ci: set up SonarCloud analysis and Rust coverage upload#57
Conversation
- sonar-project.properties: projectKey/organization, 소스 경로, lcov 리포트 경로 설정 - .github/workflows/sonar.yml: bun lcov + cargo-llvm-cov 생성 후 SonarCloud 스캔 - Rust는 minimal 툴체인이라 llvm-tools-preview 컴포넌트 추가 스텝 포함
영문/한국어 README 동기화
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a new ChangesCode Quality and Coverage Integration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request integrates SonarCloud by adding Quality Gate badges to the README files and creating a sonar-project.properties configuration file. The review feedback correctly points out that SonarCloud does not support sonar.rust.lcov.reportPaths for Rust coverage, and suggests using sonar.coverageReportPaths with a generic XML format instead.
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| Security | 1 critical |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
- sonar.yml: cargo llvm-cov 결과(rust-lcov.info)를 flag=rust 로 Codecov 업로드 - ci.yml: 기존 TS 업로드에 flag=typescript 추가하여 언어별 분리
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found and verified against the latest diff
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/sonar.yml">
<violation number="1" location=".github/workflows/sonar.yml:6">
P3: Restore the missing `amondnet/**` push branch pattern.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
- flags: typescript(src/)·rust(crates/) 정의 + carryforward 활성화 - component_management: TypeScript·Rust 컴포넌트로 UI/코멘트 분리 집계 - comment 레이아웃에 components 추가
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/sonar.yml (1)
20-24: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable checkout credential persistence for downstream steps.
At Line 21,
actions/checkoutkeeps credentials in local git config by default. Setpersist-credentials: falseto reduce token exposure surface.Suggested hardening
- name: Checkout code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: # Full history so SonarQube Cloud can attribute new code / blame. fetch-depth: 0 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/sonar.yml around lines 20 - 24, The Checkout code step in the sonar workflow is leaving git credentials persisted by default, so update the actions/checkout usage to disable credential persistence for downstream steps. In the Checkout code step, add the persist-credentials setting set to false alongside fetch-depth, keeping the existing checkout action reference intact.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/sonar.yml:
- Around line 66-69: Skip the SonarQube Cloud scan step when SONAR_TOKEN is not
available, since the SonarQube Cloud scan in sonar.yml will fail on forked
pull_request runs without repository secrets. Update the SonarQube Cloud scan
job/step so it is gated by a condition that checks for SONAR_TOKEN or otherwise
runs only in a trusted context, using the existing SonarQube Cloud scan step as
the target for the fix. If needed, move the analysis to a workflow_run-based
flow so external PRs do not block on missing secrets.
---
Nitpick comments:
In @.github/workflows/sonar.yml:
- Around line 20-24: The Checkout code step in the sonar workflow is leaving git
credentials persisted by default, so update the actions/checkout usage to
disable credential persistence for downstream steps. In the Checkout code step,
add the persist-credentials setting set to false alongside fetch-depth, keeping
the existing checkout action reference intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: dc7a07e3-c9ed-4b93-b4a2-021348051c6b
📒 Files selected for processing (6)
.github/workflows/ci.yml.github/workflows/sonar.ymlREADME.ko.mdREADME.mdcodecov.ymlsonar-project.properties
# Conflicts: # .github/workflows/ci.yml
- sonar.yml: pull-requests: read 권한 추가 (cubic) - sonar.yml: fork PR에서 SONAR_TOKEN 미존재 시 스캔 스킵 (coderabbit)
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/sonar.yml (1)
20-21: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winScope
SONAR_TOKENto the Sonar step only.Current job-level env exposes the secret to all steps. Keep only a non-secret gate at job scope and pass
SONAR_TOKENonly to the scan step.Suggested change
sonar: runs-on: ubuntu-latest env: - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + HAS_SONAR_TOKEN: ${{ secrets.SONAR_TOKEN != '' }} @@ - name: SonarQube Cloud scan - if: ${{ env.SONAR_TOKEN != '' }} + if: ${{ env.HAS_SONAR_TOKEN == 'true' }} uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}Also applies to: 60-63
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/sonar.yml around lines 20 - 21, The job-level env currently exposes SONAR_TOKEN to every step in the Sonar workflow; move the secret out of the global environment and apply it only to the Sonar scan step. Keep any non-secret gating at job scope, and update the relevant step in sonar.yml so the secret is referenced only where the scan runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/sonar.yml:
- Around line 20-21: The job-level env currently exposes SONAR_TOKEN to every
step in the Sonar workflow; move the secret out of the global environment and
apply it only to the Sonar scan step. Keep any non-secret gating at job scope,
and update the relevant step in sonar.yml so the secret is referenced only where
the scan runs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 44f6c44c-e192-4993-bde0-34d69e32f186
📒 Files selected for processing (5)
.github/workflows/sonar.ymlREADME.ko.mdREADME.mdcodecov.ymlsonar-project.properties
✅ Files skipped from review due to trivial changes (2)
- sonar-project.properties
- README.md
amondnet
changed the title
- sonar.yml: fork PR에서만 스캔 스킵, push(main)은 토큰 누락 시 실패 (cubic)
|
1 participant
Summary
Set up SonarCloud (sonarcloud.io) code-quality analysis in CI, upload Rust coverage to both Codecov and SonarCloud, and add a SonarCloud Quality Gate badge to the READMEs.
Changes
Badge (
README.md/README.ko.md)SonarCloud project config (
sonar-project.properties, new)sonar.projectKey=pleaseai_code-search,sonar.organization=pleaseaisonar.sources=crates(the implementation is the Rust workspace)sonar.exclusions=npm/**,dist/**,target/**,node_modules/**(mirrors.codacy.yaml)sonar.rust.lcov.reportPaths=coverage/rust-lcov.info— the language-specific Rust LCOV property officially supported by SonarQube CloudCI workflow (
.github/workflows/sonar.yml, new)push(main) +pull_request; PR concurrency cancellation.contents: read+pull-requests: read(PR analysis/decoration).cargo llvm-cov --workspace --locked --all-features --lcov(network-gated#[ignore]tests stay excluded; adds thellvm-tools-previewcomponent for theminimaltoolchain).flags: rust.SonarSource/sonarqube-scan-action@v8.2.0(pinned by SHA).if: ${{ env.SONAR_TOKEN != '' }}(withSONAR_TOKENhoisted to job-levelenv, since thesecretscontext isn't available in stepif:), so PRs from forks without secrets are skipped instead of failing.Codecov config (
codecov.yml)rustflag (paths: crates/,carryforward: true).Rustcomponent (crates/**) and surface components in PR comments.Test plan
Sonarworkflow runs: Rust coverage → Codecov upload → SonarCloud scan.The CI scan will fail until all three are done:
SONAR_TOKENsecret — GitHub repo (or org) Settings → Secrets and variables → Actions; use a token issued from SonarCloud.pleaseai, project keypleaseai_code-search(import via "Analyze new project" if missing)."You are running CI analysis while Automatic Analysis is enabled".Summary by cubic
Set up SonarCloud analysis for the Rust workspace and upload Rust coverage to Codecov. Adds a SonarCloud Quality Gate badge to both READMEs, and skips scans only on fork PRs without secrets (push to main fails fast if the token is missing).
New Features
sonar.sources=crates, exclusions (npm/**,dist/**,target/**,node_modules/**), andsonar.rust.lcov.reportPaths=coverage/rust-lcov.info..github/workflows/sonar.yml): generate Rust LCOV viacargo llvm-cov, installllvm-tools-preview, upload to Codecov withflags: rust, runSonarSource/sonarqube-scan-action@v8.2.0; addpull-requests: read, PR concurrency cancel; skip scan only on fork PRs withoutSONAR_TOKEN(push tomainruns and fails if missing).codecov.yml): addflags.rustwith carryforward and a Rust component; include components in PR comments.README.mdandREADME.ko.md.Migration
SONAR_TOKENin GitHub Actions secrets.pleaseai, keypleaseai_code-search.Written for commit 20bb022. Summary will update on new commits.
Summary by CodeRabbit
New Features
Chores