Skip to content

Commit edfd783

Browse files
gnodetclaude
gnodet
and
claude
authored
CAMEL-23274: Re-add SonarCloud PR analysis workflows with correct token (#22446)
Use SONARCLOUD_TOKEN (ASF org-level secret) instead of SONAR_TOKEN (stale repo-level secret from 2022) which was causing HTTP 403 errors. Co-authored-by: Claude Opus 4.6 <[email protected]>
1 parent 208eff8 commit edfd783

File tree

2 files changed

+253
-0
lines changed

2 files changed

+253
-0
lines changed

‎.github/workflows/sonar-build.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
name: SonarBuild
19+
20+
on:
21+
pull_request:
22+
branches:
23+
- main
24+
paths-ignore:
25+
- README.md
26+
- SECURITY.md
27+
- Jenkinsfile
28+
- Jenkinsfile.*
29+
- NOTICE.txt
30+
31+
permissions:
32+
contents: read
33+
34+
concurrency:
35+
group: sonar-pr-${{ github.event.pull_request.head.repo.full_name }}-${{ github.event.pull_request.head.ref }}
36+
cancel-in-progress: true
37+
38+
jobs:
39+
build:
40+
if: github.repository == 'apache/camel'
41+
name: Build for Sonar Analysis
42+
runs-on: ubuntu-latest
43+
steps:
44+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
45+
with:
46+
persist-credentials: false
47+
48+
- id: install-packages
49+
uses: ./.github/actions/install-packages
50+
51+
- name: Set up JDK 21
52+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
53+
with:
54+
distribution: 'temurin'
55+
java-version: '21'
56+
cache: 'maven'
57+
58+
- name: Build with Maven
59+
run: ./mvnw install -B -Dquickly
60+
61+
- name: Prepare compiled classes artifact
62+
shell: bash
63+
run: find . -name "target" -type d | tar -czf target.tar.gz -T -
64+
65+
- name: Upload compiled classes artifact
66+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
67+
id: target-upload
68+
with:
69+
name: sonar-target
70+
path: target.tar.gz
71+
if-no-files-found: error
72+
retention-days: 1
73+
74+
- name: Prepare pull request metadata
75+
shell: bash
76+
run: |
77+
echo "${{ github.event.pull_request.number }}" > pr-event.txt
78+
echo "${{ github.event.pull_request.head.ref }}" >> pr-event.txt
79+
echo "${{ github.event.pull_request.base.ref }}" >> pr-event.txt
80+
echo "${{ github.event.pull_request.head.sha }}" >> pr-event.txt
81+
echo "${{ steps.target-upload.outputs.artifact-id }}" >> pr-event.txt
82+
83+
- name: Upload pull request metadata
84+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
85+
with:
86+
name: sonar-pr-event
87+
path: pr-event.txt
88+
if-no-files-found: error
89+
retention-days: 1

‎.github/workflows/sonar-scan.yml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
name: Sonar Quality Pull Request Analysis
19+
20+
on:
21+
workflow_run:
22+
workflows: [SonarBuild]
23+
types: [completed]
24+
25+
concurrency:
26+
group: sonar-pr-${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}
27+
cancel-in-progress: true
28+
29+
jobs:
30+
sonar:
31+
if: >
32+
github.event.workflow_run.conclusion == 'success' &&
33+
github.repository == 'apache/camel'
34+
name: Sonar Analysis
35+
runs-on: ubuntu-latest
36+
permissions:
37+
contents: read
38+
actions: write
39+
checks: write
40+
steps:
41+
- name: Download pull request metadata
42+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
43+
with:
44+
name: sonar-pr-event
45+
run-id: ${{ github.event.workflow_run.id }}
46+
github-token: ${{ secrets.GITHUB_TOKEN }}
47+
48+
- name: Read pull request metadata
49+
shell: bash
50+
run: |
51+
echo "pr_number=$(sed '1q;d' pr-event.txt)" >> "$GITHUB_ENV"
52+
echo "pr_head_ref=$(sed '2q;d' pr-event.txt)" >> "$GITHUB_ENV"
53+
echo "pr_base_ref=$(sed '3q;d' pr-event.txt)" >> "$GITHUB_ENV"
54+
echo "pr_head_sha=$(sed '4q;d' pr-event.txt)" >> "$GITHUB_ENV"
55+
echo "target_artifact_id=$(sed '5q;d' pr-event.txt)" >> "$GITHUB_ENV"
56+
57+
- name: Create PR check
58+
uses: actions/github-script@v7
59+
id: check
60+
with:
61+
script: |
62+
const jobs_response = await github.rest.actions.listJobsForWorkflowRunAttempt({
63+
...context.repo,
64+
run_id: context.runId,
65+
attempt_number: process.env.GITHUB_RUN_ATTEMPT,
66+
});
67+
const job_url = jobs_response.data.jobs[0].html_url;
68+
const check_response = await github.rest.checks.create({
69+
...context.repo,
70+
name: 'Sonar Quality Pull Request Analysis',
71+
head_sha: process.env.pr_head_sha,
72+
status: 'in_progress',
73+
output: {
74+
title: 'Sonar Quality Pull Request Analysis',
75+
summary: '[Details](' + job_url + ')'
76+
}
77+
});
78+
return check_response.data.id;
79+
result-encoding: string
80+
81+
- name: Checkout PR source
82+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
83+
with:
84+
repository: ${{ github.event.workflow_run.head_repository.full_name }}
85+
ref: ${{ github.event.workflow_run.head_sha }}
86+
fetch-depth: 0
87+
# fetch-depth: 0 is needed for Sonar's new code detection, blame information and issue backdating
88+
89+
- name: Fetch base branch
90+
run: |
91+
git remote add upstream https://github.com/apache/camel || true
92+
git fetch upstream
93+
git checkout -B ${{ env.pr_base_ref }} upstream/${{ env.pr_base_ref }}
94+
git checkout ${{ github.event.workflow_run.head_sha }}
95+
96+
- name: Download compiled classes artifact
97+
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
98+
with:
99+
name: sonar-target
100+
run-id: ${{ github.event.workflow_run.id }}
101+
github-token: ${{ secrets.GITHUB_TOKEN }}
102+
103+
- name: Delete compiled classes artifact
104+
if: always()
105+
uses: actions/github-script@v7
106+
with:
107+
script: |
108+
await github.rest.actions.deleteArtifact({
109+
...context.repo,
110+
artifact_id: process.env.target_artifact_id
111+
});
112+
113+
- name: Extract compiled classes
114+
shell: bash
115+
run: tar -xzf target.tar.gz
116+
117+
- name: Set up JDK 21
118+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
119+
with:
120+
distribution: 'temurin'
121+
java-version: '21'
122+
cache: 'maven'
123+
124+
- name: Cache SonarCloud packages
125+
uses: actions/cache@v4
126+
with:
127+
path: ~/.sonar/cache
128+
key: ${{ runner.os }}-sonar
129+
130+
- id: install-packages
131+
uses: ./.github/actions/install-packages
132+
133+
- name: Run Sonar Analysis
134+
shell: bash
135+
run: >
136+
./mvnw org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
137+
-Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
138+
-Dsonar.pullrequest.branch=${{ env.pr_head_ref }}
139+
-Dsonar.pullrequest.base=${{ env.pr_base_ref }}
140+
-Dsonar.pullrequest.key=${{ env.pr_number }}
141+
-Dsonar.pullrequest.github.repository=apache/camel
142+
-Dsonar.pullrequest.provider=GitHub
143+
-Dsonar.pullrequest.github.summary_comment=true
144+
-Dsonar.projectKey=apache_camel
145+
-Dsonar.organization=apache
146+
-Dsonar.token=${{ secrets.SONARCLOUD_TOKEN }}
147+
-B -V
148+
env:
149+
MAVEN_OPTS: "-XX:+UseG1GC -XX:InitialHeapSize=2g -XX:MaxHeapSize=6g -XX:+UseStringDeduplication"
150+
151+
- name: Update PR check status
152+
uses: actions/github-script@v7
153+
if: always()
154+
env:
155+
CHECK_ID: ${{ steps.check.outputs.result }}
156+
JOB_STATUS: ${{ job.status }}
157+
with:
158+
script: |
159+
await github.rest.checks.update({
160+
...context.repo,
161+
check_run_id: process.env.CHECK_ID,
162+
status: 'completed',
163+
conclusion: process.env.JOB_STATUS
164+
});

0 commit comments

Comments
 (0)