Skip to content

SC-60373 Use WIF to authenticate SonarQube Cloud scans in build actions #363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
aurelien-poscia-sonarsource wants to merge 4 commits into from
Draft

SC-60373 Use WIF to authenticate SonarQube Cloud scans in build actions #363

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5699890
SC-60373 Use WIF to authenticate SonarQube Cloud scans in build actions
aurelien-poscia-sonarsource Oct 22, 2026
74bbca3
SC-60373 Extract the SonarQube Cloud authentication into a shared action
aurelien-poscia-sonarsource Oct 23, 2026
3f6069a
SC-60373 Address review comments
aurelien-poscia-sonarsource Oct 23, 2026
0991c9f
SC-60373 Use the sonar-region input of sonarqube-auth-action
henryju Oct 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,29 @@ The selected URL also determines the matching Vault server and reader-token engi
use the configured resolve URL instead of a hardcoded SaaS hostname.
- To resolve from SaaS Repox instead, set `repox-url: https://repox.jfrog.io`.

## SonarQube Cloud authentication

The `build-*` actions authenticate to SonarQube Cloud (`sonar-platform: sqc-eu` or `sqc-us`, and the matching platforms of
`run-shadow-scans`) with the GitHub OIDC token of the job, through
[`sonarqube-auth-action`](https://github.com/SonarSource/sonarqube-auth-action), instead of with tokens stored in Vault.
The SonarQube Cloud URLs, and the URL and token of the `next` platform, are still read from Vault.

@gitar-bot gitar-bot Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Quality: README still says build-* no longer read the SQC Vault secrets

This commit makes every build-* action read development/kv/data/sonarcloud url and development/kv/data/sonarqube-us url from Vault again, for example in build-gradle/action.yml:147-148. Line 100 of the README was updated to say so. Lines 115-116 were left unchanged and still say the build-* actions "do not read the secrets development/kv/data/sonarcloud and development/kv/data/sonarqube-us anymore" and that only check-sca still uses them. An operator who follows that paragraph could conclude that these secrets can be revoked once check-sca migrates. Doing that would leave SQC_EU_URL/SQC_US_URL empty and break every SQC scan in the build actions. Fix: reword lines 115-116 to say that only the token fields of those secrets are no longer read by build-*, and that the url fields are still required.

Clarify that only the token fields stopped being read:

The `build-*` actions do not read the `token` fields of the secrets `development/kv/data/sonarcloud` and
`development/kv/data/sonarqube-us` anymore, but still read their `url` fields. The tokens are still used by
[`check-sca`](#check-sca), so these secrets must not be revoked yet.
  • Apply fix

Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎


Requirements for each SonarQube Cloud platform that is analyzed:

- The job has the `id-token: write` permission.
- The repository is bound to a SonarQube Cloud project on that platform through the GitHub integration, and an administrator of the
organization has enabled trusted scanning for GitHub Actions.
- The `sonar.organization` and `sonar.projectKey` of the build match the project bound to the repository: the token only grants
access to that project.
- The build, the tests and the analysis complete within 30 minutes. The token is requested right before the build and lasts 30
minutes, which is the delay the analysis report must be uploaded within.

The token exchange fails the job when the repository is not bound, or when the job has no OIDC token. This is the case for
pull requests from forks, as GitHub does not grant `id-token: write` to them.

The `build-*` actions do not read the secrets `development/kv/data/sonarcloud` and `development/kv/data/sonarqube-us` anymore.
They are still used by [`check-sca`](#check-sca), so they must not be revoked yet.

---

## `get-build-number`
Expand Down Expand Up @@ -339,6 +362,10 @@ Build and deploy a Maven project with SonarQube analysis and Artifactory deploym
- `public-deployer` or `qa-deployer`: Artifactory role for deployment.
- `development/kv/data/develocity`: Develocity access token (only fetched when `use-develocity: true`).

#### SonarQube Cloud Authentication

Analysis on `sqc-eu` and `sqc-us` uses the GitHub OIDC token, see [SonarQube Cloud authentication](#sonarqube-cloud-authentication).

#### Other Dependencies

- The Java and Maven tools must be pre-installed. Use of `mise` is recommended.
Expand Down Expand Up @@ -577,6 +604,10 @@ Build, analyze, and publish a Python project using Poetry with SonarQube integra
- `public-reader` or `private-reader`: Artifactory role for reading dependencies
- `public-deployer` or `qa-deployer`: Artifactory role for deployment

#### SonarQube Cloud Authentication

Analysis on `sqc-eu` and `sqc-us` uses the GitHub OIDC token, see [SonarQube Cloud authentication](#sonarqube-cloud-authentication).

#### Other Dependencies

The Python and Poetry tools must be pre-installed. Use of `mise` is recommended.
Expand Down Expand Up @@ -798,6 +829,10 @@ Build and publish a Gradle project with SonarQube analysis and Artifactory deplo
- `public-reader` or `private-reader`: Artifactory role for reading dependencies
- `public-deployer` or `qa-deployer`: Artifactory role for deployment

#### SonarQube Cloud Authentication

Analysis on `sqc-eu` and `sqc-us` uses the GitHub OIDC token, see [SonarQube Cloud authentication](#sonarqube-cloud-authentication).

#### Other Dependencies

**Java**: Not pre-installed in the runner image. We recommend using `mise` to install and manage Java versions.
Expand Down Expand Up @@ -1107,6 +1142,10 @@ Build, test, analyze with SonarQube, and deploy an NPM project to JFrog Artifact
- `public-reader` or `private-reader`: Artifactory role for reading dependencies
- `public-deployer` or `qa-deployer`: Artifactory role for deployment

#### SonarQube Cloud Authentication

Analysis on `sqc-eu` and `sqc-us` uses the GitHub OIDC token, see [SonarQube Cloud authentication](#sonarqube-cloud-authentication).

#### Other Dependencies

The Node.js and NPM tools must be pre-installed. Use of `mise` is recommended.
Expand Down Expand Up @@ -1219,6 +1258,10 @@ Build, test, analyze, and deploy a Yarn project with SonarQube integration and A
- `public-reader` or `private-reader`: Artifactory role for reading dependencies
- `public-deployer` or `qa-deployer`: Artifactory role for deployment

#### SonarQube Cloud Authentication

Analysis on `sqc-eu` and `sqc-us` uses the GitHub OIDC token, see [SonarQube Cloud authentication](#sonarqube-cloud-authentication).

#### Other Dependencies

The Node.js and Yarn tools must be pre-installed. Use of `mise` is recommended.
Expand Down
16 changes: 10 additions & 6 deletions build-gradle/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,16 +142,20 @@ runs:
with:
# yamllint disable rule:line-length
secrets: |
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
Comment on lines 147 to 148

@gitar-bot gitar-bot Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Cross-Repo: sonar-dummy-gradle-oss shadow scans on @master will need WIF on EU and US

Fix here and in SonarSource/sonar-dummy-gradle-oss

Breaks in: SonarSource/sonar-dummy-gradle-oss - .github/workflows/unified-dogfooding.yml - Build and run shadow scans job (build-gradle@master, run-shadow-scans: true)

SonarSource/sonar-dummy-gradle-oss calls SonarSource/ci-github-actions/build-gradle@master with run-shadow-scans: true in .github/workflows/unified-dogfooding.yml (the "Build and run shadow scans" job). After this PR, build-gradle/action.yml reads only the SonarQube Cloud URLs from Vault (lines 147-148). The SQC_EU_TOKEN/SQC_US_TOKEN values come only from shared/sonar-auth, which runs sonarqube-auth-action for both EU and US whenever shadow scans are on, and there is no Vault fallback. The job pins @master, so the 3.0.0 versioning does not shield it. Once this merges, the job fails at the token exchange unless three things hold: the repository is bound to SonarQube Cloud projects on both sqc-eu and sqc-us with trusted scanning enabled, the job has id-token: write, and the build plus analysis finishes within the 30-minute token lifetime. The PR intends this break, so the consumer has to be ready before merge.

Here: Before merging to master, confirm that sonar-dummy-gradle-oss (and the other @master dogfood repos) is bound and has trusted scanning enabled on both sqc-eu and sqc-us. Otherwise, ship this on a 3.x/beta branch first and add a migration note in the README for @master consumers.

There: In SonarSource/sonar-dummy-gradle-oss, bind the repository to SonarQube Cloud projects on sqc-eu and sqc-us and enable trusted scanning. Add id-token: write to the shadow-scan job in .github/workflows/unified-dogfooding.yml, and make sure sonar.organization/sonar.projectKey match the bound projects.

In SonarSource/sonar-dummy-gradle-oss - .github/workflows/unified-dogfooding.yml:

permissions:
  id-token: write
  contents: write

Was this helpful? React with 👍 / 👎

${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
development/kv/data/sign key | SIGN_KEY;
development/kv/data/sign passphrase | PGP_PASSPHRASE;
development/kv/data/sign key_id | SIGN_KEY_ID;
# yamllint enable rule:line-length
# The SonarQube Cloud tokens expire after 30 minutes: keep this step right before the build step.
- uses: ./.actions/shared/sonar-auth
id: sonar-auth
with:
sonar-platform: ${{ inputs.sonar-platform }}
run-shadow-scans: ${{ inputs.run-shadow-scans }}

- name: Build, analyze and deploy
shell: bash
Expand Down Expand Up @@ -182,9 +186,9 @@ runs:
NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }}
NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }}
SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }}
SQC_EU_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN || '' }}
SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }}
SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }}
SQC_US_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN || '' }}
SQC_US_TOKEN: ${{ steps.sonar-auth.outputs.sqc-us-token }}
ORG_GRADLE_PROJECT_signingKey: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SIGN_KEY || '' }}
ORG_GRADLE_PROJECT_signingPassword: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).PGP_PASSPHRASE || '' }}
ORG_GRADLE_PROJECT_signingKeyId: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SIGN_KEY_ID || '' }}
Expand Down
4 changes: 1 addition & 3 deletions build-gradle/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,9 +55,7 @@ source "$(dirname "${BASH_SOURCE[0]}")/../shared/common-functions.sh"
if [[ "${DEPLOY:=true}" != "false" && "$RUN_SHADOW_SCANS" != "true" ]]; then
: "${ARTIFACTORY_DEPLOY_USERNAME:?}" "${ARTIFACTORY_DEPLOY_ACCESS_TOKEN:?}"
fi
if [[ "${SONAR_PLATFORM:?}" != "none" || "$RUN_SHADOW_SCANS" == "true" ]]; then
: "${NEXT_URL:?}" "${NEXT_TOKEN:?}" "${SQC_US_URL:?}" "${SQC_US_TOKEN:?}" "${SQC_EU_URL:?}" "${SQC_EU_TOKEN:?}"
fi
require_sonar_env
: "${ORG_GRADLE_PROJECT_signingKey:?}" "${ORG_GRADLE_PROJECT_signingPassword:?}" "${ORG_GRADLE_PROJECT_signingKeyId:?}"
: "${SKIP_TESTS:=false}" "${GRADLE_ARGS:=}"
export DEPLOY DEPLOY_PULL_REQUEST SKIP_TESTS GRADLE_ARGS
Expand Down
16 changes: 10 additions & 6 deletions build-maven/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,15 +177,19 @@ runs:
with:
# yamllint disable rule:line-length
secrets: |
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
development/kv/data/sign key | SIGN_KEY;
development/kv/data/sign passphrase | PGP_PASSPHRASE;
# yamllint enable rule:line-length
# The SonarQube Cloud tokens expire after 30 minutes: keep this step right before the build step.

@julien-carsique-sonarsource julien-carsique-sonarsource Oct 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it enough for long-running builds? Is the token used at the beginning and/or at the end of the Maven build?

@aurelien-poscia-sonarsource aurelien-poscia-sonarsource Oct 23, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The token fetch happens before the maven build is started, by design. The goal of modifying this action is to be able to dogfood the public sonarqube-auth-action at scale.

So we have two options:

  1. We have a custom implem here to fetch the token differently and not use the sonarqube-auth-action
  2. On the adopters of this action, only sonarqube build exceeded 30 minutes twice out of the recorded 25 runs.

I would rather adopt a specific solution for sonarqube, and let all other projects use the public sonarqube-auth-action

@henryju henryju Oct 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO this is a major design flaw of those shared actions (and to be honest, of our Maven/Gradle scanners). We should have isolated the Sonar analysis from the build of the project.
This is what I am trying to do on some projects, like here:
https://github.com/SonarSource/sonar-scanner-engine/actions/runs/39807148955

This is especially true if the build takes longer than 30 min, we should extract it, run tests in parallel jobs, and only run the SQ analysis in a downstream job.

- uses: ./.actions/shared/sonar-auth
id: sonar-auth
with:
sonar-platform: ${{ inputs.sonar-platform }}
run-shadow-scans: ${{ inputs.run-shadow-scans }}

- name: Build, analyze and deploy
shell: bash
Expand Down Expand Up @@ -216,9 +220,9 @@ runs:
NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }}
NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }}
SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }}
SQC_EU_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN || '' }}
SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }}
SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }}
SQC_US_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN || '' }}
SQC_US_TOKEN: ${{ steps.sonar-auth.outputs.sqc-us-token }}
SIGN_KEY: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SIGN_KEY || '' }}
PGP_PASSPHRASE: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).PGP_PASSPHRASE || '' }}
working-directory: ${{ inputs.working-directory }}
Expand Down
4 changes: 1 addition & 3 deletions build-maven/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,9 +53,7 @@ source "$(dirname "${BASH_SOURCE[0]}")/../shared/common-functions.sh"
if [[ "${DEPLOY:=true}" != "false" && "$RUN_SHADOW_SCANS" != "true" ]]; then
: "${ARTIFACTORY_DEPLOY_USERNAME:?}" "${ARTIFACTORY_DEPLOY_PASSWORD:?}"
fi
if [[ "${SONAR_PLATFORM:?}" != "none" || "$RUN_SHADOW_SCANS" == "true" ]]; then
: "${NEXT_URL:?}" "${NEXT_TOKEN:?}" "${SQC_US_URL:?}" "${SQC_US_TOKEN:?}" "${SQC_EU_URL:?}" "${SQC_EU_TOKEN:?}"
fi
require_sonar_env
: "${USER_MAVEN_ARGS:=}"
: "${SKIP_BUILD:=false}"
if [[ "$SKIP_BUILD" == "true" && "$DEPLOY" != "false" ]]; then
Expand Down
16 changes: 10 additions & 6 deletions build-npm/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,13 +147,17 @@ runs:
# yamllint disable rule:line-length
with:
secrets: |
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
# yamllint enable rule:line-length
# The SonarQube Cloud tokens expire after 30 minutes: keep this step right before the build step.
- uses: ./.actions/shared/sonar-auth
id: sonar-auth
with:
sonar-platform: ${{ inputs.sonar-platform }}
run-shadow-scans: ${{ inputs.run-shadow-scans }}
- name: Build, test, analyze and deploy
id: build
shell: bash
Expand All @@ -179,9 +183,9 @@ runs:
NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }}
NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }}
SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }}
SQC_EU_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN || '' }}
SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }}
SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }}
SQC_US_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN || '' }}
SQC_US_TOKEN: ${{ steps.sonar-auth.outputs.sqc-us-token }}
JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR: ${{ runner.temp }}/jfrog-summary
# JFROG_CLI_GITHUB_TOKEN:
working-directory: ${{ inputs.working-directory }}
Expand Down
4 changes: 1 addition & 3 deletions build-npm/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,7 @@ source "$(dirname "${BASH_SOURCE[0]}")/../shared/common-functions.sh"
if [[ "${DEPLOY:=true}" != "false" && "$RUN_SHADOW_SCANS" != "true" ]]; then
: "${ARTIFACTORY_DEPLOY_ACCESS_TOKEN:?}"
fi
if [[ "${SONAR_PLATFORM:?}" != "none" || "$RUN_SHADOW_SCANS" == "true" ]]; then
: "${NEXT_URL:?}" "${NEXT_TOKEN:?}" "${SQC_US_URL:?}" "${SQC_US_TOKEN:?}" "${SQC_EU_URL:?}" "${SQC_EU_TOKEN:?}"
fi
require_sonar_env
: "${SKIP_TESTS:=false}" "${BUILD_NAME:?}" "${PROJECT_VERSION:?}" "${CURRENT_VERSION:?}" "${SQ_SCANNER_VERSION:=4.3.0}"
export DEPLOY DEPLOY_PULL_REQUEST SKIP_TESTS SQ_SCANNER_VERSION

Expand Down
16 changes: 10 additions & 6 deletions build-poetry/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,13 +135,17 @@ runs:
# yamllint disable rule:line-length
with:
secrets: |
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}
${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
# yamllint enable rule:line-length
# The SonarQube Cloud tokens expire after 30 minutes: keep this step right before the build step.
- uses: ./.actions/shared/sonar-auth
id: sonar-auth
with:
sonar-platform: ${{ inputs.sonar-platform }}
run-shadow-scans: ${{ inputs.run-shadow-scans }}
- name: Build, Analyze and deploy
id: build
shell: bash
Expand All @@ -168,8 +172,8 @@ runs:
SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }}
NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }}
NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }}
SQC_EU_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN || '' }}
SQC_US_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN || '' }}
SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }}
SQC_US_TOKEN: ${{ steps.sonar-auth.outputs.sqc-us-token }}
SONAR_PLATFORM: ${{ inputs.sonar-platform }}
RUN_SHADOW_SCANS: ${{ inputs.run-shadow-scans }}
JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR: ${{ runner.temp }}/jfrog-summary
Expand Down
6 changes: 2 additions & 4 deletions build-poetry/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,9 +50,7 @@ source "$(dirname "${BASH_SOURCE[0]}")/../shared/common-functions.sh"
if [[ "${DEPLOY:=true}" != "false" && "$RUN_SHADOW_SCANS" != "true" ]]; then
: "${ARTIFACTORY_DEPLOY_ACCESS_TOKEN:?}"
fi
if [[ "${SONAR_PLATFORM:?}" != "none" || "$RUN_SHADOW_SCANS" == "true" ]]; then
: "${NEXT_URL:?}" "${NEXT_TOKEN:?}" "${SQC_US_URL:?}" "${SQC_US_TOKEN:?}" "${SQC_EU_URL:?}" "${SQC_EU_TOKEN:?}"
fi
require_sonar_env
export DEPLOY DEPLOY_PULL_REQUEST

# Unshallow and fetch all commit history for SonarQube analysis and issue assignment
Expand Down Expand Up @@ -130,7 +128,7 @@ run_sonar_analysis() {
echo "run_sonar_analysis()"
if [[ "${RUN_SHADOW_SCANS}" = "true" ]]; then
echo "=== Running Sonar analysis on all platforms (shadow scan enabled) ==="
local platforms=("next" "sqc-us" "sqc-eu")
local platforms=("${SONAR_PLATFORMS[@]}")

for platform in "${platforms[@]}"; do
echo "::group::Sonar analysis on $platform"
Expand Down
Loading
Loading