \ | |
| 76 | "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$VERSION-linux-x64.zip" | |
| 77 | unzip -q -o "$HOME_DIR/.sonar/sonar-scanner.zip" -d "$HOME_DIR/.sonar/" | |
| 78 | rm -f "$HOME_DIR/.sonar/sonar-scanner.zip" | |
| 79 | fi | |
| 80 | # Analyse each branch as itself. Without this every branch is | |
| 81 | # recorded against the project's main branch, so a feature branch | |
| 82 | # replaces main's results — a branch that removes findings makes | |
| 83 | # main look clean before its fix is merged, and one that adds | |
| 84 | # findings makes main look broken when it is not (#154). | |
| 85 | BRANCH="${GITBAY_REF:-}" | |
| 86 | BRANCH="${BRANCH#refs/heads/}" | |
| 87 | BRANCH_ARG="" | |
| 88 | if [ -n "$BRANCH" ] && [ "$BRANCH" != "main" ]; then | |
| 89 | BRANCH_ARG="-Dsonar.branch.name=$BRANCH" | |
| 90 | fi | |
| 91 | SONAR_HOST_URL=https://sonarcloud.io \ | |
| 92 | "$SCANNER/bin/sonar-scanner" -Dsonar.scm.revision="${GITBAY_SHA:-}" $BRANCH_ARG || true | |
sonar-project.properties deleted −27
| @@ -1,27 +0,0 @@ | ||
| 1 | # SonarCloud analysis. Only SONAR_TOKEN is a secret; it is a gitbay build | |
| 2 | # secret (`repo secret set krz/gitbay SONAR_TOKEN`, value on stdin) and | |
| 3 | # never appears here. Everything below is public configuration and is | |
| 4 | # checked in so a scan is reproducible from the repository alone. | |
| 5 | sonar.organization=krz | |
| 6 | sonar.projectKey=krz_gitbay | |
| 7 | sonar.projectName=gitbay | |
| 8 | ||
| 9 | sonar.sources=. | |
| 10 | sonar.tests=. | |
| 11 | sonar.test.inclusions=**/*_test.go | |
| 12 | ||
| 13 | # dist/ is release output, testdata is fixtures meant to be malformed, and | |
| 14 | # the fonts are third-party binaries. | |
| 15 | # | |
| 16 | # The migrations are excluded because they are SQLite and the analyser | |
| 17 | # reads .sql as PL/SQL, where '' is NULL. That turns `WHERE col = ''` on a | |
| 18 | # NOT NULL DEFAULT '' column — correct SQLite, and the shape used | |
| 19 | # throughout — into a NullComparison finding. Excluding them is the fix; | |
| 20 | # dismissing the same false positive after every migration is not. | |
| 21 | sonar.exclusions=dist/**,**/testdata/**,internal/web/static/fonts/**,internal/store/migrations/** | |
| 22 | ||
| 23 | # No sonar.go.coverage.reportPaths yet. Most of this repository's coverage | |
| 24 | # comes from the e2e suite, and re-running that under -coverprofile would | |
| 25 | # double the CI time; unit-only coverage would report misleadingly low | |
| 26 | # numbers for packages e2e exercises heavily. Reporting none is more | |
| 27 | # honest than reporting the wrong number. | |