ci: SonarQube analysis on the internal server through NetBird

.github/workflows/test.yml

@@ -26,7 +26,9 @@ jobs:
           npx vitest run --coverage
           --reporter=default --reporter=junit --outputFile.junit=reports/junit-ts.xml
       - if: always()
-        run: cp coverage/cobertura-coverage.xml reports/coverage-ts.xml
+        run: |
+          cp coverage/cobertura-coverage.xml reports/coverage-ts.xml
+          cp coverage/lcov.info reports/lcov-ts.info
       - if: always()
         uses: actions/upload-artifact@v4
         with:
@@ -141,6 +143,46 @@ jobs:
           name: quality-reports
           path: reports/
 
+  # Analysis on the internal SonarQube (sonar.simvia.internal), reached through a NetBird tunnel.
+  # Skipped until the secrets SONAR_TOKEN and NETBIRD_SETUP_KEY and the variable SONAR_HOST_URL exist.
+  sonar:
+    name: SonarQube
+    needs: [quality-reports]
+    if: always() && github.ref_name == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    env:
+      SONAR_ENABLED: ${{ secrets.SONAR_TOKEN != '' && secrets.NETBIRD_SETUP_KEY != '' && vars.SONAR_HOST_URL != '' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # blame data and new code detection
+      - uses: actions/download-artifact@v4
+        continue-on-error: true
+        with:
+          pattern: "*reports*"
+          path: reports/
+          merge-multiple: true
+      - name: Join the NetBird network
+        if: env.SONAR_ENABLED == 'true'
+        env:
+          NETBIRD_SETUP_KEY: ${{ secrets.NETBIRD_SETUP_KEY }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+        run: |
+          curl -sSfL https://pkgs.netbird.io/install.sh | sh
+          sudo netbird up --setup-key "$NETBIRD_SETUP_KEY" --hostname "gh-vs-code-aster-$GITHUB_RUN_ID"
+          host=$(echo "$SONAR_HOST_URL" | sed 's|https://||; s|/.*||')
+          for _ in $(seq 30); do getent hosts "$host" && break; sleep 2; done
+          getent hosts "$host"
+          # Private CA of the internal services, for the Java scanner.
+          keytool -importcert -noprompt -alias simvia -file ci/simvia-ca.crt \
+            -keystore "$RUNNER_TEMP/simvia.jks" -storepass changeit
+          echo "SONAR_SCANNER_OPTS=-Djavax.net.ssl.trustStore=$RUNNER_TEMP/simvia.jks -Djavax.net.ssl.trustStorePassword=changeit" >> "$GITHUB_ENV"
+      - uses: SonarSource/sonarqube-scan-action@v5
+        if: env.SONAR_ENABLED == 'true'
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+
   integration:
     name: VS Code integration (headless)
     runs-on: ubuntu-latest

ci/simvia-ca.crt

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID0zCCArugAwIBAgIULiuZ9T0IKboz5DC6JEB/m65duxgwDQYJKoZIhvcNAQEL
+BQAweTELMAkGA1UEBhMCRlIxDzANBgNVBAgMBkZyZW5jaDEPMA0GA1UEBwwGU2Fj
+bGF5MQ8wDQYDVQQKDAZTaW12aWExDzANBgNVBAMMBnNpbXZpYTEmMCQGCSqGSIb3
+DQEJARYXbHVjYXMuc292cmVAc2ltdmlhLnRlY2gwHhcNMjUwNTE1MTMwNzA5WhcN
+MzAwNTE0MTMwNzA5WjB5MQswCQYDVQQGEwJGUjEPMA0GA1UECAwGRnJlbmNoMQ8w
+DQYDVQQHDAZTYWNsYXkxDzANBgNVBAoMBlNpbXZpYTEPMA0GA1UEAwwGc2ltdmlh
+MSYwJAYJKoZIhvcNAQkBFhdsdWNhcy5zb3ZyZUBzaW12aWEudGVjaDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKKqIcTo6oPuu8pl72g4dozCkMnQ89Ro
+QsUxYApvd6yVXH4UG94maC7+wVMtV44ruCpb8aMEkvX4l4WtIgqpgzKTqiB9pElF
+fqWBtBgANMVnprrYOTPLKkFeou61cTPS2C1yByzQxjJXqJaZhIOWwhiy2hezWpd0
+oP0E1si0nbaw/cpTcIu6K1wGCG4NopiMIaU2Q3+zHU1pXpEqZgo9Z+lGnMlCodg/
+sTxrm3E36L1ji1qxa94vklld2lsnd9Oxd2sUR3f41RERfeTVYvCCanuUsrK8lp87
+ZdeOlVr4yB/LTzfOHyNh4pt3ePe6Vfh7M0Z8mGCS3eP1QdAHFwKoXIECAwEAAaNT
+MFEwHQYDVR0OBBYEFBawpFvIjM8Y31ao3xMTvZMvEP58MB8GA1UdIwQYMBaAFBaw
+pFvIjM8Y31ao3xMTvZMvEP58MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBAGTs+I8tGy3FCmvVvBWx12WnPtYlq9DQ+xqNr6B/dEDZZxGAq2fjZdt0
+KXJZL2PSA+64AtwNopwWEDoUr8fHGz32qgcW5Ntg9iJhBQzJxqf3fyKm6Uj0GvWp
+D62mjzKa9rb1ZGgDf605WcG2BryZqhqhkiBMPgbq+EeHonA+7ucW91LVUPaFRbin
+WvIy8ECw8epzDEOG2WS2mKk0SxANGCer6zL8K5fRm+Cs4AOFo6gfviGaPDiqnVmF
+fJUlzYHwDYgCIUVqQFlaNgEooLX+2mz5Ny3+CuC2rKfwCVvW2McIGONKwGme24gD
+yk0X3PkXRpD8BNrIaGG75JBQwSQZf/E=
+-----END CERTIFICATE-----

sonar-project.properties

@@ -0,0 +1,12 @@
+sonar.projectKey=vs-code-aster
+sonar.projectName=VS Code Aster
+
+sonar.sources=src,webviews,python/lsp,python/med2obj.py,python/mesh_groups.py
+sonar.tests=tests,python/tests
+sonar.test.inclusions=**/*.test.ts,tests/**,python/tests/**
+sonar.exclusions=**/node_modules/**,**/dist/**,**/out/**,**/coverage/**
+
+# Coverage and lint findings produced by the test jobs, see .github/workflows/test.yml
+sonar.python.coverage.reportPaths=reports/coverage-python.xml
+sonar.javascript.lcov.reportPaths=reports/lcov-ts.info
+sonar.sarifReportPaths=reports/lint-ts.sarif,reports/lint-python.sarif

vitest.config.ts

@@ -20,7 +20,7 @@ export default defineConfig({
         'webviews/shared/**/*.{ts,svelte}',
       ],
       exclude: ['**/*.test.ts', '**/*.d.ts'],
-      reporter: ['text-summary', 'html', 'cobertura'],
+      reporter: ['text-summary', 'html', 'cobertura', 'lcov'],
     },
     projects: [
       {