-
Notifications
You must be signed in to change notification settings - Fork 13
71 lines (62 loc) · 2.67 KB
/
sonar.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
# This workflow helps you trigger a SonarCloud analysis of your code and populates
# GitHub Code Scanning alerts with the vulnerabilities found.
# Free for open source project.
name: sonar
on:
workflow_call:
inputs:
python-version:
description: 'Python Version'
required: true
type: string
secrets:
SONAR_TOKEN:
required: true
permissions:
pull-requests: read # allows SonarCloud to decorate PRs with analysis results
jobs:
run_analysis:
runs-on: ubuntu-latest
steps:
- name: Checkout the project from Git
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Install StartLeft
uses: ./.github/actions/install-startleft
with:
python-version: ${{ inputs.python-version }}
- name: Run test using coverage
run: coverage run -m pytest
- name: Generate coverage report
run: coverage xml
- name: Analyze with SonarCloud
# You can pin the exact commit or the version.
# uses: SonarSource/sonarcloud-github-action@commithas or tag
uses: SonarSource/sonarcloud-github-action@49e6cd3b187936a73b8280d59ffd9da69df63ec9 #v2.1.1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Generate a token on Sonarcloud.io, add it to the secrets of this repo with the name SONAR_TOKEN (Settings > Secrets > Actions > add new repository secret)
with:
# Additional arguments for the sonarcloud scanner
args:
-Dsonar.projectKey=startleft
-Dsonar.organization=continuumsec
-Dsonar.python.version=3.9,3.10,3.11
-Dsonar.qualitygate.wait=true
-Dsonar.python.coverage.reportPaths=coveragereport/coverage.xml
# Args explanation
# Unique keys of your project and organization. You can find them in SonarCloud > Information (bottom-left menu)
# mandatory
# -Dsonar.projectKey=
# -Dsonar.organization=
# Version of supported python versions to get a more precise analysis
# -Dsonar.python.version=
# Flag to way for Analysis Quality Gate results, if fail the steps it will be marked as failed too.
# -Dsonar.qualitygate.wait=
# The path for coverage report to use in the SonarCloud analysis, it must be in XML format.
# -Dsonar.python.coverage.reportPaths=