Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 34 additions & 1 deletion .github/workflows/build-gradle-g8.yml
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,8 @@ env:
jobs:
build-server:
runs-on: [ appdev-selfhosted-al2023 ]
outputs:
sonar-inputs-artifact: ${{ steps.set_sonar_artifact.outputs.name }}
steps:
- uses: actions/checkout@v3
with:
Expand Down Expand Up @@ -322,6 +324,34 @@ jobs:
env:
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

- name: Generate JaCoCo reports for Sonar
if: inputs.sonar_enabled
uses: gradle/gradle-build-action@v2
with:
arguments: jacocoTestReport ${{ env.CACHE_OPTS }} --stacktrace -Pversion=${{ env.BUILD_VERSION }} -PpushToCache=${{ env.GRADLE_GENESIS_PUSH_TO_CACHE }} -PdisableRemoteCache=${{ env.GRADLE_GENESIS_DISABLE_REMOTE_CACHE }} ${{ inputs.server-build-gradle-arguments }}
build-root-directory: "${{ inputs.working-directory }}/server"
cache-disabled: true

- name: Upload Sonar inputs
if: inputs.sonar_enabled
uses: actions/upload-artifact@v4
with:
name: sonar-inputs-${{ github.run_id }}
retention-days: 1
if-no-files-found: error
path: |
${{ inputs.working-directory }}/server/**/build/classes/**
${{ inputs.working-directory }}/server/**/build/generated/**
${{ inputs.working-directory }}/server/**/build/reports/**
${{ inputs.working-directory }}/server/**/build/test-results/**
${{ inputs.working-directory }}/server/**/build/jacoco/**
${{ inputs.working-directory }}/server/build/**/reports/**
${{ inputs.working-directory }}/server/build/**/jacoco/**

- name: Record Sonar inputs artifact name
if: inputs.sonar_enabled
id: set_sonar_artifact
run: echo "name=sonar-inputs-${{ github.run_id }}" >> "$GITHUB_OUTPUT"

- name: Check Auth Permissions task
id: auth_permissions_task
Expand Down Expand Up @@ -483,15 +513,18 @@ jobs:

sonar:
name: SonarCloud Analysis
needs: build-server
if: ${{ inputs.sonar_enabled }}
uses: ./.github/workflows/sonarcloud.yml
with:
branch: ${{ inputs.branch }}
version: ${{ inputs.version }}
server-path: '${{ inputs.working-directory }}/server'
working-directory: ${{ inputs.working-directory }}
server-path: server
node_version: ${{ inputs.node_version }}
REGISTRY_URL: ${{ inputs.REGISTRY_URL }}
SCOPE: ${{ inputs.SCOPE }}
sonar-inputs-artifact: ${{ needs.build-server.outputs.sonar-inputs-artifact }}
secrets:
GPR_READ_TOKEN: ${{ secrets.GPR_READ_TOKEN }}
GRADLE_PROPERTIES: ${{ secrets.GRADLE_PROPERTIES }}
Expand Down
42 changes: 32 additions & 10 deletions .github/workflows/sonarcloud.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ on:
type: string
default: '.'
server-path:
description: Path containing the server Gradle wrapper
description: Path containing the server Gradle wrapper (relative to working-directory)
required: false
type: string
default: 'server'
Expand All @@ -39,6 +39,13 @@ on:
description: NPM scope used with REGISTRY_URL
required: false
type: string
sonar-inputs-artifact:
description: >-
Optional artifact name containing classes/coverage/test results from a prior build.
When set, prepare-analysis skips re-running tests and reuses this artifact.
required: false
type: string
default: ''
secrets:
GPR_READ_TOKEN:
required: true
Expand All @@ -55,11 +62,13 @@ on:

env:
NODE_AUTH_TOKEN: ${{ secrets.GPR_READ_TOKEN }}
SONAR_ARTIFACT_NAME: sonar-inputs-${{ github.run_id }}
SONAR_ARTIFACT_NAME: ${{ inputs.sonar-inputs-artifact != '' && inputs.sonar-inputs-artifact || format('sonar-inputs-{0}', github.run_id) }}
SERVER_DIR: ${{ inputs.working-directory == '.' && inputs.server-path || format('{0}/{1}', inputs.working-directory, inputs.server-path) }}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 To ensure robust handling of various inputs (such as an empty string `""` or `./` directory paths), we should extend the check for `inputs.working-directory`.

If inputs.working-directory is passed as an empty string, the expression currently falls back to format('{0}/{1}', '', 'server') which evaluates to /server (an absolute path pointing to root instead of a relative project path). Checking for empty strings and ./ will prevent this edge-case failure.

Suggested change
SERVER_DIR: ${{ inputs.working-directory == '.' && inputs.server-path || format('{0}/{1}', inputs.working-directory, inputs.server-path) }}
SERVER_DIR: ${{ (inputs.working-directory == '.' || inputs.working-directory == '' || inputs.working-directory == './') && inputs.server-path || format('{0}/{1}', inputs.working-directory, inputs.server-path) }}


jobs:
prepare-analysis:
name: Prepare Sonar inputs
if: ${{ inputs.sonar-inputs-artifact == '' }}
runs-on: [appdev-selfhosted-al2023]
steps:
- name: Checkout repository
Expand Down Expand Up @@ -123,7 +132,7 @@ jobs:
with:
cache-disabled: true
- name: Run tests and generate coverage
working-directory: "${{ inputs.working-directory }}/${{ inputs.server-path }}"
working-directory: ${{ env.SERVER_DIR }}
shell: bash
run: |
set -euo pipefail
Expand All @@ -135,22 +144,33 @@ jobs:
retention-days: 1
if-no-files-found: error
path: |
${{ inputs.working-directory }}/${{ inputs.server-path }}/**/build/classes/**
${{ inputs.working-directory }}/${{ inputs.server-path }}/**/build/generated/**
${{ inputs.working-directory }}/${{ inputs.server-path }}/**/build/reports/**
${{ inputs.working-directory }}/${{ inputs.server-path }}/**/build/test-results/**
${{ inputs.working-directory }}/${{ inputs.server-path }}/**/build/jacoco/**
${{ env.SERVER_DIR }}/**/build/classes/**
${{ env.SERVER_DIR }}/**/build/generated/**
${{ env.SERVER_DIR }}/**/build/reports/**
${{ env.SERVER_DIR }}/**/build/test-results/**
${{ env.SERVER_DIR }}/**/build/jacoco/**
${{ env.SERVER_DIR }}/build/**/reports/**
${{ env.SERVER_DIR }}/build/**/jacoco/**

sonar-analysis:
name: SonarCloud analysis
needs: prepare-analysis
# Prepare is skipped when the caller already uploaded Sonar inputs; still run analysis.
if: ${{ !cancelled() && (needs.prepare-analysis.result == 'success' || (needs.prepare-analysis.result == 'skipped' && inputs.sonar-inputs-artifact != '')) }}
runs-on: [appdev-selfhosted-al2023]
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ inputs.branch }}
# Project toolchain JDK must be present even with skipCompile — Gradle still
# configures compileJava and resolves dependencies against languageVersion.
- name: Set up project JDK
uses: actions/setup-java@v4
with:
java-version: ${{ inputs.project_java_version }}
distribution: temurin
- name: Set up JDK 21 for Sonar
uses: actions/setup-java@v4
with:
Expand Down Expand Up @@ -217,11 +237,13 @@ jobs:
name: ${{ env.SONAR_ARTIFACT_NAME }}
path: ${{ github.workspace }}
- name: Run SonarCloud analysis
working-directory: "${{ inputs.working-directory }}/${{ inputs.server-path }}"
working-directory: ${{ env.SERVER_DIR }}
shell: bash
env:
SONAR_TOKEN: ${{ secrets.JENKINSGENESIS_SONAR }}
GITHUB_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
./gradlew sonar --no-configuration-cache --stacktrace -Dsonar.token="${SONAR_TOKEN}"
./gradlew sonar --no-configuration-cache --stacktrace \
-Dsonar.gradle.skipCompile=true \
-Dsonar.token="${SONAR_TOKEN}"