wrangling sonar (kroxylicious#3135)

SamBarker · web-flow · commit 7d020486e8ad · 2026-01-13T21:46:11.000Z
* caches are branch scoped so we don't need to limit it to main See https://github.com/marketplace/actions/cache#cache-scopes Signed-off-by: Sam Barker <sam@quadrocket.co.uk> * Try a different syntax for reffering to env var Signed-off-by: Sam Barker <sam@quadrocket.co.uk> * Set project name when running the job Signed-off-by: Sam Barker <sam@quadrocket.co.uk> * only run sonar actions if sonar token available. Signed-off-by: Sam Barker <sam@quadrocket.co.uk> * Move sonar properties into pom Signed-off-by: Sam Barker <sam@quadrocket.co.uk> * Ensure renovate scans all workflows for sonar versions. Signed-off-by: Sam Barker <sam@quadrocket.co.uk> --------- Signed-off-by: Sam Barker <sam@quadrocket.co.uk>
diff --git a/.github/renovate.json b/.github/renovate.json
@@ -122,8 +122,8 @@
     {
       "customType": "regex",
       "fileMatch": [
-        ".github/workflows/maven.yaml",
-        ".github/workflows/sonar.yaml"],
+        ".github/workflows/*.yaml"
+        ],
       "matchStrings": [
         "(?<depName>org.sonarsource.scanner.maven:sonar-maven-plugin):(?<currentValue>\\d+\\.\\d+\\.\\d+\\.\\d+)"
       ],
diff --git a/.github/workflows/maven.yaml b/.github/workflows/maven.yaml
@@ -64,13 +64,6 @@ jobs:
         run: |
           REFERENCE_RELEASE=$(mvn --quiet -pl kroxylicious-api help:evaluate -Dexpression=ApiCompatability.ReferenceVersion -DforceStdout)
           echo "REFERENCE_RELEASE_UNPUBLISHED=$(mvn --quiet dependency:get -Dartifact=io.kroxylicious:kroxylicious-parent:${REFERENCE_RELEASE}:pom 1>/dev/null && echo false || echo true)" >> $GITHUB_ENV
-      - name: Cache SonarCloud packages
-        uses: actions/cache@v5
-        if: github.ref_name == 'main' || env.SONAR_TOKEN_SET == 'true'
-        with:
-          path: ~/.sonar/cache
-          key: ${{ runner.os }}-sonar
-          restore-keys: ${{ runner.os }}-sonar
       - name: 'Cache Maven packages'
         uses: actions/cache@v5
         with:
@@ -89,6 +82,13 @@ jobs:
           # KROXYLICIOUS_IMAGE env var is used by the Operator ITs
           echo "KROXYLICIOUS_IMAGE=${KROXYLICIOUS_IMAGE}" >> "$GITHUB_ENV"
           mvn -B install -DskipITs -Pci -Djapicmp.skip=${REFERENCE_RELEASE_UNPUBLISHED}
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v5
+        if: github.ref_name == 'main' || env.SONAR_TOKEN_SET == 'true'
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
       - name: 'Build Kroxylicious maven project on main with Sonar'
         if: github.event_name == 'push' && github.ref_name == 'main' && env.SONAR_TOKEN_SET == 'true'
         env:
@@ -97,4 +97,4 @@ jobs:
           KROXYLICIOUS_KMS_FORTANIX_API_ENDPOINT: ${{ vars.KROXYLICIOUS_KMS_FORTANIX_API_ENDPOINT }}
           KROXYLICIOUS_KMS_FORTANIX_ADMIN_API_KEY: ${{ secrets.KROXYLICIOUS_KMS_FORTANIX_ADMIN_API_KEY }}
           KROXYLICIOUS_KMS_FORTANIX_API_KEY: ${{ secrets.KROXYLICIOUS_KMS_FORTANIX_API_KEY }}
-        run: mvn -B verify -Pci -Djapicmp.skip=${REFERENCE_RELEASE_UNPUBLISHED} org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar -Dsonar.projectKey=kroxylicious_kroxylicious  -pl ''!:kroxylicious-operator''
+        run: mvn -B verify -Pci -Djapicmp.skip=${REFERENCE_RELEASE_UNPUBLISHED} org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar  -pl ''!:kroxylicious-operator''
diff --git a/.github/workflows/operator-maven.yaml b/.github/workflows/operator-maven.yaml
@@ -76,7 +76,7 @@ jobs:
           minikube image ls | grep --fixed-strings ${KROXYLICIOUS_IMAGE}
       - name: Cache SonarCloud packages
         uses: actions/cache@v5
-        if: github.ref_name == 'main' || env.SONAR_TOKEN_SET == 'true'
+        if: github.ref_name == 'main' && env.SONAR_TOKEN_SET == 'true'
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
@@ -91,7 +91,7 @@ jobs:
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mvn -B verify -Pci -Djapicmp.skip=true org.sonarsource.scanner.maven:sonar-maven-plugin:5.0.0.4389:sonar -Dsonar.projectKey=kroxylicious_operator -pl ':kroxylicious-operator,:kroxylicious-parent'
+        run: mvn -B verify -Pci -Djapicmp.skip=true org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar -pl ':kroxylicious-operator,:kroxylicious-parent'
       - name: Save PR number to file
         if: github.event_name == 'pull_request'
         run: echo ${{ github.event.number }} > PR_NUMBER.txt
diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
@@ -21,17 +21,20 @@ jobs:
           echo "SONAR_TOKEN_SET=$(test ${SONAR_TOKEN} && echo true)" >> $GITHUB_ENV
       - name: Download PR number artifact
         uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392
+        if: env.SONAR_TOKEN_SET == 'true'
         with:
           workflow: Build
           run_id: ${{ github.event.workflow_run.id }}
           name: PR_NUMBER
       - name: Read PR_NUMBER.txt
         id: pr_number
         uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58
+        if: env.SONAR_TOKEN_SET == 'true'
         with:
           path: ./PR_NUMBER.txt
       - name: Request GitHub API for PR data
         uses: octokit/request-action@05a2312de9f8207044c4c9e41fe19703986acc13
+        if: env.SONAR_TOKEN_SET == 'true'
         id: get_pr_data
         with:
           route: GET /repos/{full_name}/pulls/{number}
@@ -40,11 +43,15 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/checkout@v6
+        if: env.SONAR_TOKEN_SET == 'true'
         with:
           repository: ${{ github.event.workflow_run.head_repository.full_name }}
-          ref: ${{ github.event.workflow_run.head_branch }}
+          ref: $HEAD_REF
           fetch-depth: 0
+        env:
+          HEAD_REF: ${{ github.event.workflow_run.head_branch }}
       - name: Checkout base branch
+        if: env.SONAR_TOKEN_SET == 'true'
         env:
           HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
@@ -55,31 +62,36 @@ jobs:
           git clean -ffdx && git reset --hard HEAD
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
+        if: env.SONAR_TOKEN_SET == 'true'
       - name: Set up JDK 21
         uses: actions/setup-java@v5
+        if: env.SONAR_TOKEN_SET == 'true'
         with:
           java-version: 21
           distribution: 'temurin'
       - name: 'Cache Maven packages'
         uses: actions/cache/restore@v5
+        if: env.SONAR_TOKEN_SET == 'true'
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-m2
       - name: Cache SonarCloud packages
         uses: actions/cache@v5
-        if: github.ref_name == 'main' || env.SONAR_TOKEN_SET == 'true'
+        if: env.SONAR_TOKEN_SET == 'true'
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
       - name: SonarCloud scan on PR for the Proxy Runtime
-        run: mvn -B clean verify -Pci -DskipITs=true org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar -Djapicmp.skip=true -Dsonar.projectKey=kroxylicious_kroxylicious -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }} -Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }} -Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }} -Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}  -pl ''!:kroxylicious-operator''
+        if: env.SONAR_TOKEN_SET == 'true'
+        run: mvn -B clean verify -Pci -DskipITs=true org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar -Djapicmp.skip=true -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }} -Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }} -Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }} -Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }}  -pl ''!:kroxylicious-operator''
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: SonarCloud scan on PR for the Operator
-        run: mvn -B clean verify -Pci -DskipITs=true org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar -Djapicmp.skip=true -Dsonar.projectKey=kroxylicious_operator -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }} -Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }} -Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }} -Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }} -pl ':kroxylicious-operator,:kroxylicious-parent'
+        if: env.SONAR_TOKEN_SET == 'true'
+        run: mvn -B clean verify -Pci -DskipITs=true org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar -Djapicmp.skip=true -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }} -Dsonar.pullrequest.key=${{ fromJson(steps.get_pr_data.outputs.data).number }} -Dsonar.pullrequest.branch=${{ fromJson(steps.get_pr_data.outputs.data).head.ref }} -Dsonar.pullrequest.base=${{ fromJson(steps.get_pr_data.outputs.data).base.ref }} -pl ':kroxylicious-operator,:kroxylicious-parent'
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/kroxylicious-operator/pom.xml b/kroxylicious-operator/pom.xml
@@ -25,6 +25,8 @@
         <prometheus-metrics.version>1.4.3</prometheus-metrics.version>
         <io.kroxylicious.operator.image.name>quay.io/kroxylicious/operator:${project.version}</io.kroxylicious.operator.image.name>
         <io.kroxylicious.operator.image.archive>target/kroxylicious-operator.img.tar.gz</io.kroxylicious.operator.image.archive>
+        <sonar.projectName>Kroxylicious Operator</sonar.projectName>
+        <sonar.projectkey>kroxylicious_kroxylicious</sonar.projectkey>
     </properties>
 
     <dependencyManagement>
diff --git a/pom.xml b/pom.xml
@@ -1258,6 +1258,8 @@
             <properties>
                 <sonar.organization>kroxylicious</sonar.organization>
                 <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+                <sonar.projectName>Proxy Runtime</sonar.projectName>
+                <sonar.projectKey>kroxylicious_kroxylicious</sonar.projectKey>
                 <impsort-maven-plugin.goal>check</impsort-maven-plugin.goal>
                 <skip-validate-yaml-snippets>false</skip-validate-yaml-snippets>
             </properties>
