1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
name: Analyze PR
on:
workflow_run:
workflows:
- 'Build'
types:
- completed
permissions:
pull-requests: read
contents: read
checks: write
env:
BUILD_JAVA_VERSION: '21'
jobs:
analyze:
name: Analyze Code
# Only run on forks, in-repo PRs are analyzed directly
if: github.event.workflow_run.head_repository.owner.login != 'dnsjava'
runs-on: ubuntu-latest
steps:
- name: Download PR number artifact
id: get_pr_number
uses: dawidd6/action-download-artifact@v6
with:
workflow: ${{ github.event.workflow_run.name }}
run_id: ${{ github.event.workflow_run.id }}
name: pr_number
- name: Read Pull Request Number
id: pr_number
run: |
PR=$(cat pr_number.txt)
echo "pr_number=${PR}" >> "$GITHUB_OUTPUT"
- name: Request PR data from GitHub API
id: get_pr_data
if: steps.get_pr_number.outputs.found_artifact
uses: octokit/request-action@v2.x
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
route: GET /repos/{full_name}/pulls/{number}
full_name: ${{ github.event.repository.full_name }}
number: ${{ steps.pr_number.outputs.pr_number }}
- name: Checkout PR
uses: actions/checkout@v4
with:
repository: ${{ github.event.workflow_run.head_repository.full_name }}
ref: ${{ github.event.workflow_run.head_sha }}
persist-credentials: false
# for Sonar
fetch-depth: 0
- name: Make sure 'base' doesn't exist
shell: bash
run: rm -rf base
- name: Checkout base
uses: actions/checkout@v4
with:
repository: ${{ github.event.repository.full_name }}
ref: ${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}
persist-credentials: false
path: base
- name: Get analysis data
uses: ./base/.github/actions/prepare-analysis
- name: Run SonarQube
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
WF_REVISION: ${{ github.event.workflow_run.head_sha }}
WF_PRKEY: ${{ fromJson(steps.get_pr_data.outputs.data).number }}
WF_BRANCH: ${{ fromJson(steps.get_pr_data.outputs.data).head.ref }}
WF_BASE: ${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}
run: |
cp -f base/pom.xml .
mvn -B \
-Dsonar.scm.revision='${WF_REVISION}' \
-Dsonar.pullrequest.key='${WF_PRKEY}' \
-Dsonar.pullrequest.branch='${WF_BRANCH}' \
-Dsonar.pullrequest.base='${WF_BASE}' \
properties:read-project-properties \
org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
|
