From 16226c42952b80475b05d81b71969f2e0d043b1a Mon Sep 17 00:00:00 2001 From: Ulysse Bouchet Date: Fri, 23 Oct 2026 11:19:06 +0200 Subject: [PATCH] ci: SonarQube analysis on the internal server through NetBird Adds a sonar job after quality-reports on the default branch. The job joins NetBird with a setup key, trusts the internal Simvia CA (ci/simvia-ca.crt) and runs sonarqube-scan-action with sonar-project.properties. Vitest now also emits lcov for Sonar's JS analyzer. The job is skipped until the secrets SONAR_TOKEN and NETBIRD_SETUP_KEY and the variable SONAR_HOST_URL are set. --- .github/workflows/test.yml | 44 +++++++++++++++++++++++++++++++++++++- ci/simvia-ca.crt | 23 ++++++++++++++++++++ sonar-project.properties | 12 +++++++++++ vitest.config.ts | 2 +- 4 files changed, 79 insertions(+), 2 deletions(-) create mode 100755 ci/simvia-ca.crt create mode 100644 sonar-project.properties diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c8176ef..b639ac8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -26,7 +26,9 @@ jobs: npx vitest run --coverage --reporter=default --reporter=junit --outputFile.junit=reports/junit-ts.xml - if: always() - run: cp coverage/cobertura-coverage.xml reports/coverage-ts.xml + run: | + cp coverage/cobertura-coverage.xml reports/coverage-ts.xml + cp coverage/lcov.info reports/lcov-ts.info - if: always() uses: actions/upload-artifact@v4 with: @@ -141,6 +143,46 @@ jobs: name: quality-reports path: reports/ + # Analysis on the internal SonarQube (sonar.simvia.internal), reached through a NetBird tunnel. + # Skipped until the secrets SONAR_TOKEN and NETBIRD_SETUP_KEY and the variable SONAR_HOST_URL exist. + sonar: + name: SonarQube + needs: [quality-reports] + if: always() && github.ref_name == github.event.repository.default_branch + runs-on: ubuntu-latest + env: + SONAR_ENABLED: ${{ secrets.SONAR_TOKEN != '' && secrets.NETBIRD_SETUP_KEY != '' && vars.SONAR_HOST_URL != '' }} + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 # blame data and new code detection + - uses: actions/download-artifact@v4 + continue-on-error: true + with: + pattern: "*reports*" + path: reports/ + merge-multiple: true + - name: Join the NetBird network + if: env.SONAR_ENABLED == 'true' + env: + NETBIRD_SETUP_KEY: ${{ secrets.NETBIRD_SETUP_KEY }} + SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} + run: | + curl -sSfL https://pkgs.netbird.io/install.sh | sh + sudo netbird up --setup-key "$NETBIRD_SETUP_KEY" --hostname "gh-vs-code-aster-$GITHUB_RUN_ID" + host=$(echo "$SONAR_HOST_URL" | sed 's|https://||; s|/.*||') + for _ in $(seq 30); do getent hosts "$host" && break; sleep 2; done + getent hosts "$host" + # Private CA of the internal services, for the Java scanner. + keytool -importcert -noprompt -alias simvia -file ci/simvia-ca.crt \ + -keystore "$RUNNER_TEMP/simvia.jks" -storepass changeit + echo "SONAR_SCANNER_OPTS=-Djavax.net.ssl.trustStore=$RUNNER_TEMP/simvia.jks -Djavax.net.ssl.trustStorePassword=changeit" >> "$GITHUB_ENV" + - uses: SonarSource/sonarqube-scan-action@v5 + if: env.SONAR_ENABLED == 'true' + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} + integration: name: VS Code integration (headless) runs-on: ubuntu-latest diff --git a/ci/simvia-ca.crt b/ci/simvia-ca.crt new file mode 100755 index 0000000..325161c --- /dev/null +++ b/ci/simvia-ca.crt @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIID0zCCArugAwIBAgIULiuZ9T0IKboz5DC6JEB/m65duxgwDQYJKoZIhvcNAQEL +BQAweTELMAkGA1UEBhMCRlIxDzANBgNVBAgMBkZyZW5jaDEPMA0GA1UEBwwGU2Fj +bGF5MQ8wDQYDVQQKDAZTaW12aWExDzANBgNVBAMMBnNpbXZpYTEmMCQGCSqGSIb3 +DQEJARYXbHVjYXMuc292cmVAc2ltdmlhLnRlY2gwHhcNMjUwNTE1MTMwNzA5WhcN +MzAwNTE0MTMwNzA5WjB5MQswCQYDVQQGEwJGUjEPMA0GA1UECAwGRnJlbmNoMQ8w +DQYDVQQHDAZTYWNsYXkxDzANBgNVBAoMBlNpbXZpYTEPMA0GA1UEAwwGc2ltdmlh +MSYwJAYJKoZIhvcNAQkBFhdsdWNhcy5zb3ZyZUBzaW12aWEudGVjaDCCASIwDQYJ +KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKKqIcTo6oPuu8pl72g4dozCkMnQ89Ro +QsUxYApvd6yVXH4UG94maC7+wVMtV44ruCpb8aMEkvX4l4WtIgqpgzKTqiB9pElF +fqWBtBgANMVnprrYOTPLKkFeou61cTPS2C1yByzQxjJXqJaZhIOWwhiy2hezWpd0 +oP0E1si0nbaw/cpTcIu6K1wGCG4NopiMIaU2Q3+zHU1pXpEqZgo9Z+lGnMlCodg/ +sTxrm3E36L1ji1qxa94vklld2lsnd9Oxd2sUR3f41RERfeTVYvCCanuUsrK8lp87 +ZdeOlVr4yB/LTzfOHyNh4pt3ePe6Vfh7M0Z8mGCS3eP1QdAHFwKoXIECAwEAAaNT +MFEwHQYDVR0OBBYEFBawpFvIjM8Y31ao3xMTvZMvEP58MB8GA1UdIwQYMBaAFBaw +pFvIjM8Y31ao3xMTvZMvEP58MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL +BQADggEBAGTs+I8tGy3FCmvVvBWx12WnPtYlq9DQ+xqNr6B/dEDZZxGAq2fjZdt0 +KXJZL2PSA+64AtwNopwWEDoUr8fHGz32qgcW5Ntg9iJhBQzJxqf3fyKm6Uj0GvWp +D62mjzKa9rb1ZGgDf605WcG2BryZqhqhkiBMPgbq+EeHonA+7ucW91LVUPaFRbin +WvIy8ECw8epzDEOG2WS2mKk0SxANGCer6zL8K5fRm+Cs4AOFo6gfviGaPDiqnVmF +fJUlzYHwDYgCIUVqQFlaNgEooLX+2mz5Ny3+CuC2rKfwCVvW2McIGONKwGme24gD +yk0X3PkXRpD8BNrIaGG75JBQwSQZf/E= +-----END CERTIFICATE----- diff --git a/sonar-project.properties b/sonar-project.properties new file mode 100644 index 0000000..ec41a2a --- /dev/null +++ b/sonar-project.properties @@ -0,0 +1,12 @@ +sonar.projectKey=vs-code-aster +sonar.projectName=VS Code Aster + +sonar.sources=src,webviews,python/lsp,python/med2obj.py,python/mesh_groups.py +sonar.tests=tests,python/tests +sonar.test.inclusions=**/*.test.ts,tests/**,python/tests/** +sonar.exclusions=**/node_modules/**,**/dist/**,**/out/**,**/coverage/** + +# Coverage and lint findings produced by the test jobs, see .github/workflows/test.yml +sonar.python.coverage.reportPaths=reports/coverage-python.xml +sonar.javascript.lcov.reportPaths=reports/lcov-ts.info +sonar.sarifReportPaths=reports/lint-ts.sarif,reports/lint-python.sarif diff --git a/vitest.config.ts b/vitest.config.ts index e9a9701..769eaef 100644 --- a/vitest.config.ts +++ b/vitest.config.ts @@ -20,7 +20,7 @@ export default defineConfig({ 'webviews/shared/**/*.{ts,svelte}', ], exclude: ['**/*.test.ts', '**/*.d.ts'], - reporter: ['text-summary', 'html', 'cobertura'], + reporter: ['text-summary', 'html', 'cobertura', 'lcov'], }, projects: [ {