diff --git a/README.md b/README.md index 57721a9a..2164fdc0 100644 --- a/README.md +++ b/README.md @@ -96,8 +96,8 @@ The selected URL also determines the matching Vault server and reader-token engi The `build-*` actions authenticate to SonarQube Cloud (`sonar-platform: sqc-eu` or `sqc-us`, and the matching platforms of `run-shadow-scans`) with the GitHub OIDC token of the job, through -[`sonarqube-auth-action`](https://github.com/SonarSource/sonarqube-auth-action), instead of with tokens stored in Vault. -The SonarQube Cloud URLs, and the URL and token of the `next` platform, are still read from Vault. +[`sonarqube-auth-action`](https://github.com/SonarSource/sonarqube-auth-action), instead of with Vault secrets. +The `next` platform still reads its URL and token from Vault. Requirements for each SonarQube Cloud platform that is analyzed: @@ -106,6 +106,10 @@ Requirements for each SonarQube Cloud platform that is analyzed: organization has enabled trusted scanning for GitHub Actions. - The `sonar.organization` and `sonar.projectKey` of the build match the project bound to the repository: the token only grants access to that project. +- The scanner of the build resolves the SonarQube Cloud URL from the region: the actions pass `sonar.region=us` for `sqc-us` and no + `sonar.host.url` for `sqc-eu`. This requires the SonarScanner for Gradle 6.1+ (`org.sonarqube` plugin), which is the first version to + support regions. The SonarScanner for Maven is pinned by the action. A `sonar.host.url` set in the build of the project must + match the region, or be removed. - The build, the tests and the analysis complete within 30 minutes. The token is requested right before the build and lasts 30 minutes, which is the delay the analysis report must be uploaded within. diff --git a/build-gradle/action.yml b/build-gradle/action.yml index a5c76836..1ef4b283 100644 --- a/build-gradle/action.yml +++ b/build-gradle/action.yml @@ -144,8 +144,6 @@ runs: secrets: | ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }} ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }} development/kv/data/sign key | SIGN_KEY; development/kv/data/sign passphrase | PGP_PASSPHRASE; development/kv/data/sign key_id | SIGN_KEY_ID; @@ -185,9 +183,7 @@ runs: # yamllint enable rule:line-length NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }} NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }} - SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }} SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }} - SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }} SQC_US_TOKEN: ${{ steps.sonar-auth.outputs.sqc-us-token }} ORG_GRADLE_PROJECT_signingKey: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SIGN_KEY || '' }} ORG_GRADLE_PROJECT_signingPassword: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).PGP_PASSPHRASE || '' }} diff --git a/build-gradle/build.sh b/build-gradle/build.sh index 1706a681..e1cd0271 100755 --- a/build-gradle/build.sh +++ b/build-gradle/build.sh @@ -7,9 +7,7 @@ # - SONAR_PLATFORM: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. # - NEXT_URL: URL of SonarQube server for next platform # - NEXT_TOKEN: Access token to send analysis reports to SonarQube for next platform -# - SQC_US_URL: URL of SonarQube server for sqc-us platform # - SQC_US_TOKEN: Access token to send analysis reports to SonarQube for sqc-us platform -# - SQC_EU_URL: URL of SonarQube server for sqc-eu platform # - SQC_EU_TOKEN: Access token to send analysis reports to SonarQube for sqc-eu platform # - RUN_SHADOW_SCANS: If true, run sonar scanner on all 3 platforms. If false, run on the platform provided by SONAR_PLATFORM. # When enabled, SONAR_PLATFORM is ignored. @@ -124,10 +122,15 @@ build_gradle_args() { args+=("-x" "test") fi - # SonarQube analysis (orchestrator will provide SONAR_HOST_URL and SONAR_TOKEN) - if [[ -n "${SONAR_HOST_URL:-}" && -n "${SONAR_TOKEN:-}" ]]; then + # SonarQube analysis (orchestrator will provide SONAR_TOKEN, and SONAR_HOST_URL or SONAR_REGION) + if [[ -n "${SONAR_TOKEN:-}" ]]; then args+=("sonar") - args+=("-Dsonar.host.url=$SONAR_HOST_URL") + if [[ -n "${SONAR_HOST_URL:-}" ]]; then + args+=("-Dsonar.host.url=$SONAR_HOST_URL") + fi + if [[ -n "${SONAR_REGION:-}" ]]; then + args+=("-Dsonar.region=$SONAR_REGION") + fi args+=("-Dsonar.token=$SONAR_TOKEN") args+=("-Dsonar.analysis.buildNumber=$BUILD_NUMBER") args+=("-Dsonar.analysis.pipeline=$GITHUB_RUN_ID") @@ -188,7 +191,7 @@ set_gradle_cmd() { # # This function is called BY THE ORCHESTRATOR (orchestrate_sonar_platforms) # The orchestrator will: -# 1. Set SONAR_HOST_URL and SONAR_TOKEN for the current platform +# 1. Set SONAR_TOKEN, and SONAR_HOST_URL (next) or SONAR_REGION (sqc-us) for the current platform # 2. Call this function to execute the actual scanner # 3. Repeat for each platform (if shadow scanning enabled) gradle_build_and_analyze() { diff --git a/build-maven/action.yml b/build-maven/action.yml index abea3e82..528372d6 100644 --- a/build-maven/action.yml +++ b/build-maven/action.yml @@ -179,8 +179,6 @@ runs: secrets: | ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }} ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }} development/kv/data/sign key | SIGN_KEY; development/kv/data/sign passphrase | PGP_PASSPHRASE; # yamllint enable rule:line-length @@ -219,9 +217,7 @@ runs: # yamllint enable rule:line-length NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }} NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }} - SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }} SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }} - SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }} SQC_US_TOKEN: ${{ steps.sonar-auth.outputs.sqc-us-token }} SIGN_KEY: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SIGN_KEY || '' }} PGP_PASSPHRASE: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).PGP_PASSPHRASE || '' }} diff --git a/build-maven/build.sh b/build-maven/build.sh index 8764a1a5..091e4599 100755 --- a/build-maven/build.sh +++ b/build-maven/build.sh @@ -7,9 +7,7 @@ # - SONAR_PLATFORM: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. # - NEXT_URL: URL of SonarQube server for next platform # - NEXT_TOKEN: Access token to send analysis reports to SonarQube for next platform -# - SQC_US_URL: URL of SonarQube server for sqc-us platform # - SQC_US_TOKEN: Access token to send analysis reports to SonarQube for sqc-us platform -# - SQC_EU_URL: URL of SonarQube server for sqc-eu platform # - SQC_EU_TOKEN: Access token to send analysis reports to SonarQube for sqc-eu platform # - RUN_SHADOW_SCANS: If true, run sonar scanner on all 3 platforms. If false, run on the platform provided by SONAR_PLATFORM. # - ARTIFACTORY_URL: URL to Artifactory repository @@ -76,13 +74,20 @@ readonly SONAR_GOAL="org.sonarsource.scanner.maven:sonar-maven-plugin:${SCANNER_ # This function is called BY THE ORCHESTRATOR (orchestrate_sonar_platforms) # INVERSION OF CONTROL: We implement this interface, orchestrator calls us # The orchestrator will: -# 1. Set SONAR_HOST_URL and SONAR_TOKEN for the current platform +# 1. Set SONAR_TOKEN, and SONAR_HOST_URL (next) or SONAR_REGION (sqc-us) for the current platform # 2. Call this function to execute the actual scanner # 3. Repeat for each platform (if shadow scanning enabled) sonar_scanner_implementation() { local additional_params=("$@") - # Build sonar properties (using orchestrator-provided SONAR_HOST_URL/SONAR_TOKEN) - local sonar_props=("-Dsonar.host.url=${SONAR_HOST_URL}" "-Dsonar.token=${SONAR_TOKEN}") + # Build sonar properties (using orchestrator-provided SONAR_HOST_URL/SONAR_REGION/SONAR_TOKEN) + local sonar_props=() + if [[ -n "${SONAR_HOST_URL:-}" ]]; then + sonar_props+=("-Dsonar.host.url=${SONAR_HOST_URL}") + fi + if [[ -n "${SONAR_REGION:-}" ]]; then + sonar_props+=("-Dsonar.region=${SONAR_REGION}") + fi + sonar_props+=("-Dsonar.token=${SONAR_TOKEN}") sonar_props+=("-Dsonar.projectVersion=${CURRENT_VERSION}") sonar_props+=("${additional_params[@]+"${additional_params[@]}"}") diff --git a/build-npm/action.yml b/build-npm/action.yml index cc8dd225..66f60206 100644 --- a/build-npm/action.yml +++ b/build-npm/action.yml @@ -149,8 +149,6 @@ runs: secrets: | ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }} ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }} # yamllint enable rule:line-length # The SonarQube Cloud tokens expire after 30 minutes: keep this step right before the build step. - uses: ./.actions/shared/sonar-auth @@ -182,9 +180,7 @@ runs: SONAR_PLATFORM: ${{ inputs.sonar-platform }} NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }} NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }} - SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }} SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }} - SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }} SQC_US_TOKEN: ${{ steps.sonar-auth.outputs.sqc-us-token }} JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR: ${{ runner.temp }}/jfrog-summary # JFROG_CLI_GITHUB_TOKEN: diff --git a/build-npm/build.sh b/build-npm/build.sh index cc79fa81..26c01adf 100755 --- a/build-npm/build.sh +++ b/build-npm/build.sh @@ -8,9 +8,7 @@ # - SONAR_PLATFORM: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. # - NEXT_URL: URL of SonarQube server for next platform # - NEXT_TOKEN: Access token to send analysis reports to SonarQube for next platform -# - SQC_US_URL: URL of SonarQube server for sqc-us platform # - SQC_US_TOKEN: Access token to send analysis reports to SonarQube for sqc-us platform -# - SQC_EU_URL: URL of SonarQube server for sqc-eu platform # - SQC_EU_TOKEN: Access token to send analysis reports to SonarQube for sqc-eu platform # - RUN_SHADOW_SCANS: If true, run sonar scanner on all 3 platforms. If false, run on the platform provided by SONAR_PLATFORM. # When enabled, SONAR_PLATFORM is ignored. @@ -72,14 +70,16 @@ git_fetch_unshallow() { # # This function is called BY THE ORCHESTRATOR (orchestrate_sonar_platforms) # The orchestrator will: -# 1. Set SONAR_HOST_URL and SONAR_TOKEN for the current platform +# 1. Set SONAR_TOKEN, and SONAR_HOST_URL (next) or SONAR_REGION (sqc-us) for the current platform # 2. Call this function to execute the actual scanner # 3. Repeat for each platform (if shadow scanning enabled) sonar_scanner_implementation() { local additional_params=("$@") - # Build base scanner arguments (using orchestrator-provided SONAR_HOST_URL/SONAR_TOKEN) + # Build base scanner arguments (using orchestrator-provided SONAR_HOST_URL/SONAR_REGION/SONAR_TOKEN) local scanner_args=() - scanner_args+=("-Dsonar.host.url=${SONAR_HOST_URL}") + if [[ -n "${SONAR_HOST_URL:-}" ]]; then + scanner_args+=("-Dsonar.host.url=${SONAR_HOST_URL}") + fi scanner_args+=("-Dsonar.token=${SONAR_TOKEN}") scanner_args+=("-Dsonar.analysis.buildNumber=${BUILD_NUMBER}") scanner_args+=("-Dsonar.analysis.pipeline=${GITHUB_RUN_ID}") diff --git a/build-poetry/action.yml b/build-poetry/action.yml index 0ca95229..213f4a35 100644 --- a/build-poetry/action.yml +++ b/build-poetry/action.yml @@ -137,8 +137,6 @@ runs: secrets: | ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }} ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }} # yamllint enable rule:line-length # The SonarQube Cloud tokens expire after 30 minutes: keep this step right before the build step. - uses: ./.actions/shared/sonar-auth @@ -168,8 +166,6 @@ runs: POETRY_CACHE_DIR: ${{ github.workspace }}/${{ inputs.poetry-cache-dir }} # Vault secrets - SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }} - SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }} NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }} NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }} SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }} diff --git a/build-poetry/build.sh b/build-poetry/build.sh index 4f29a882..36c320df 100755 --- a/build-poetry/build.sh +++ b/build-poetry/build.sh @@ -12,9 +12,7 @@ # - SONAR_PLATFORM: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. # - NEXT_URL: URL of SonarQube server for next platform # - NEXT_TOKEN: Access token to send analysis reports to SonarQube for next platform -# - SQC_US_URL: URL of SonarQube server for sqc-us platform # - SQC_US_TOKEN: Access token to send analysis reports to SonarQube for sqc-us platform -# - SQC_EU_URL: URL of SonarQube server for sqc-eu platform # - SQC_EU_TOKEN: Access token to send analysis reports to SonarQube for sqc-eu platform # - RUN_SHADOW_SCANS: If true, run sonar scanner on all 3 platforms. If false, run on the platform provided by SONAR_PLATFORM. # When enabled, SONAR_PLATFORM is ignored. @@ -81,12 +79,12 @@ set_sonar_platform_vars() { export SONAR_REGION="" ;; "sqc-us") - export SONAR_HOST_URL="$SQC_US_URL" + unset SONAR_HOST_URL export SONAR_TOKEN="$SQC_US_TOKEN" export SONAR_REGION="us" ;; "sqc-eu") - export SONAR_HOST_URL="$SQC_EU_URL" + unset SONAR_HOST_URL export SONAR_TOKEN="$SQC_EU_TOKEN" export SONAR_REGION="" ;; @@ -100,22 +98,29 @@ set_sonar_platform_vars() { ;; esac - echo "Using Sonar platform: $platform (URL: $SONAR_HOST_URL)" + echo "Using Sonar platform: $platform (URL: ${SONAR_HOST_URL:-default})" } run_sonar_scanner() { local additional_params=("$@") + local location_args=() + if [[ -n "${SONAR_HOST_URL:-}" ]]; then + location_args+=("-Dsonar.host.url=${SONAR_HOST_URL}") + fi + if [[ -n "${SONAR_REGION:-}" ]]; then + location_args+=("-Dsonar.region=${SONAR_REGION}") + fi # Install pysonar into Poetry's virtual environment without modifying project files poetry run pip install pysonar echo "Poetry command: poetry run pysonar ..." \ - "-Dsonar.host.url=${SONAR_HOST_URL}" \ + "${location_args[@]+${location_args[@]}}" \ "-Dsonar.analysis.buildNumber=${BUILD_NUMBER}" \ "-Dsonar.analysis.pipeline=${GITHUB_RUN_ID}" \ "-Dsonar.analysis.repository=${GITHUB_REPOSITORY}" \ "${additional_params[@]+${additional_params[@]}}" poetry run pysonar \ - -Dsonar.host.url="${SONAR_HOST_URL}" \ + "${location_args[@]+${location_args[@]}}" \ -Dsonar.token="${SONAR_TOKEN}" \ -Dsonar.analysis.buildNumber="${BUILD_NUMBER}" \ -Dsonar.analysis.pipeline="${GITHUB_RUN_ID}" \ diff --git a/build-yarn/action.yml b/build-yarn/action.yml index 98712864..41a510e2 100644 --- a/build-yarn/action.yml +++ b/build-yarn/action.yml @@ -155,8 +155,6 @@ runs: secrets: | ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }} ${{ (inputs.sonar-platform == 'next' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next token | NEXT_TOKEN;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }} - ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }} # yamllint enable rule:line-length # The SonarQube Cloud tokens expire after 30 minutes: keep this step right before the build step. - uses: ./.actions/shared/sonar-auth @@ -189,8 +187,6 @@ runs: SKIP_TESTS: ${{ inputs.skip-tests }} # Vault secrets - SQC_EU_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_EU_URL || '' }} - SQC_US_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).SQC_US_URL || '' }} NEXT_URL: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_URL || '' }} NEXT_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN || '' }} SQC_EU_TOKEN: ${{ steps.sonar-auth.outputs.sqc-eu-token }} diff --git a/build-yarn/build.sh b/build-yarn/build.sh index 95788fff..1050b14c 100755 --- a/build-yarn/build.sh +++ b/build-yarn/build.sh @@ -7,9 +7,7 @@ # - SONAR_PLATFORM: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. # - NEXT_URL: URL of SonarQube server for next platform # - NEXT_TOKEN: Access token to send analysis reports to SonarQube for next platform -# - SQC_US_URL: URL of SonarQube server for sqc-us platform # - SQC_US_TOKEN: Access token to send analysis reports to SonarQube for sqc-us platform -# - SQC_EU_URL: URL of SonarQube server for sqc-eu platform # - SQC_EU_TOKEN: Access token to send analysis reports to SonarQube for sqc-eu platform # - RUN_SHADOW_SCANS: If true, run sonar scanner on all 3 platforms. If false, run on the platform provided by SONAR_PLATFORM. # When enabled, SONAR_PLATFORM is ignored. @@ -143,14 +141,16 @@ set_project_version() { # # This function is called BY THE ORCHESTRATOR (orchestrate_sonar_platforms) # The orchestrator will: -# 1. Set SONAR_HOST_URL and SONAR_TOKEN for the current platform +# 1. Set SONAR_TOKEN, and SONAR_HOST_URL (next) or SONAR_REGION (sqc-us) for the current platform # 2. Call this function to execute the actual scanner # 3. Repeat for each platform (if shadow scanning enabled) sonar_scanner_implementation() { local additional_params=("$@") - # Build base scanner arguments (using orchestrator-provided SONAR_HOST_URL/SONAR_TOKEN) + # Build base scanner arguments (using orchestrator-provided SONAR_HOST_URL/SONAR_REGION/SONAR_TOKEN) local scanner_args=() - scanner_args+=("-Dsonar.host.url=${SONAR_HOST_URL}") + if [[ -n "${SONAR_HOST_URL:-}" ]]; then + scanner_args+=("-Dsonar.host.url=${SONAR_HOST_URL}") + fi scanner_args+=("-Dsonar.token=${SONAR_TOKEN}") scanner_args+=("-Dsonar.analysis.buildNumber=${BUILD_NUMBER}") scanner_args+=("-Dsonar.analysis.pipeline=${GITHUB_RUN_ID}") diff --git a/shared/common-functions.sh b/shared/common-functions.sh index 721c52b1..f88c532a 100755 --- a/shared/common-functions.sh +++ b/shared/common-functions.sh @@ -24,12 +24,12 @@ set_sonar_platform_vars() { unset SONAR_REGION ;; "sqc-us") - export SONAR_HOST_URL="$SQC_US_URL" + unset SONAR_HOST_URL export SONAR_TOKEN="$SQC_US_TOKEN" export SONAR_REGION="us" ;; "sqc-eu") - export SONAR_HOST_URL="$SQC_EU_URL" + unset SONAR_HOST_URL export SONAR_TOKEN="$SQC_EU_TOKEN" unset SONAR_REGION ;; @@ -42,12 +42,13 @@ set_sonar_platform_vars() { return 1 ;; esac - echo "Using Sonar platform: $platform (URL: ${SONAR_HOST_URL#*//}, Region: ${SONAR_REGION:-none})" + local url="${SONAR_HOST_URL:-default}" + echo "Using Sonar platform: $platform (URL: ${url#*//}, Region: ${SONAR_REGION:-none})" } SONAR_PLATFORMS=("next" "sqc-us" "sqc-eu") -# Fails when the URL or token of a platform that is going to be analyzed is missing +# Fails when the token (and the URL for next) of a platform that is going to be analyzed is missing require_sonar_env() { local platforms=() if [[ "${RUN_SHADOW_SCANS:-false}" == "true" ]]; then @@ -60,8 +61,8 @@ require_sonar_env() { for platform in "${platforms[@]}"; do case "$platform" in next) : "${NEXT_URL:?}" "${NEXT_TOKEN:?}" ;; - sqc-us) : "${SQC_US_URL:?}" "${SQC_US_TOKEN:?}" ;; - sqc-eu) : "${SQC_EU_URL:?}" "${SQC_EU_TOKEN:?}" ;; + sqc-us) : "${SQC_US_TOKEN:?}" ;; + sqc-eu) : "${SQC_EU_TOKEN:?}" ;; *) ;; esac done diff --git a/spec/build-gradle_spec.sh b/spec/build-gradle_spec.sh index b11b9004..3203cf92 100755 --- a/spec/build-gradle_spec.sh +++ b/spec/build-gradle_spec.sh @@ -50,9 +50,7 @@ export SONAR_PLATFORM="next" export RUN_SHADOW_SCANS="false" export NEXT_URL="https://next.sonarqube.com" export NEXT_TOKEN="next-token" -export SQC_US_URL="https://sonarcloud.io" export SQC_US_TOKEN="sqc-us-token" -export SQC_EU_URL="https://sonarcloud.io" export SQC_EU_TOKEN="sqc-eu-token" export ORG_GRADLE_PROJECT_signingKey="signing-key" export ORG_GRADLE_PROJECT_signingPassword="signing-pass" @@ -207,6 +205,17 @@ Describe 'build_gradle_args' The output should include "-Dsonar.host.url=https://sonar.example.com" End + It 'includes sonar with the region and without host URL when configured for sqc-us' + export GRADLE_ARGS="" + unset SONAR_HOST_URL + export SONAR_REGION="us" + export SONAR_TOKEN="sonar-token" + When call build_gradle_args + The output should include "sonar" + The output should include "-Dsonar.region=us" + The output should not include "-Dsonar.host.url" + End + It 'includes deployment for master' export GRADLE_ARGS="" When call build_gradle_args diff --git a/spec/build-maven_spec.sh b/spec/build-maven_spec.sh index d59c0717..10cf219f 100755 --- a/spec/build-maven_spec.sh +++ b/spec/build-maven_spec.sh @@ -40,9 +40,7 @@ export RUNNER_OS="Linux" export SONAR_PLATFORM="next" export NEXT_URL="https://next.sonarqube.com" export NEXT_TOKEN="next-token" -export SQC_US_URL="https://sonarqube.us.sonarsource.com" export SQC_US_TOKEN="sqc-us-token" -export SQC_EU_URL="https://sonarqube.eu.sonarsource.com" export SQC_EU_TOKEN="sqc-eu-token" export RUN_SHADOW_SCANS="false" export SCANNER_VERSION="5.6.0.6792" @@ -259,6 +257,16 @@ Describe 'run_sonar_scanner()' The lines of stdout should equal 2 End + It 'runs sonar scanner with the region and without host URL for sqc-us' + unset SONAR_HOST_URL + export SONAR_REGION="us" + When call sonar_scanner_implementation + The status should be success + The line 2 should include "-Dsonar.region=us" + The line 2 should not include "-Dsonar.host.url" + The line 2 should include "-Dsonar.token=test-token" + End + It 'runs sonar scanner with additional parameters' When call sonar_scanner_implementation "-Dsonar.pullrequest.key=123" The status should be success diff --git a/spec/build-npm_spec.sh b/spec/build-npm_spec.sh index f5482fee..43b51b00 100755 --- a/spec/build-npm_spec.sh +++ b/spec/build-npm_spec.sh @@ -82,9 +82,7 @@ export RUN_SHADOW_SCANS="false" export SKIP_TESTS="false" export SONAR_PLATFORM="next" export SQC_EU_TOKEN="sqc-eu-token" -export SQC_EU_URL="https://sonarcloud.io" export SQC_US_TOKEN="sqc-us-token" -export SQC_US_URL="https://sonarqube-us.example.com" GITHUB_EVENT_PATH=$(mktemp) export GITHUB_EVENT_PATH echo '{}' > "$GITHUB_EVENT_PATH" @@ -332,7 +330,7 @@ Describe 'sonar_scanner_implementation()' End It 'runs sonar scanner with region parameter for sqc-us' - export SONAR_HOST_URL="https://sonarqube-us.example.com" + unset SONAR_HOST_URL export SONAR_TOKEN="us-token" export SONAR_REGION="us" export BUILD_NUMBER="42" @@ -342,6 +340,7 @@ Describe 'sonar_scanner_implementation()' When call sonar_scanner_implementation The status should be success The output should include "-Dsonar.region=us" + The output should not include "-Dsonar.host.url" End It 'runs sonar scanner with additional parameters' diff --git a/spec/build-poetry_spec.sh b/spec/build-poetry_spec.sh index 33713e3b..22a22126 100755 --- a/spec/build-poetry_spec.sh +++ b/spec/build-poetry_spec.sh @@ -32,9 +32,7 @@ export GITHUB_RUN_ID="dummy-run-id" export SONAR_PLATFORM="next" export NEXT_URL="https://next.sonarqube.com" export NEXT_TOKEN="next-token" -export SQC_US_URL="https://sonarqube-us.com" export SQC_US_TOKEN="sqc-us-token" -export SQC_EU_URL="https://sonarcloud.io" export SQC_EU_TOKEN="sqc-eu-token" export DEPLOY="true" export RUN_SHADOW_SCANS="false" @@ -442,15 +440,15 @@ Describe 'build_poetry()' The line 22 should equal '::endgroup::' The line 23 should equal '::group::Sonar analysis on sqc-us' The line 24 should equal '--- ORCHESTRATOR: Analyzing with platform: sqc-us ---' - The line 25 should equal 'Using Sonar platform: sqc-us (URL: https://sonarqube-us.com)' + The line 25 should equal 'Using Sonar platform: sqc-us (URL: default)' The line 26 should equal 'poetry run pip install pysonar' - The line 28 should equal 'poetry run pysonar -Dsonar.host.url=https://sonarqube-us.com -Dsonar.token=sqc-us-token -Dsonar.analysis.buildNumber=42 -Dsonar.analysis.pipeline=dummy-run-id -Dsonar.analysis.repository=my-org/my-repo' + The line 28 should equal 'poetry run pysonar -Dsonar.region=us -Dsonar.token=sqc-us-token -Dsonar.analysis.buildNumber=42 -Dsonar.analysis.pipeline=dummy-run-id -Dsonar.analysis.repository=my-org/my-repo' The line 29 should equal '::endgroup::' The line 30 should equal '::group::Sonar analysis on sqc-eu' The line 31 should equal '--- ORCHESTRATOR: Analyzing with platform: sqc-eu ---' - The line 32 should equal 'Using Sonar platform: sqc-eu (URL: https://sonarcloud.io)' + The line 32 should equal 'Using Sonar platform: sqc-eu (URL: default)' The line 33 should equal 'poetry run pip install pysonar' - The line 35 should equal 'poetry run pysonar -Dsonar.host.url=https://sonarcloud.io -Dsonar.token=sqc-eu-token -Dsonar.analysis.buildNumber=42 -Dsonar.analysis.pipeline=dummy-run-id -Dsonar.analysis.repository=my-org/my-repo' + The line 35 should equal 'poetry run pysonar -Dsonar.token=sqc-eu-token -Dsonar.analysis.buildNumber=42 -Dsonar.analysis.pipeline=dummy-run-id -Dsonar.analysis.repository=my-org/my-repo' The line 36 should equal '::endgroup::' The line 37 should equal '=== Completed Sonar analysis on all platforms ===' The stderr should include "::warning title=Deployment disabled::Shadow scans enabled - disabling deployment" diff --git a/spec/build-yarn_spec.sh b/spec/build-yarn_spec.sh index f945b126..9a58205a 100755 --- a/spec/build-yarn_spec.sh +++ b/spec/build-yarn_spec.sh @@ -60,9 +60,7 @@ export SONAR_PLATFORM="next" export RUN_SHADOW_SCANS="false" export NEXT_URL="https://next.sonarqube.com" export NEXT_TOKEN="next-token" -export SQC_US_URL="https://sonarqube-us.example.com" export SQC_US_TOKEN="sqc-us-token" -export SQC_EU_URL="https://sonarcloud.io" export SQC_EU_TOKEN="sqc-eu-token" export DEPLOY="true" export DEPLOY_PULL_REQUEST="false" SKIP_TESTS="false" DEFAULT_BRANCH="main" PULL_REQUEST="" @@ -311,7 +309,7 @@ Describe 'build-yarn/build.sh' End It 'runs sonar scanner with region parameter for sqc-us' - export SONAR_HOST_URL="https://sonarqube-us.example.com" + unset SONAR_HOST_URL export SONAR_TOKEN="us-token" export SONAR_REGION="us" export BUILD_NUMBER="42" @@ -322,6 +320,7 @@ Describe 'build-yarn/build.sh' When call sonar_scanner_implementation The status should be success The output should include "-Dsonar.region=us" + The output should not include "-Dsonar.host.url" End It 'runs sonar scanner with additional parameters' diff --git a/spec/shared-functions_spec.sh b/spec/shared-functions_spec.sh index 3a5b902b..5618d687 100755 --- a/spec/shared-functions_spec.sh +++ b/spec/shared-functions_spec.sh @@ -2,9 +2,7 @@ eval "$(shellspec - -c) exit 1" export NEXT_URL="https://next.sonarqube.com" export NEXT_TOKEN="next-token" -export SQC_US_URL="https://sonarqube-us.example.com" export SQC_US_TOKEN="sqc-us-token" -export SQC_EU_URL="https://sonarcloud.io" export SQC_EU_TOKEN="sqc-eu-token" Describe 'shared/common-functions.sh' @@ -22,16 +20,18 @@ Describe 'shared/common-functions.sh' It 'sets sonar variables for sqc-us platform' When call set_sonar_platform_vars "sqc-us" The status should be success - The line 1 should equal "Using Sonar platform: sqc-us (URL: sonarqube-us.example.com, Region: us)" - The variable SONAR_HOST_URL should equal "https://sonarqube-us.example.com" + The line 1 should equal "Using Sonar platform: sqc-us (URL: default, Region: us)" + The variable SONAR_HOST_URL should be undefined + The variable SONAR_REGION should equal "us" The variable SONAR_TOKEN should equal "sqc-us-token" End It 'sets sonar variables for sqc-eu platform' When call set_sonar_platform_vars "sqc-eu" The status should be success - The line 1 should equal "Using Sonar platform: sqc-eu (URL: sonarcloud.io, Region: none)" - The variable SONAR_HOST_URL should equal "https://sonarcloud.io" + The line 1 should equal "Using Sonar platform: sqc-eu (URL: default, Region: none)" + The variable SONAR_HOST_URL should be undefined + The variable SONAR_REGION should be undefined The variable SONAR_TOKEN should equal "sqc-eu-token" End @@ -59,7 +59,7 @@ Describe 'shared/common-functions.sh' Describe 'require_sonar_env()' check_sonar_env() ( - unset NEXT_URL NEXT_TOKEN SQC_US_URL SQC_US_TOKEN SQC_EU_URL SQC_EU_TOKEN + unset NEXT_URL NEXT_TOKEN SQC_US_TOKEN SQC_EU_TOKEN local environment="$1" assignments assignment IFS=' ' read -ra assignments <<< "$environment" for assignment in "${assignments[@]}"; do @@ -73,9 +73,9 @@ Describe 'shared/common-functions.sh' Parameters "RUN_SHADOW_SCANS=false SONAR_PLATFORM=none" "RUN_SHADOW_SCANS=false SONAR_PLATFORM=next NEXT_URL=u NEXT_TOKEN=t" - "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-us SQC_US_URL=u SQC_US_TOKEN=t" - "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-eu SQC_EU_URL=u SQC_EU_TOKEN=t" - "RUN_SHADOW_SCANS=true SONAR_PLATFORM=none NEXT_URL=u NEXT_TOKEN=t SQC_US_URL=u SQC_US_TOKEN=t SQC_EU_URL=u SQC_EU_TOKEN=t" + "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-us SQC_US_TOKEN=t" + "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-eu SQC_EU_TOKEN=t" + "RUN_SHADOW_SCANS=true SONAR_PLATFORM=none NEXT_URL=u NEXT_TOKEN=t SQC_US_TOKEN=t SQC_EU_TOKEN=t" End It "succeeds with: $1" @@ -86,9 +86,9 @@ Describe 'shared/common-functions.sh' Describe 'when a variable of an analyzed platform is missing' Parameters - "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-eu SQC_EU_URL=u" "SQC_EU_TOKEN" - "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-us SQC_EU_URL=u SQC_EU_TOKEN=t" "SQC_US_URL" - "RUN_SHADOW_SCANS=true SONAR_PLATFORM=sqc-eu SQC_EU_URL=u SQC_EU_TOKEN=t" "NEXT_URL" + "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-eu" "SQC_EU_TOKEN" + "RUN_SHADOW_SCANS=false SONAR_PLATFORM=sqc-us SQC_EU_TOKEN=t" "SQC_US_TOKEN" + "RUN_SHADOW_SCANS=true SONAR_PLATFORM=sqc-eu SQC_EU_TOKEN=t" "NEXT_URL" End It "fails with: $1"