WIP: [CI] Integrate SonarCloud to the repository #5845

rtsisyk · 2023-08-27T21:25:37Z

meenbeese commented

2023-08-27 21:25:37 +00:00

(Migrated from github.com)

Resolves #3180

SonarCloud sales pitch: Using this GitHub Action, scan your code with SonarCloud to detect bugs, vulnerabilities and code smells in C and C++!

I chose the C/C++/Objective-C version of the workflow as this covers more than 80% of our code.
I also took the first steps to integrate SonarCloud but some actions are needed from the maintainers:

Have an account on SonarCloud. Sign up for free now if it's not already the case!
The repository to analyze is set up on SonarCloud. Set it up in just one click.
Generate the SONAR_TOKEN and GITHUB_TOKEN – Resources: Security page in SonarCloud. You can set the SONAR_TOKEN environment variable in the "Secrets" settings page of your repo and (see Authenticating with the GITHUB_TOKEN).
Populate the .github/workflows/sonar-analyze.yml and sonar-project.properties files with the secrets.
Configure actions in the workflow (maybe sonar-project.properties too) according to the needs of the project .

Some useful documentation:

Resolves #3180 SonarCloud sales pitch: Using this GitHub Action, scan your code with [SonarCloud](https://sonarcloud.io/) to detect bugs, vulnerabilities and code smells in C and C++! I chose the C/C++/Objective-C version of the workflow as this covers more than 80% of our code. I also took the first steps to integrate SonarCloud but some actions are needed from the maintainers: - [x] Have an account on SonarCloud. [Sign up for free now](https://sonarcloud.io/sessions/init/github) if it's not already the case! - [x] The repository to analyze is set up on SonarCloud. [Set it up](https://sonarcloud.io/projects/create) in just one click. - [x] Generate the SONAR_TOKEN and GITHUB_TOKEN – Resources: [Security page in SonarCloud](https://sonarcloud.io/account/security/). You can set the SONAR_TOKEN environment variable in the "Secrets" settings page of your repo and (see [Authenticating with the GITHUB_TOKEN](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/authenticating-with-the-github_token)). - [ ] Populate the .github/workflows/sonar-analyze.yml and sonar-project.properties files with the secrets. - [ ] Configure actions in the workflow (maybe sonar-project.properties too) according to the needs of the project . Some useful documentation: - https://docs.sonarcloud.io/getting-started/github/ - https://www.sonarsource.com/products/sonarcloud/signup/ - https://github.com/marketplace/actions/sonarcloud-scan-for-c-and-c - https://docs.sonarcloud.io/advanced-setup/languages/c-c-objective-c/ - https://docs.sonarcloud.io/advanced-setup/ci-based-analysis/github-actions-for-sonarcloud/

rtsisyk reviewed 2024-08-24 12:59:55 +00:00

.github/workflows/sonar-analyze.yml

					
				@ -0,0 +1,73 @@

				name: SonarCloud

				on:

				  push:

rtsisyk commented

2024-08-24 12:59:55 +00:00

let's configure it for workflow_dispatch (manual invocation) for now.

rtsisyk reviewed 2024-08-24 13:00:18 +00:00

sonar-project.properties

rtsisyk commented

2024-08-24 13:00:18 +00:00

sonar.organization=organicmaps

```suggestion sonar.organization=organicmaps ```

rtsisyk reviewed 2024-08-24 13:00:46 +00:00

sonar-project.properties

rtsisyk commented

2024-08-24 13:00:46 +00:00

sonar.projectKey=organicmaps

https://sonarcloud.io/project/overview?id=organicmaps_organicmaps

```suggestion sonar.projectKey=organicmaps ``` https://sonarcloud.io/project/overview?id=organicmaps_organicmaps

AndrewShkrob reviewed 2024-10-05 20:53:11 +00:00

.github/workflows/sonar-analyze.yml

AndrewShkrob commented

2024-10-05 20:53:10 +00:00

          sonar-scanner --define sonar.cfamily.build-wrapper-output="${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json"

From this example: https://github.com/marketplace/actions/sonarcloud-scan-for-c-and-c

```suggestion sonar-scanner --define sonar.cfamily.build-wrapper-output="${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json" ``` From this example: https://github.com/marketplace/actions/sonarcloud-scan-for-c-and-c

This repo is archived. You cannot comment on pull requests.

No reviewers