fix: reinstate old sonarcloud.yml with current jdk fix for sonarcloud (DCD-5125) by LukasKuzavas · Pull Request #423 · genesislcap/appdev-workflows

LukasKuzavas · 2026-07-29T14:48:15Z

No description provided.

… (DCD-5125)

github-actions · 2026-07-29T14:48:33Z

🤖 Hi @LukasKuzavas, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

## 📋 Review Summary

This Pull Request aims to reinstate an older single-job version of the sonarcloud.yml workflow while retaining the JDK 21 update required for running the SonarCloud scanner. While simplifying the workflow structure is understandable, this change introduces multiple high-severity bugs, schema validation errors, and action version regressions that will break caller repositories.

🔍 General Feedback

Input Configuration Inconsistencies: Multiple inputs like working-directory and repo-name are referenced in step execution but have been deleted or omitted from the inputs block, which will break any external workflow calling this shared action.
Workflow Action Version Regressions: Several core GitHub Actions (checkout, setup-node, and gradle-build-action) were downgraded to deprecated or outdated versions, triggering Node.js runtime deprecation warnings.
Missing Sonar Cloud Configurations: The omission of GITHUB_TOKEN from the Sonar step prevents the scanner from reporting findings directly back to PR checks.

github-actions · 2026-07-29T14:50:45Z

      version:
-        description: Application version
-        required: false
-        type: string
-      working-directory:
-        description: Project working directory
        required: false
        type: string


🔴 **Critical**: The `working-directory` and `repo-name` inputs are referenced in the workflow (e.g., at lines 93 and 107) but have been completely omitted from the `inputs` declaration section. This will result in workflow schema validation errors when callers attempt to pass these inputs, or cause runtime failures because `inputs.working-directory` resolves to an empty string.

Suggested change

version:

description: Application version

required: false

type: string

working-directory:

description: Project working directory

required: false

type: string

version:

required: false

type: string

working-directory:

required: false

type: string

default: '.'

repo-name:

required: false

type: string

github-actions · 2026-07-29T14:51:03Z

+          echo "dockerPassword=${{ secrets.JFROG_PASSWORD }}" >> ~/.gradle/gradle.properties
+          echo "dockerEmail=platformmanageteam@genesis.global" >> ~/.gradle/gradle.properties
+
+          echo "genesis-home=../.genesis-home" >> ~/.gradle/gradle.properties
+          echo "deploy-plugin-mode=local" >> ~/.gradle/gradle.properties
+          sudo chmod +x ./gradlew
+          sudo chmod +x ./${{ inputs.server-path }}/gradlew
+          sudo chmod -R +rx ./${{ inputs.server-path }}/
+          cat ~/.gradle/gradle.properties >>  ./gradle.properties
+          if [ -z "${{ inputs.repo-name }}" ]; then
+            echo "REPO_NAME=$(echo '${{ github.event.repository.name }}' | cut -d'-' -f1)" >> $GITHUB_ENV
+          else
+            echo "REPO_NAME=${{ inputs.repo-name }}" >> $GITHUB_ENV
          fi
-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+          RELEASE_VERSION=$(echo "${{ inputs.version }}" | sed 's/\//-/g')
+          echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
+          sed -E -i "s/^\s{4}version = \".+\"/    version = \"${RELEASE_VERSION}\"/g" ${{ inputs.server-path }}/build.gradle.kts
+
+      - name: Server Build
+        uses: gradle/gradle-build-action@v2
        with:
+          arguments: test jacocoTestReport --no-configuration-cache


🔴 **Critical**: Multiple critical bugs and regressions have been introduced in this setup step: 1. **Unused `GRADLE_PROPERTIES`**: The environment variable `GRADLE_PROPERTIES` is declared at line 91 but never written to `~/.gradle/gradle.properties`, ignoring any custom Gradle configurations. 2. **Missing Safety Checks on `sed`**: Directly running `sed -E -i` on `${{ inputs.server-path }}/build.gradle.kts` without checking if the file or the release version exists will cause the build to fail if a project lacks a `build.gradle.kts` at that path. 3. **Insecure and Unnecessary `sudo`**: Using `sudo chmod` is unnecessary for files checked out in the runner workspace, and can fail in environments that require sudo password prompts.

Suggested change

echo "dockerPassword=${{ secrets.JFROG_PASSWORD }}" >> ~/.gradle/gradle.properties

echo "dockerEmail=platformmanageteam@genesis.global" >> ~/.gradle/gradle.properties

echo "genesis-home=../.genesis-home" >> ~/.gradle/gradle.properties

echo "deploy-plugin-mode=local" >> ~/.gradle/gradle.properties

sudo chmod +x ./gradlew

sudo chmod +x ./${{ inputs.server-path }}/gradlew

sudo chmod -R +rx ./${{ inputs.server-path }}/

cat ~/.gradle/gradle.properties >> ./gradle.properties

if [ -z "${{ inputs.repo-name }}" ]; then

echo "REPO_NAME=$(echo '${{ github.event.repository.name }}' | cut -d'-' -f1)" >> $GITHUB_ENV

else

echo "REPO_NAME=${{ inputs.repo-name }}" >> $GITHUB_ENV

fi

- name: Set up Gradle

uses: gradle/actions/setup-gradle@v4

RELEASE_VERSION=$(echo "${{ inputs.version }}" | sed 's/\//-/g')

echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV

sed -E -i "s/^\s{4}version = \".+\"/ version = \"${RELEASE_VERSION}\"/g" ${{ inputs.server-path }}/build.gradle.kts

- name: Server Build

uses: gradle/gradle-build-action@v2

with:

arguments: test jacocoTestReport --no-configuration-cache

run: |

mkdir -p ~/.gradle/

echo "GRADLE_USER_HOME=${HOME}/.gradle" >> $GITHUB_ENV

echo "genesisArtifactoryUser=${{ secrets.JFROG_USERNAME }}" > ~/.gradle/gradle.properties

echo "genesisArtifactoryPassword=${{ secrets.JFROG_PASSWORD }}" >> ~/.gradle/gradle.properties

echo "systemProp.org.gradle.internal.http.connectionTimeout=180000" >> ~/.gradle/gradle.properties

echo "systemProp.org.gradle.internal.http.socketTimeout=180000" >> ~/.gradle/gradle.properties

echo "dockerUrl=genesisglobal-docker-internal.jfrog.io" >> ~/.gradle/gradle.properties

echo "dockerUsername=${{ secrets.JFROG_USERNAME }}" >> ~/.gradle/gradle.properties

echo "dockerPassword=${{ secrets.JFROG_PASSWORD }}" >> ~/.gradle/gradle.properties

echo "dockerEmail=platformmanageteam@genesis.global" >> ~/.gradle/gradle.properties

echo "genesis-home=../.genesis-home" >> ~/.gradle/gradle.properties

echo "deploy-plugin-mode=local" >> ~/.gradle/gradle.properties

if [ -n "${GRADLE_PROPERTIES:-}" ]; then

printf '%s\n' "${GRADLE_PROPERTIES}" >> ~/.gradle/gradle.properties

fi

chmod +x ./gradlew

chmod +x ./${{ inputs.server-path }}/gradlew

chmod -R +rx ./${{ inputs.server-path }}/

cat ~/.gradle/gradle.properties >> ./gradle.properties

if [ -z "${{ inputs.repo-name }}" ]; then

echo "REPO_NAME=$(echo '${{ github.event.repository.name }}' | cut -d'-' -f1)" >> $GITHUB_ENV

else

echo "REPO_NAME=${{ inputs.repo-name }}" >> $GITHUB_ENV

fi

RELEASE_VERSION=$(echo "${{ inputs.version }}" | sed 's/\//-/g')

echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV

BUILD_FILE="${{ inputs.server-path }}/build.gradle.kts"

if [ -n "${RELEASE_VERSION}" ] && [ -f "${BUILD_FILE}" ]; then

sed -E -i "s/^\s{4}version = \".+\"/ version = \"${RELEASE_VERSION}\"/g" "${BUILD_FILE}"

fi

github-actions · 2026-07-29T14:51:32Z

        env:
-          GRADLE_PROPERTIES: ${{ secrets.GRADLE_PROPERTIES }}
-        run: |
-          set -euo pipefail
-          mkdir -p "${HOME}/.gradle"
-          echo "GRADLE_USER_HOME=${HOME}/.gradle" >> "${GITHUB_ENV}"
-          {
-            echo "genesisArtifactoryUser=${{ secrets.JFROG_USERNAME }}"
-            echo "genesisArtifactoryPassword=${{ secrets.JFROG_PASSWORD }}"
-            echo "systemProp.org.gradle.internal.http.connectionTimeout=180000"
-            echo "systemProp.org.gradle.internal.http.socketTimeout=180000"
-            echo "dockerUrl=genesisglobal-docker-internal.jfrog.io"
-            echo "dockerUsername=${{ secrets.JFROG_USERNAME }}"
-            echo "dockerPassword=${{ secrets.JFROG_PASSWORD }}"
-            echo "dockerEmail=${{ secrets.JFROG_EMAIL }}"
-            echo "genesis-home=../.genesis-home"
-            echo "deploy-plugin-mode=local"
-          } > "${HOME}/.gradle/gradle.properties"
-          if [ -n "${GRADLE_PROPERTIES:-}" ]; then
-            printf '%s\n' "${GRADLE_PROPERTIES}" >> "${HOME}/.gradle/gradle.properties"
-          fi
-          if [ -f ./gradlew ]; then
-            chmod +x ./gradlew
-          fi
-          if [ -f "./${{ inputs.server-path }}/gradlew" ]; then
-            chmod +x "./${{ inputs.server-path }}/gradlew"
-          fi
-          if [ -d "./${{ inputs.server-path }}" ]; then
-            chmod -R +rx "./${{ inputs.server-path }}"
-          fi
-          cat "${HOME}/.gradle/gradle.properties" >> ./gradle.properties
-          RELEASE_VERSION="$(echo '${{ inputs.version }}' | sed 's/\//-/g')"
-          BUILD_FILE="${{ inputs.server-path }}/build.gradle.kts"
-          if [ -n "${RELEASE_VERSION}" ] && [ -f "${BUILD_FILE}" ]; then
-            sed -E -i "s/^[[:space:]]{4}version = \".+\"/    version = \"${RELEASE_VERSION}\"/g" "${BUILD_FILE}"
-          fi
-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+          SONAR_TOKEN: ${{ secrets.JENKINSGENESIS_SONAR }}


sky 🟠 **High**: The `GITHUB_TOKEN` environment variable is missing from the SonarCloud analysis step. Without `GITHUB_TOKEN: ${{ github.token }}` defined, the SonarCloud scanner will fail to authenticate with GitHub, which will prevent it from posting pull request decorations and quality gate status updates.

Suggested change

env:

GRADLE_PROPERTIES: ${{ secrets.GRADLE_PROPERTIES }}

run: |

set -euo pipefail

mkdir -p "${HOME}/.gradle"

echo "GRADLE_USER_HOME=${HOME}/.gradle" >> "${GITHUB_ENV}"

{

echo "genesisArtifactoryUser=${{ secrets.JFROG_USERNAME }}"

echo "genesisArtifactoryPassword=${{ secrets.JFROG_PASSWORD }}"

echo "systemProp.org.gradle.internal.http.connectionTimeout=180000"

echo "systemProp.org.gradle.internal.http.socketTimeout=180000"

echo "dockerUrl=genesisglobal-docker-internal.jfrog.io"

echo "dockerUsername=${{ secrets.JFROG_USERNAME }}"

echo "dockerPassword=${{ secrets.JFROG_PASSWORD }}"

echo "dockerEmail=${{ secrets.JFROG_EMAIL }}"

echo "genesis-home=../.genesis-home"

echo "deploy-plugin-mode=local"

} > "${HOME}/.gradle/gradle.properties"

if [ -n "${GRADLE_PROPERTIES:-}" ]; then

printf '%s\n' "${GRADLE_PROPERTIES}" >> "${HOME}/.gradle/gradle.properties"

fi

if [ -f ./gradlew ]; then

chmod +x ./gradlew

fi

if [ -f "./${{ inputs.server-path }}/gradlew" ]; then

chmod +x "./${{ inputs.server-path }}/gradlew"

fi

if [ -d "./${{ inputs.server-path }}" ]; then

chmod -R +rx "./${{ inputs.server-path }}"

fi

cat "${HOME}/.gradle/gradle.properties" >> ./gradle.properties

RELEASE_VERSION="$(echo '${{ inputs.version }}' | sed 's/\//-/g')"

BUILD_FILE="${{ inputs.server-path }}/build.gradle.kts"

if [ -n "${RELEASE_VERSION}" ] && [ -f "${BUILD_FILE}" ]; then

sed -E -i "s/^[[:space:]]{4}version = \".+\"/ version = \"${RELEASE_VERSION}\"/g" "${BUILD_FILE}"

fi

- name: Set up Gradle

uses: gradle/actions/setup-gradle@v4

SONAR_TOKEN: ${{ secrets.JENKINSGENESIS_SONAR }}

env:

SONAR_TOKEN: ${{ secrets.JENKINSGENESIS_SONAR }}

GITHUB_TOKEN: ${{ github.token }}

github-actions · 2026-07-29T14:51:40Z

-        uses: gradle/actions/setup-gradle@v4
+          SONAR_TOKEN: ${{ secrets.JENKINSGENESIS_SONAR }}
        with:
+          arguments: sonarqube --no-configuration-cache -Dsonar.token=${{env.SONAR_TOKEN}}


🟡 **Medium**: Running the `sonarqube` analysis step directly with JDK 21 active on the path (without `-Dsonar.gradle.skipCompile=true`) poses a risk of re-triggering Gradle tasks and re-compiling source files using the JDK 21 compiler. If the project does not have a hardcoded Java toolchain configured, this can lead to bytecode version mismatches (e.g., classes compiled with Java 21 running in a Java 17 environment). Since compilation and testing were already completed in the previous step, passing `-Dsonar.gradle.skipCompile=true` ensures Gradle uses the existing compilation outputs.

Suggested change

arguments: sonarqube --no-configuration-cache -Dsonar.token=${{env.SONAR_TOKEN}}

arguments: sonarqube --no-configuration-cache -Dsonar.token=${{env.SONAR_TOKEN}} -Dsonar.gradle.skipCompile=true

github-actions · 2026-07-29T14:51:47Z

    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v3


🟡 **Medium**: Reverting from `actions/checkout@v4` to `actions/checkout@v3` is a regression. GitHub Actions has deprecated Node.js 16, which is used internally by `@v3` of checkout, resulting in deprecation warnings during pipeline execution. Upgrading to `@v4` ensures compatibility and uses the supported Node.js 20 runner.

Suggested change

- uses: actions/checkout@v3

- uses: actions/checkout@v4

github-actions · 2026-07-29T14:51:54Z

+        uses: actions/setup-node@v2
        with:
          node-version: ${{ inputs.node_version }}
-      - name: Configure Node if using JFrog npm packages
+
+      - name: Configure Node if using JFROG npm packages
        if: ${{ inputs.REGISTRY_URL }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v2
        with:
          node-version: ${{ inputs.node_version }}
          registry-url: ${{ inputs.REGISTRY_URL }}
          scope: ${{ inputs.SCOPE }}


🟡 **Medium**: Reverting from `actions/setup-node@v4` to `actions/setup-node@v2` is a regression. Version `@v2` runs on the deprecated Node.js 16 runtime and lacks important caching features, security fixes, and performance improvements available in `@v4`.

Suggested change

uses: actions/setup-node@v2

with:

node-version: ${{ inputs.node_version }}

- name: Configure Node if using JFrog npm packages

- name: Configure Node if using JFROG npm packages

if: ${{ inputs.REGISTRY_URL }}

uses: actions/setup-node@v4

uses: actions/setup-node@v2

with:

node-version: ${{ inputs.node_version }}

registry-url: ${{ inputs.REGISTRY_URL }}

scope: ${{ inputs.SCOPE }}

- name: Configure Node

if: ${{ !inputs.REGISTRY_URL }}

uses: actions/setup-node@v4

with:

node-version: ${{ inputs.node_version }}

- name: Configure Node if using JFROG npm packages

if: ${{ inputs.REGISTRY_URL }}

uses: actions/setup-node@v4

with:

node-version: ${{ inputs.node_version }}

registry-url: ${{ inputs.REGISTRY_URL }}

scope: ${{ inputs.SCOPE }}

github-actions · 2026-07-29T14:52:00Z

+          sed -E -i "s/^\s{4}version = \".+\"/    version = \"${RELEASE_VERSION}\"/g" ${{ inputs.server-path }}/build.gradle.kts
+
+      - name: Server Build
+        uses: gradle/gradle-build-action@v2


🟡 **Medium**: The action `gradle/gradle-build-action` is deprecated in favor of `gradle/actions/setup-gradle`. Migrating to `gradle/actions/setup-gradle@v4` provides better performance, more robust caching, and official support from Gradle, while removing runtime deprecation warnings.

Suggested change

uses: gradle/gradle-build-action@v2

- name: Server Build

uses: gradle/actions/setup-gradle@v4

github-actions · 2026-07-29T14:52:04Z

+          distribution: 'temurin'
+
+      - name: SonarCloud analysis
+        uses: gradle/gradle-build-action@v2


🟡 **Medium**: Reverting to the deprecated `gradle/gradle-build-action@v2` is a regression. Using the official `gradle/actions/setup-gradle@v4` is recommended to avoid deprecation warnings and ensure long-term support.

Suggested change

uses: gradle/gradle-build-action@v2

- name: SonarCloud analysis

uses: gradle/actions/setup-gradle@v4

fix: reinstate old sonarcloud.yml with current jdk fix for sonarcloud…

6116cc4

… (DCD-5125)

LukasKuzavas self-assigned this Jul 29, 2026

LukasKuzavas requested review from Namitha-genesis, Tanmay-Genesis, abhinav-genesis, perryking and pmakwanalcap as code owners July 29, 2026 14:48

github-actions Bot reviewed Jul 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: reinstate old sonarcloud.yml with current jdk fix for sonarcloud (DCD-5125) - #423

fix: reinstate old sonarcloud.yml with current jdk fix for sonarcloud (DCD-5125)#423
LukasKuzavas wants to merge 1 commit into
developfrom
lukask/DCD-5125-java-version-compat

LukasKuzavas commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

github-actions Bot Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	arguments: sonarqube --no-configuration-cache -Dsonar.token=${{env.SONAR_TOKEN}}
	arguments: sonarqube --no-configuration-cache -Dsonar.token=${{env.SONAR_TOKEN}} -Dsonar.gradle.skipCompile=true

	uses: gradle/gradle-build-action@v2
	- name: Server Build
	uses: gradle/actions/setup-gradle@v4

	uses: gradle/gradle-build-action@v2
	- name: SonarCloud analysis
	uses: gradle/actions/setup-gradle@v4

Uh oh!

Conversation

LukasKuzavas commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

🔍 General Feedback

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant