Noor1027/bb2 4975 sonarqube integration gha (#1650)

* Fix SonarQube job dependencies and use pytest

* fix module

* Fix Exec format error

* Update sonarqube.yml

* Run when code is merged o master

* Update sonarqube.yml

Author: noor1027

.github/workflows/sonarqube.yml

@@ -1,19 +1,18 @@
-# SonarQube Code Analysis
-# Migrated from Jenkins pipeline
+# Runs our SonarQube code analysis to check code quality and test coverage.
+# (This job was recently moved over from our old Jenkins pipeline!)
 
 name: SonarQube Analysis
 
 on:
   push:
     branches: 
       - master
-  pull_request:
-    branches: [master]
+
   workflow_dispatch:
 
 env:
-  # These values come from GitHub Repository Variables
-  # Settings → Secrets and variables → Actions → Variables
+  # We pull these configuration variables directly from GitHub.
+  # (You can find them in the repo under Settings -> Secrets and variables -> Actions -> Variables)
   SONARQUBE_URL: ${{ vars.SONARQUBE_URL }}
   SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY }}
   DJANGO_SETTINGS_MODULE: ${{ vars.DJANGO_SETTINGS_MODULE }}
@@ -22,7 +21,8 @@ env:
 jobs:
   sonarqube:
     name: SonarQube Analysis
-    # Use CodeBuild runner - runs inside CMS/AWS network, can reach internal SonarQube
+    # We use our custom AWS CodeBuild runner for this job because it runs 
+    # directly inside the CMS/AWS network, which allows it to securely talk to our internal SonarQube server!
     runs-on:
       - codebuild-bb-test-web-server-${{ github.run_id }}-${{ github.run_attempt }}
 
@@ -44,14 +44,15 @@ jobs:
           python3 -m venv /tmp/venv
           source /tmp/venv/bin/activate
           python3 -m pip install --upgrade pip setuptools wheel
-          pip install -r requirements/requirements.txt --no-deps --prefer-binary || pip install -r requirements/requirements.txt
-          pip install coverage pytest
+          pip install -r requirements/requirements.dev.txt --no-deps --prefer-binary --require-hashes
+          pip install coverage
           echo "/tmp/venv/bin" >> $GITHUB_PATH
 
       - name: Run tests with coverage
         run: |
           source /tmp/venv/bin/activate
-          coverage run runtests.py
+          export DJANGO_SETTINGS_MODULE="hhs_oauth_server.settings.test"
+          coverage run -m pytest -m 'not integration'
           coverage xml
 
       - name: Check SonarQube connectivity
@@ -64,16 +65,17 @@ jobs:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
           echo "Installing SonarQube scanner..."
-          curl -sSLo sonar-scanner.zip https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-5.0.1.3006-linux.zip
+          curl -sSLo sonar-scanner.zip https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-5.0.1.3006.zip
           unzip -q sonar-scanner.zip
-          export PATH="$PWD/sonar-scanner-5.0.1.3006-linux/bin:$PATH"
+          export PATH="$PWD/sonar-scanner-5.0.1.3006/bin:$PATH"
           
           echo "Running SonarQube analysis..."
           sonar-scanner \
             -Dsonar.projectKey=${{ env.SONAR_PROJECT_KEY }} \
             -Dsonar.sources=. \
             -Dsonar.host.url=${{ env.SONARQUBE_URL }} \
             -Dsonar.token=$SONAR_TOKEN \
+            -Dsonar.ci.autoconfig.disabled=true \
             -Dsonar.inclusions=apps/*/*.py,hhs_oauth_server/*/*.py \
             -Dsonar.exclusions=apps/*/management/migrations/*.py,apps/*/tests/*.py,apps/integration_tests/* \
             -Dsonar.python.coverage.reportPaths=coverage.xml