fix(sonar): declare SONAR_TOKEN instead of inheriting every secret by usetheodev · Pull Request #29 · usetheokit/shared-workflows

usetheodev · 2026-08-27T18:46:41Z

Ajuste no workflow adicionado em #28, encontrado rodando o zizmor localmente contra os quatro repositórios que vão adotá-lo — antes de empurrar, em vez de assistir quatro CIs ficarem vermelhos.

O que muda

secrets: inherit entrega ao workflow chamado todos os secrets do caller. O zizmor sinaliza isso (secrets-inherit) com razão: este workflow precisa de um token para publicar uma análise, e herdar dá a ele credenciais de npm, chave privada de app e o que mais o repositório carregue.

Agora o secret é declarado por nome, e os callers passam só ele:

secrets:
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

required: false de propósito — um repositório sem o secret continua rodando o job, que avisa e pula. É isso que permite adotar o workflow antes do secret existir.

O outro achado do zizmor

unpinned-uses na chamada @v1. Não é para corrigir com um SHA: @v1 é ref móvel por design, do mesmo jeito que actions/setup@v1 é usado em todo o ecossistema — uma correção de política no shared-workflows precisa alcançar todos os callers sem onze pull requests, que é a razão deste repositório existir. Suprimido inline nos callers com a justificativa escrita ao lado.

Verificado: zizmor --min-severity low limpo neste workflow e nos quatro ci.yml que o chamam.

🤖 Generated with Claude Code

https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq

CI-based analysis, because Automatic Analysis does not import coverage — its own documentation says "code coverage information is not supported". The nine `theokit*` projects were analysing today and reporting no coverage at all, which leaves the quality gate blind to the metric the suites are actually enforcing. One workflow rather than a step copied into eight repositories, and the reason is measured. The one inline version that existed — `theokit-tui`, added by B-126 — carried `if: matrix.node-version == '22.x'` against a matrix of `['22.12', '22']`. That value never occurs, so the step reported `skipped` on every run since it was written, and a skipped step renders exactly like a passing one. Copying it eight times would have copied that. Three decisions worth stating: - `fetch-depth: 0`. On a shallow clone every line looks like it arrived in the last commit, so the scanner attributes all issues to it and the new-code period — which is what the quality gate measures — describes the wrong change. - Coverage runs with `continue-on-error`. The caller's own test job gates the suite; here a broken coverage run should cost the coverage number, not take the security findings down with it. - `sonar-project.properties` is required, not defaulted. Without it the scanner analyses build output and reports a file as a duplicate of its own bundle — measured on theokit-tui. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq

… does not replace it The header claimed SonarCloud "disables Automatic Analysis for a project as soon as a CI-based analysis reports". It does not. The scanner fails: [ERROR] ScannerEngine: You are running CI analysis while Automatic Analysis is enabled. Please consider disabling one or the other. Measured on theokit-tui: with the step finally executing (the `22.x` condition fixed) and the token present, the run failed on exactly this and nothing else. Turning the toggle off by hand under Administration > Analysis Method is a prerequisite, not something the workflow handles. Written down here because a caller reading the old sentence would adopt the workflow and get a red check with no idea it needed a manual step. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq

…everything `secrets: inherit` hands the called workflow every secret the caller holds. zizmor flags it (`secrets-inherit`), and it is right to: this workflow needs one token to publish an analysis, and inheriting gives it npm credentials, app private keys and anything else the repository carries. Declared as `required: false`, so a repository without the secret still runs the job — the existing step warns and skips rather than failing, which is what lets a repository adopt the workflow before the secret exists. Caught by running zizmor locally against the four callers before pushing them, rather than by watching four CI runs go red. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq

Add/add conflict: #28 introduced the file on main, this branch carries the same file with SONAR_TOKEN declared instead of inherited. Resolved to this branch, which is a superset — the only line unique to main was the usage example that #29 updates.

The previous run ended in startup_failure: the caller passes SONAR_TOKEN, and the shared workflow at v1 did not yet declare it — passing an undeclared secret stops the workflow from loading at all, before any step runs. usetheokit/shared-workflows#29 declares it and v1 now points at that commit.

@v1

* ci(sonar): analyse from CI, with coverage Automatic Analysis does not import coverage — "code coverage information is not supported" in its own documentation — so this project reported bugs and smells while the quality gate stayed blind to how much of the code the suite reaches. Two changes make that work: - `lcov` joins the coverage reporters. It is not in vitest's default set (text/html/clover/json), and naming any reporter replaces the set rather than extending it, so the defaults are repeated here instead of silently dropped. Verified: `pnpm test:coverage` writes `packages/studio/coverage/lcov.info` (30 KB). - The CI calls the shared `sonar.yml` rather than inlining a step. The one repository that had an inline version carried `if: matrix.node-version == '22.x'` against a matrix of ['22.12', '22'], a value that never occurs — the step reported `skipped` on every run for two months, and a skipped step renders exactly like a passing one. Automatic Analysis is switched off for this project in SonarCloud, which is a prerequisite rather than a preference: the scanner refuses to run beside it with "You are running CI analysis while Automatic Analysis is enabled." Proven on theokit-tui first, where the same three pieces produced 97.7% coverage over 9,265 lines on PR #167. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq * ci(sonar): name the secret the scanner needs, and say why @v1 stays unpinned zizmor rejected the first version of this job on two counts, and only one of them was a suppression: - `secrets: inherit` hands the called workflow every secret this repository holds. The scanner needs one token to publish an analysis; it now receives exactly that one. Fixed rather than silenced. - `unpinned-uses` on `@v1`. Suppressed, with the reason next to it: `@v1` is a moving ref by design — the same way `actions/setup@v1` is used across this ecosystem — because a policy fix in shared-workflows has to reach every caller without eleven pull requests. Pinning a SHA here would defeat the reason that repository exists. Verified with `zizmor --min-severity low` locally before pushing, after four CI runs had already gone red on the first version. * ci: re-run with v1 carrying the declared SONAR_TOKEN The previous run ended in startup_failure: the caller passes SONAR_TOKEN, and the shared workflow at v1 did not yet declare it — passing an undeclared secret stops the workflow from loading at all, before any step runs. usetheokit/shared-workflows#29 declares it and v1 now points at that commit. --------- Co-authored-by: paulohenriquevn <paulohenriquevn@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

# Conflicts: # .github/workflows/sonar.yml

@v1

* ci(sonar): analyse from CI, so the coverage floors reach the quality gate The `coverage floors` job has been measuring `@theokit/sdk` all along, and `packages/sdk/vitest.config.ts` already emits lcov. What was missing was anything reading it: Automatic Analysis cannot import coverage — "code coverage information is not supported" in its own documentation — so the gate saw bugs and smells and nothing about what the tests reach. Scope stated rather than implied: `quality:coverage` runs `@theokit/sdk` only, which is where the floors are enforced. The other fourteen packages get bugs and smells with no coverage figure. `sonar-project.properties` lists all fifteen lcov paths anyway — the scanner ignores one it cannot find, so each package starts reporting the day it joins the coverage run, with no second edit here. The workflow comes from shared-workflows. The ecosystem's only inline version carried `if: matrix.node-version == '22.x'` against a matrix of ['22.12', '22'] and reported `skipped` on every run for two months; a skipped step renders exactly like a passing one. Automatic Analysis switched off for this project, which the scanner requires rather than prefers: "You are running CI analysis while Automatic Analysis is enabled." Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186oaXQM4r2CdhRJgdTGhLq * ci(sonar): name the secret the scanner needs, and say why @v1 stays unpinned zizmor rejected the first version of this job on two counts, and only one of them was a suppression: - `secrets: inherit` hands the called workflow every secret this repository holds. The scanner needs one token to publish an analysis; it now receives exactly that one. Fixed rather than silenced. - `unpinned-uses` on `@v1`. Suppressed, with the reason next to it: `@v1` is a moving ref by design — the same way `actions/setup@v1` is used across this ecosystem — because a policy fix in shared-workflows has to reach every caller without eleven pull requests. Pinning a SHA here would defeat the reason that repository exists. Verified with `zizmor --min-severity low` locally before pushing, after four CI runs had already gone red on the first version. * ci: re-run with v1 carrying the declared SONAR_TOKEN The previous run ended in startup_failure: the caller passes SONAR_TOKEN, and the shared workflow at v1 did not yet declare it — passing an undeclared secret stops the workflow from loading at all, before any step runs. usetheokit/shared-workflows#29 declares it and v1 now points at that commit. * fix(ci): the sonar job has to build before it can measure anything The first analysis passed both checks and reported no coverage at all. The scanner said only `No coverage information will be saved because all LCOV files cannot be found`; the reason was one step above, swallowed by `continue-on-error`: Failed to resolve entry for package "@theokit/sdk" sdk-cache: missing dist/index.js — run 'pnpm build' → Failed Suites 9, no lcov written. The packages here import each other through their published entry points, which is why the `coverage floors` job in this same file builds first. The shared workflow gained a `build-command` input for it (shared-workflows#30). --------- Co-authored-by: paulohenriquevn <paulohenriquevn@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

paulohenriquevn and others added 4 commits August 27, 2026 15:12

usetheodev merged commit bdc26bb into main Aug 27, 2026
8 checks passed

usetheodev pushed a commit that referenced this pull request Aug 27, 2026

chore: merge main — the squash of #29 arrives as a different commit

91426c2

# Conflicts: # .github/workflows/sonar.yml

Navigation Menu

Uh oh!

fix(sonar): declare SONAR_TOKEN instead of inheriting every secret - #29

fix(sonar): declare SONAR_TOKEN instead of inheriting every secret#29
usetheodev merged 4 commits into
mainfrom
workspace

usetheodev commented Aug 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

usetheodev commented Aug 27, 2026

O que muda

O outro achado do zizmor

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants