IGNITE-23820 Restore 'checkout' in sonar-pr-from-fork-build.yml

[raboof]

Follow-up on 964dc48 which removed the checkout from the pull-request workflow entirely. This should now check out the default rev (which should be the code from the PR as it was when the workflow was approved).

Thank you for submitting the pull request to the Apache Ignite.

In order to streamline the review of the contribution
we ask you to ensure the following steps have been taken:

The Contribution Checklist

• There is a single JIRA ticket related to the pull request.
• The web-link to the pull request is attached to the JIRA ticket.
• The JIRA ticket has the Patch Available state.
• The pull request body describes changes that have been made.
  The description explains WHAT and WHY was made instead of HOW.
• The pull request title is treated as the final commit message.
  The following pattern must be used: IGNITE-XXXX Change summary where XXXX - number of JIRA issue.
• A reviewer has been mentioned through the JIRA comments
  (see the Maintainers list)
• The pull request has been checked by the Teamcity Bot and
  the green visa attached to the JIRA ticket (see TC.Bot: Check PR)

Notes

• How to Contribute
• Coding abbreviation rules
• Coding Guidelines
• Apache Ignite Teamcity Bot

If you need any help, please email [email protected] or ask anу advice on http://asf.slack.com #ignite channel.

[skorotkov]

Hi Arnout Engelen,

Thanks!

Now it does the build.

I think we still need to return back the fetch of the PR's base branch (which is master in fact) from the upstream (main ignite) repo. Otherwise the Sonar would fail to detect the "new lines of code" if fork's master is not synchronized with main repo.

See details at https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/32

Do you see any security risks in fetching of the master branch from the main ignite repo?

---

I mean the following section

      - name: Checkout PR base branch
        run: |
          git remote add upstream ${{ github.event.repository.clone_url }}
          git fetch upstream
          git checkout -B $pr_base_ref upstream/$pr_base_ref
          git checkout ${{ github.event.workflow_run.head_branch }}
          git clean -ffdx && git reset --hard HEAD

[raboof]

I think that should be OK, as we trust $pr_base_ref (because it should have been reviewed). Hardcoding ${{ github.event.repository.clone_url }} and ${{ github.event.workflow_run.head_branch }} (as -) might be nice just to reduce attack surface - I guess perhaps we could even hard-code $pr_base_ref (as master)?

[skorotkov]

Yes we may hardcode the ${{ github.event.repository.clone_url }} and
replace ${{ github.event.workflow_run.head_branch }} with github.event.workflow_run.head_sha. - also may work but should be tested.

As far as the $pr_base_ref. I wouldn't hardcode it. Sometimes mainteners want to do PRs to some non-master branch which accumulates changes for some big feature. See the recent example #11618

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.0% Duplication on New Code

See analysis details on SonarQube Cloud

[skorotkov]

Looks good for me now