Skip to content

Commit b0940d1

Browse files
brianLoomisbrianLoomis
committed
language-specific sonar files, sonar scanner updated for akeyless secret, UDF fields on main pull request
1 parent fe924b4 commit b0940d1

File tree

10 files changed

+428
-73
lines changed

10 files changed

+428
-73
lines changed

‎.github/workflows/blackduck-polaris.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@
44
#
55
# from https://documentation.blackduck.com/bundle/bridge/page/documentation/t_github-polaris-quickstart.html
66
# parameters @ https://documentation.blackduck.com/bundle/bridge/page/documentation/c_github-polaris.html
7+
#
8+
# internal confluence https://progresssoftware.atlassian.net/wiki/spaces/TCE/pages/1010336076/Polaris#Examples
9+
# TODO: update internal page with final action
10+
# chehf-vault at https://polaris.blackduck.com/portfolio/portfolios/8b7ad6f7-6dcb-49ec-bded-bfc4f190d4f8/portfolio-items/fe369baf-11d2-4989-bcb7-045577856dcc/projects/2460eabd-d033-48a1-a378-6cadd49be6d1/tests/sast?branchId=a6d2c02a-05f8-4557-bfa1-c40e9337ee5d
711
name: Blackduck Polaris scan
812

913
on:

‎.github/workflows/ci-main-pull-request.yml‎

Lines changed: 70 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,6 @@ name: CI flow containing PR checks for main & release, v2
2222
on:
2323
workflow_call:
2424
inputs:
25-
language:
26-
description: 'Primary language in the repository, for language-specific checks'
27-
required: false
28-
type: string
29-
default: 'Go'
3025
visibility:
3126
description: 'Visibility of the repository'
3227
required: false
@@ -67,6 +62,11 @@ on:
6762
required: false
6863
type: boolean
6964
default: true
65+
language:
66+
description: 'Primary language in the repository, for language-specific 3rd party dep checks, builds, and unit testing'
67+
required: false
68+
type: string
69+
default: 'Go' # (Go, Ruby, Rust)
7070
unit-tests:
7171
description: 'Run unit tests (language-specific)'
7272
required: false
@@ -77,6 +77,51 @@ on:
7777
required: false
7878
type: boolean
7979
default: true
80+
perform-sonar-build:
81+
description: 'Perform the build (in specified language and profile)'
82+
required: false
83+
type: boolean
84+
default: true
85+
build-profile:
86+
description: 'Build profile for SonarQube - application specific path'
87+
required: false
88+
type: string
89+
default: 'default'
90+
report-unit-test-coverage:
91+
description: 'Perform unit tests and report coverage to SonarQube'
92+
required: false
93+
type: boolean
94+
default: true
95+
report-to-atlassian-dashboard:
96+
description: 'Report Sonar test coverage and other metrics to Atlassian dashboard (Irfan's QA dashboard)'
97+
required: false
98+
type: boolean
99+
default: true
100+
quality-product-name:
101+
description: 'Product name for quality reporting (Chef360, Courier, Inspec)'
102+
required: false
103+
type: string
104+
default: 'Chef360'
105+
quality-sonar-app-name:
106+
description: 'Sonar application name for quality reporting'
107+
required: false
108+
type: string
109+
default: 'YourSonarAppName'
110+
quality-testing-type:
111+
description: 'Testing type for quality reporting (Unit, Integration, e2e, api, Performance, Security)'
112+
required: false
113+
type: string
114+
default: 'Integration'
115+
quality-service-name:
116+
description: 'Service or repository name for quality reporting'
117+
required: false
118+
type: string
119+
default: 'YourServiceOrRepoName'
120+
quality-junit-report:
121+
description: 'Path to JUnit report for quality reporting'
122+
required: false
123+
type: string
124+
default: 'path/to/junit/report'
80125
perform-blackduck-coverity:
81126
description: 'Perform BlackDuck coverity scan'
82127
required: false
@@ -92,6 +137,26 @@ on:
92137
required: false
93138
type: boolean
94139
default: true
140+
go-private-modules:
141+
description: 'GOPRIVATE for Go private modules'
142+
required: false
143+
type: string
144+
default: 'github.com/progress-platform-services/*'
145+
udf1:
146+
description: 'User defined flag 1'
147+
required: false
148+
type: string
149+
default: 'default'
150+
udf2:
151+
description: 'User defined flag 2'
152+
required: false
153+
type: string
154+
default: 'default'
155+
udf3:
156+
description: 'User defined flag 3'
157+
required: false
158+
type: string
159+
default: 'default'
95160

96161
env:
97162
REPO_VISIBILITY: ${{ github.event.repository.visibility }}

‎.github/workflows/sbom.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ jobs:
125125

126126
# example project https://progresssoftware.app.blackduck.com/api/risk-profile-dashboard?limit=25&offset=0
127127
# server URL https://progresssoftware.app.blackduck.com/api/projects/c7954ee4-348d-4c2f-b259-d577e1df40dc
128+
# and https://progresssoftware.app.blackduck.com/api/risk-profile-dashboard?limit=25&offset=0
128129
#
129130
# Blackduck SBOM is at SERVER: https://progresssoftware.app.blackduck.com/ - org variable!
130131
# API token in repo - https://github.com/chef/chef-vault/settings/secrets/actions

‎.github/workflows/sonarqube-internal-repo.yml‎

Lines changed: 109 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -3,55 +3,135 @@ name: SonarQube scan for internal repositories
33
# configuration @ https://github.com/marketplace/actions/official-sonarqube-scan
44
# TODO: replace existing sonarqube.yml in PPS repos (like https://github.com/progress-platform-services/chef-node-enrollment-api/blob/main/.github/workflows/sonarqube.yml)
55
# TODO: remove from PPS code gen, just use the stub
6+
# TODO: add version to each pipeline stage
67

78
on:
89
workflow_call:
9-
10+
# all secrets are inherited from the calling workflow, typically SONAR_TOKEN, SONAR_HOST_URL, GH_TOKEN
11+
inputs:
12+
perform-build:
13+
required: false
14+
type: boolean
15+
build-profile: # TODO: implmenet this flag - chef360 container build flags, etc
16+
required: false
17+
type: string
18+
language:
19+
required: false
20+
type: string
21+
report-unit-test-coverage:
22+
required: false
23+
type: boolean
24+
report-to-atlassian-dashboard:
25+
required: false
26+
type: boolean
27+
quality-product-name:
28+
required: false
29+
type: string
30+
quality-sonar-app-name:
31+
required: false
32+
type: string
33+
quality-testing-type:
34+
required: false
35+
type: string
36+
quality-service-name:
37+
required: false
38+
type: string
39+
quality-junit-report:
40+
required: false
41+
type: string
42+
visibility: # TODO: simplify the sonar step by bringing in the other variants (private, public, internal) from the calling workflow
43+
required: false
44+
type: string
45+
go-private-modules:
46+
required: false
47+
type: string
48+
udf1:
49+
required: false
50+
type: string
51+
udf2:
52+
required: false
53+
type: string
54+
udf3:
55+
required: false
56+
type: string
57+
1058
jobs:
11-
# echo-inputs:
12-
# name: 'Echo inputs'
13-
# runs-on: ubuntu-latest
14-
# steps:
15-
# - name: Echo inputs
16-
# run: |
17-
# echo "Sonarqube scan for INTERNAL repositories, running on ubuntu-latest-4-cores runner"
18-
# echo "Sonar host URL ${{ secrets.SONAR_HOST_URL}}"
19-
# # echo "Skip unit tests set to ${{ inputs.skip-unit-tests }}"
20-
59+
echo-inputs:
60+
name: 'Echo inputs'
61+
runs-on: ubuntu-latest
62+
steps:
63+
- name: Echo inputs
64+
run: |
65+
echo "Sonarqube scan for INTERNAL repositories, running on ubuntu-latest-4-cores runner"
66+
echo "Perform build set to ${{ inputs.perform-build }}"
67+
echo "Build profile set to ${{ inputs.build-profile }}"
68+
echo "Language set to ${{ inputs.language }} "
69+
echo "Visibility set to ${{ inputs.visibility }} [ ${{ github.event.repository.visibility }} ]"
70+
echo "Perform unit test coverage set to ${{ inputs.report-unit-test-coverage }}"
71+
echo "Report to Atlassian dashboard set to ${{ inputs.report-to-atlassian-dashboard }}"
72+
echo "Quality product name set to ${{ inputs.quality-product-name }}"
73+
echo "Quality sonar application name set to ${{ inputs.quality-sonar-app-name }}"
74+
echo "Quality testing type set to ${{ inputs.quality-testing-type }}"
75+
echo "Quality service name set to ${{ inputs.quality-service-name }}"
76+
echo "Quality JUnit report set to ${{ inputs.quality-junit-report }}"
77+
echo "Go private modules set to ${{ inputs.go-private-modules }}"
78+
2179
SonarQube:
2280
runs-on: ubuntu-latest-4-cores
2381
steps:
24-
# unit-tests:
25-
# runs-on: ubuntu-latest
26-
# if: ${{ inputs.skip-unit-tests == false }}
27-
# steps:
28-
# - name: Run unit tests
29-
# run: |
30-
# echo "Running unit tests..."
31-
- uses: actions/checkout@v4
82+
- name: checkout
83+
if: ${{ inputs.perform-build == true && inputs.visibility == 'internal' }}
84+
uses: actions/checkout@v4
3285
with:
3386
fetch-depth: 0
3487

3588
- name: Set up Go
36-
uses: actions/setup-go@v4
89+
if: ${{ inputs.perform-build == true && inputs.language == 'Go' && inputs.visibility == 'internal' }}
90+
uses: actions/setup-go@v5
3791
with:
38-
go-version: 1.24.2
39-
check-latest: true
40-
92+
go-version: 'stable'
93+
# go-version: 1.24.2
94+
# check-latest: true
95+
4196
- name: Configure git for private modules
97+
if: ${{ inputs.perform-build == true && inputs.visibility == 'internal' }}
4298
env:
43-
GOPRIVATE: github.com/progress-platform-services/*
99+
GOPRIVATE: ${{ inputs.go-private-modules }} # github.com/progress-platform-services/*
44100
run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
45101

46-
- name: Generate coverage files
47-
run: go test -v -coverprofile="coverage.out" ./...
48-
- name: Copy file
49-
run: mkdir -p test/coverage; cp coverage.out test/coverage/coverage.out
102+
- name: Generate unit test coverage files
103+
if: ${{ inputs.perform-build == true && inputs.report-unit-test-coverage == true && inputs.language == 'Go' && inputs.visibility == 'internal'}}
104+
run: |
105+
go test -v -coverprofile="coverage.out" ./...
106+
mkdir -p test/coverage
107+
cp coverage.out test/coverage/coverage.out
50108
51109
- name: SonarQube Scan
110+
if: ${{ inputs.perform-build == true && inputs.report-unit-test-coverage == true && inputs.visibility == 'internal' }}
52111
uses: sonarsource/sonarqube-scan-action@v5.1.0
53112
# was uses: sonarsource/sonarqube-scan-action@master
54113
continue-on-error: true
55114
env:
56115
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
57-
SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
116+
SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
117+
118+
#TODO: Test adding Irfan's quality reporting stage inline here after sonar run (https://github.com/Progress-I360/github-action-reporting)
119+
# PRODUCT_NAME = [Chef360 | Courier | Inspec]
120+
- name: Run SonarQube report generation
121+
if: ${{ inputs.report-to-atlassian-dashboard == true && inputs.visibility == 'internal' }}
122+
uses: Progress-I360/github-action-reporting/sonarqube@main
123+
with:
124+
PRODUCT_NAME: ${{ inputs.quality-product-name }}
125+
SONAR_APP_NAME: ${{ inputs.quality-sonar-app-name }}
126+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
127+
128+
# TESTING_TYPE = [Unit | Integration | e2e | api | Performance | Security]
129+
# ENVIRONMENT = [DEV | STAGE | PROD] (optional)
130+
- name: Run report generation
131+
if: ${{ inputs.report-to-atlassian-dashboard == true && inputs.report-unit-test-coverage == true && inputs.visibility == 'internal' }}
132+
uses: Progress-I360/github-action-reporting/automation@main
133+
with:
134+
PRODUCT_NAME: ${{ inputs.quality-product-name }}
135+
TESTING_TYPE: ${{ inputs.quality-testing-type }}
136+
SERVICE_NAME: ${{ inputs.quality-service-name }}
137+
JUNIT_REPORT: ${{ inputs.quality-junit-report }}

‎.github/workflows/sonarqube-private-repo.yml‎

Lines changed: 72 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,24 +4,85 @@ name: SonarQube scan for private repositories
44

55
on:
66
workflow_call:
7-
7+
# all secrets are inherited from the calling workflow, typically SONAR_TOKEN, SONAR_HOST_URL
8+
inputs:
9+
perform-build:
10+
required: false
11+
type: boolean
12+
build-profile: # TODO: implmenet this flag - chef360 container build flags, etc
13+
required: false
14+
type: string
15+
language:
16+
required: false
17+
type: string
18+
report-unit-test-coverage:
19+
required: false
20+
type: boolean
21+
report-to-atlassian-dashboard:
22+
required: false
23+
type: boolean
24+
quality-product-name:
25+
required: false
26+
type: string
27+
quality-sonar-app-name:
28+
required: false
29+
type: string
30+
quality-testing-type:
31+
required: false
32+
type: string
33+
quality-service-name:
34+
required: false
35+
type: string
36+
quality-junit-report:
37+
required: false
38+
type: string
39+
visibility: # TODO: simplify the sonar step by bringing in the other variants (private, public, internal) from the calling workflow
40+
required: false
41+
type: string
42+
go-private-modules:
43+
required: false
44+
type: string
45+
udf1:
46+
required: false
47+
type: string
48+
udf2:
49+
required: false
50+
type: string
51+
udf3:
52+
required: false
53+
type: string
54+
855
jobs:
9-
# echo-inputs:
10-
# name: 'Echo inputs'
11-
# runs-on: ubuntu-latest
12-
# steps:
13-
# - name: Echo inputs
14-
# run: |
15-
# echo "Sonarqube scan for PRIVATE repositories, running on ubuntu-latest-4-cores runner"
16-
# echo "Sonar host URL ${{ secrets.SONAR_HOST_URL}}"
17-
56+
echo-inputs:
57+
name: 'Echo inputs'
58+
runs-on: ubuntu-latest
59+
steps:
60+
- name: Echo inputs
61+
run: |
62+
echo "Sonarqube scan for PRIVATE repositories, running on ubuntu-latest-4-cores runner"
63+
echo "Perform build set to ${{ inputs.perform-build }}"
64+
echo "Build profile set to ${{ inputs.build-profile }}"
65+
echo "Language set to ${{ inputs.language }} "
66+
echo "Visibility set to ${{ inputs.visibility }} [ ${{ github.event.repository.visibility }} ]"
67+
echo "Perform unit test coverage set to ${{ inputs.report-unit-test-coverage }}"
68+
echo "Report to Atlassian dashboard set to ${{ inputs.report-to-atlassian-dashboard }}"
69+
echo "Quality product name set to ${{ inputs.quality-product-name }}"
70+
echo "Quality sonar application name set to ${{ inputs.quality-sonar-app-name }}"
71+
echo "Quality testing type set to ${{ inputs.quality-testing-type }}"
72+
echo "Quality service name set to ${{ inputs.quality-service-name }}"
73+
echo "Quality JUnit report set to ${{ inputs.quality-junit-report }}"
74+
echo "Go private modules set to ${{ inputs.go-private-modules }}"
75+
1876
SonarQube:
1977
runs-on: ubuntu-latest-4-cores
2078
steps:
21-
- uses: actions/checkout@v4
79+
- name:
80+
if: ${{ inputs.visibility == 'private' }}
81+
uses: actions/checkout@v4
2282
with:
2383
fetch-depth: 0
2484
- name: SonarQube Scan
85+
if: ${{ inputs.visibility == 'private' }}
2586
uses: sonarsource/sonarqube-scan-action@v5.1.0
2687
continue-on-error: true
2788
env:

0 commit comments

Comments
 (0)