Enable SonarQube analysis in nightly test pipeline#1109
Draft
rgsl888prabhu wants to merge 4 commits intomainfrom
Draft
Enable SonarQube analysis in nightly test pipeline#1109rgsl888prabhu wants to merge 4 commits intomainfrom
rgsl888prabhu wants to merge 4 commits intomainfrom
Conversation
Add a sonarqube-analysis job to the nightly test workflow that runs sonar-scanner against the source tree. The job checks out the target commit with full history, downloads sonar-scanner CLI, and reports results to sonar.nvidia.com using the SONAR_TOKEN secret. Also updates sonar-branches.txt to reference release/26.06. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds a workflow_dispatch-triggered sonarqube.yaml so the SonarQube analysis can be run on-demand from the Actions tab without waiting for the full nightly pipeline. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
📝 WalkthroughWalkthroughA SonarQube analysis workflow is introduced with three components: a standalone GitHub Actions workflow for manual triggering, a job integrated into the nightly build pipeline, and a shell script orchestrating the SonarQube scanner execution. Additionally, the configured release branch list is updated. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/sonarqube.yaml (1)
14-17: Set explicit minimalGITHUB_TOKENpermissions for this workflow.Defining least-privilege permissions avoids inheriting broader repo defaults.
🔐 Suggested addition
jobs: sonarqube-analysis: + permissions: + contents: read runs-on: ubuntu-latest timeout-minutes: 30🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/sonarqube.yaml around lines 14 - 17, Add an explicit minimal GITHUB_TOKEN permissions block for the workflow so the sonarqube-analysis job does not inherit broad repo defaults; add a top-level or job-level permissions section (referencing the job name sonarqube-analysis) that grants only the required scopes such as permissions: contents: read, checks: write, and actions: read (and/or pull-requests: write if your Sonar step updates PRs), placing it above jobs or inside the sonarqube-analysis job as appropriate.ci/run_sonarqube.sh (1)
10-13: Preferset -ufail-fast instead of a custom SONAR_TOKEN guard.This can be simplified while keeping the same behavior.
♻️ Proposed refactor
-if [ -z "${SONAR_TOKEN:-}" ]; then - echo "ERROR: SONAR_TOKEN environment variable is not set" - exit 1 -fi +: "${SONAR_TOKEN}"Based on learnings: In this repository, prefer using 'set -u' in Bash scripts to detect unbound variables and rely on the default unbound-variable error messages rather than implementing explicit guards with custom error messages.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ci/run_sonarqube.sh` around lines 10 - 13, Replace the explicit SONAR_TOKEN guard with Bash fail-fast by enabling unbound-variable checking: add a top-level shell option (e.g., set -u or set -eu) and remove the explicit if [ -z "${SONAR_TOKEN:-}" ] ... fi block that checks SONAR_TOKEN; this will cause the script to fail with the standard unbound-variable error when SONAR_TOKEN is not set and preserves the intended behavior while simplifying the script (locate references to SONAR_TOKEN and the if-check block to remove and add the set -u/-eu at the script start).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sonarqube.yaml:
- Around line 19-25: The workflow checks out the repository but may not use the
same ref that is passed to SonarQube (inputs.branch or github.ref_name); update
the checkout step (actions/checkout@v4) to use the same ref value passed into
ci/run_sonarqube.sh by adding ref: ${{ inputs.branch || github.ref_name }} (keep
fetch-depth: 0) so the checked-out code matches the branch label used by
SonarQube.
In `@ci/run_sonarqube.sh`:
- Around line 21-24: Add integrity verification for the downloaded Sonar
scanner: after downloading the archive into /tmp/sonar-scanner.zip compute its
checksum (e.g., sha256) and compare it against a trusted checksum source before
unzipping; fetch the corresponding checksum file or hardcode a verified checksum
and validate it, and abort with a clear error if the checksums mismatch. Update
the run_sonarqube.sh flow around the existing
SONAR_SCANNER_VERSION/SONAR_SCANNER_DIR/SONAR_SCANNER_BIN logic so the script
only runs unzip and sets SONAR_SCANNER_BIN when the checksum verification
passes.
---
Nitpick comments:
In @.github/workflows/sonarqube.yaml:
- Around line 14-17: Add an explicit minimal GITHUB_TOKEN permissions block for
the workflow so the sonarqube-analysis job does not inherit broad repo defaults;
add a top-level or job-level permissions section (referencing the job name
sonarqube-analysis) that grants only the required scopes such as permissions:
contents: read, checks: write, and actions: read (and/or pull-requests: write if
your Sonar step updates PRs), placing it above jobs or inside the
sonarqube-analysis job as appropriate.
In `@ci/run_sonarqube.sh`:
- Around line 10-13: Replace the explicit SONAR_TOKEN guard with Bash fail-fast
by enabling unbound-variable checking: add a top-level shell option (e.g., set
-u or set -eu) and remove the explicit if [ -z "${SONAR_TOKEN:-}" ] ... fi block
that checks SONAR_TOKEN; this will cause the script to fail with the standard
unbound-variable error when SONAR_TOKEN is not set and preserves the intended
behavior while simplifying the script (locate references to SONAR_TOKEN and the
if-check block to remove and add the set -u/-eu at the script start).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9ac0d49f-4356-46e9-895a-f522ca4b7838
📒 Files selected for processing (4)
.github/workflows/sonarqube.yaml.github/workflows/test.yamlci/run_sonarqube.shsonarqube/sonar-branches.txt
Comment on lines
+19
to
+25
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Run SonarQube analysis | ||
| env: | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | ||
| run: ci/run_sonarqube.sh "${{ inputs.branch || github.ref_name }}" |
There was a problem hiding this comment.
Branch label can diverge from checked-out code.
The workflow passes an effective branch name to SonarQube, but checkout always uses the workflow’s current ref. This can publish analysis under the wrong branch name.
🐛 Proposed fix
- uses: actions/checkout@v4
with:
+ ref: ${{ inputs.branch || github.ref_name }}
fetch-depth: 0
- name: Run SonarQube analysis
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
- run: ci/run_sonarqube.sh "${{ inputs.branch || github.ref_name }}"
+ run: bash ci/run_sonarqube.sh "${{ inputs.branch || github.ref_name }}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run SonarQube analysis | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| run: ci/run_sonarqube.sh "${{ inputs.branch || github.ref_name }}" | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ inputs.branch || github.ref_name }} | |
| fetch-depth: 0 | |
| - name: Run SonarQube analysis | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| run: bash ci/run_sonarqube.sh "${{ inputs.branch || github.ref_name }}" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/sonarqube.yaml around lines 19 - 25, The workflow checks
out the repository but may not use the same ref that is passed to SonarQube
(inputs.branch or github.ref_name); update the checkout step
(actions/checkout@v4) to use the same ref value passed into ci/run_sonarqube.sh
by adding ref: ${{ inputs.branch || github.ref_name }} (keep fetch-depth: 0) so
the checked-out code matches the branch label used by SonarQube.
Comment on lines
+21
to
+24
| curl -sSLo /tmp/sonar-scanner.zip \ | ||
| "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_SCANNER_VERSION}-linux-x64.zip" | ||
| unzip -q /tmp/sonar-scanner.zip -d "${SONAR_SCANNER_DIR}" | ||
| SONAR_SCANNER_BIN="${SONAR_SCANNER_DIR}/sonar-scanner-${SONAR_SCANNER_VERSION}-linux-x64/bin/sonar-scanner" |
There was a problem hiding this comment.
Verify scanner archive integrity before executing downloaded binaries.
The script downloads and executes tooling without checksum verification, which is a supply-chain risk.
🔒 Suggested hardening
SONAR_SCANNER_VERSION="6.2.1.4610"
+SONAR_SCANNER_SHA256="${SONAR_SCANNER_SHA256:?SONAR_SCANNER_SHA256 is required}"
...
-curl -sSLo /tmp/sonar-scanner.zip \
+curl --fail --silent --show-error --location --retry 3 --retry-delay 2 \
+ -o /tmp/sonar-scanner.zip \
"https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_SCANNER_VERSION}-linux-x64.zip"
+echo "${SONAR_SCANNER_SHA256} /tmp/sonar-scanner.zip" | sha256sum -c -
unzip -q /tmp/sonar-scanner.zip -d "${SONAR_SCANNER_DIR}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| curl -sSLo /tmp/sonar-scanner.zip \ | |
| "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_SCANNER_VERSION}-linux-x64.zip" | |
| unzip -q /tmp/sonar-scanner.zip -d "${SONAR_SCANNER_DIR}" | |
| SONAR_SCANNER_BIN="${SONAR_SCANNER_DIR}/sonar-scanner-${SONAR_SCANNER_VERSION}-linux-x64/bin/sonar-scanner" | |
| SONAR_SCANNER_VERSION="6.2.1.4610" | |
| SONAR_SCANNER_SHA256="${SONAR_SCANNER_SHA256:?SONAR_SCANNER_SHA256 is required}" | |
| curl --fail --silent --show-error --location --retry 3 --retry-delay 2 \ | |
| -o /tmp/sonar-scanner.zip \ | |
| "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_SCANNER_VERSION}-linux-x64.zip" | |
| echo "${SONAR_SCANNER_SHA256} /tmp/sonar-scanner.zip" | sha256sum -c - | |
| unzip -q /tmp/sonar-scanner.zip -d "${SONAR_SCANNER_DIR}" | |
| SONAR_SCANNER_BIN="${SONAR_SCANNER_DIR}/sonar-scanner-${SONAR_SCANNER_VERSION}-linux-x64/bin/sonar-scanner" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ci/run_sonarqube.sh` around lines 21 - 24, Add integrity verification for the
downloaded Sonar scanner: after downloading the archive into
/tmp/sonar-scanner.zip compute its checksum (e.g., sha256) and compare it
against a trusted checksum source before unzipping; fetch the corresponding
checksum file or hardcode a verified checksum and validate it, and abort with a
clear error if the checksums mismatch. Update the run_sonarqube.sh flow around
the existing SONAR_SCANNER_VERSION/SONAR_SCANNER_DIR/SONAR_SCANNER_BIN logic so
the script only runs unzip and sets SONAR_SCANNER_BIN when the checksum
verification passes.
Temporary push trigger to validate the workflow before merging. Remove before merge. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use sonar.scanner.socketTimeout instead of deprecated sonar.ws.timeout. Remove the temporary push trigger from sonarqube.yaml used for testing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sonarqube-analysisjob to nightlytest.yaml(source-only scan onubuntu-latest)sonarqube.yamlworkflow for on-demand manual testingci/run_sonarqube.shto download sonar-scanner and run analysisPrerequisite
SONAR_TOKENsecret must be configured in repo settingsTest plan
SONAR_TOKENsecret in repo settingssonarqube.yamlmanually from Actions tab to verify end-to-end🤖 Generated with Claude Code