feat(sonar): a reusable SonarQube Cloud analysis workflow - #28
Merged
Conversation
CI-based analysis, because Automatic Analysis does not import coverage — its own documentation says "code coverage information is not supported". The nine `theokit*` projects were analysing today and reporting no coverage at all, which leaves the quality gate blind to the metric the suites are actually enforcing. One workflow rather than a step copied into eight repositories, and the reason is measured. The one inline version that existed — `theokit-tui`, added by B-126 — carried `if: matrix.node-version == '22.x'` against a matrix of `['22.12', '22']`. That value never occurs, so the step reported `skipped` on every run since it was written, and a skipped step renders exactly like a passing one. Copying it eight times would have copied that. Three decisions worth stating: - `fetch-depth: 0`. On a shallow clone every line looks like it arrived in the last commit, so the scanner attributes all issues to it and the new-code period — which is what the quality gate measures — describes the wrong change. - Coverage runs with `continue-on-error`. The caller's own test job gates the suite; here a broken coverage run should cost the coverage number, not take the security findings down with it. - `sonar-project.properties` is required, not defaulted. Without it the scanner analyses build output and reports a file as a duplicate of its own bundle — measured on theokit-tui. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq
… does not replace it
The header claimed SonarCloud "disables Automatic Analysis for a project as soon as a CI-based
analysis reports". It does not. The scanner fails:
[ERROR] ScannerEngine: You are running CI analysis while Automatic Analysis is enabled.
Please consider disabling one or the other.
Measured on theokit-tui: with the step finally executing (the `22.x` condition fixed) and the
token present, the run failed on exactly this and nothing else. Turning the toggle off by hand
under Administration > Analysis Method is a prerequisite, not something the workflow handles.
Written down here because a caller reading the old sentence would adopt the workflow and get a
red check with no idea it needed a manual step.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Análise via CI para o ecossistema, num lugar só.
Por que CI-based e não Automatic Analysis
A Automatic Analysis não importa cobertura — a documentação dela diz, literalmente, "code coverage information is not supported". Os nove projetos
theokit*passaram a analisar hoje e reportam cobertura nenhuma, o que deixa o quality gate cego justamente na métrica que as suítes já enforçam (otheokit-tuiexige 90%).Por que um workflow, e não um step copiado nove vezes
Porque existe a medição. A única versão inline do ecossistema —
theokit-tui, adicionada pela B-126 — carregava:Esse valor nunca ocorre. O step reportou
skippedem toda run desde que foi escrito, e um step pulado renderiza exatamente igual a um step que passou. Copiar isso oito vezes teria copiado a classe do defeito junto — que é o argumento que este repositório existe para fazer.Três decisões que valem estar escritas
fetch-depth: 0. Num clone raso toda linha parece ter chegado no último commit, então o scanner atribui todas as issues a ele e o período de new code — que é o que o quality gate mede — descreve a mudança errada.Cobertura roda com
continue-on-error. O job de teste do próprio caller é quem porteia a suíte; aqui uma falha na cobertura deve custar o número, não derrubar junto os achados de segurança.sonar-project.propertiesé obrigatório, não defaultado. Sem ele o scanner analisa build output e reporta um arquivo como duplicata do próprio bundle — medido notheokit-tui.E um
SONAR_TOKENausente avisa e pula em vez de falhar, para que adotar o workflow não deixe um repositório vermelho antes do secret existir.Uso
🤖 Generated with Claude Code
https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq