|
| 1 | +# This workflow uses actions that are not certified by GitHub. |
| 2 | +# They are provided by a third-party and are governed by |
| 3 | +# separate terms of service, privacy policy, and support |
| 4 | +# documentation. |
| 5 | + |
| 6 | +# This workflow helps you trigger a SonarQube analysis of your code and populates |
| 7 | +# GitHub Code Scanning alerts with the vulnerabilities found. |
| 8 | +# (this feature is available starting from SonarQube 9.7, Developer Edition and above) |
| 9 | + |
| 10 | +# 1. Make sure you add a valid GitHub configuration to your SonarQube (Administration > DevOps platforms > GitHub) |
| 11 | + |
| 12 | +# 2. Import your project on SonarQube |
| 13 | +# * Add your repository as a new project by clicking "Create project" from your homepage. |
| 14 | +# |
| 15 | +# 3. Select GitHub Actions as your CI and follow the tutorial |
| 16 | +# * a. Generate a new token and add it to your GitHub repository's secrets using the name SONAR_TOKEN |
| 17 | +# (On SonarQube, click on your avatar on top-right > My account > Security or ask your administrator) |
| 18 | +# |
| 19 | +# * b. Copy/paste your SonarQube host URL to your GitHub repository's secrets using the name SONAR_HOST_URL |
| 20 | +# |
| 21 | +# * c. Copy/paste the project Key into the args parameter below |
| 22 | +# (You'll find this information in SonarQube by following the tutorial or by clicking on Project Information at the top-right of your project's homepage) |
| 23 | + |
| 24 | +# Feel free to take a look at our documentation (https://docs.sonarqube.org/latest/analysis/github-integration/) |
| 25 | +# or reach out to our community forum if you need some help (https://community.sonarsource.com/c/sq/10) |
| 26 | + |
| 27 | +name: SonarQube analysis |
| 28 | + |
| 29 | +on: |
| 30 | + push: |
| 31 | + branches: [ "master" ] |
| 32 | + pull_request: |
| 33 | + branches: [ "master" ] |
| 34 | + workflow_dispatch: |
| 35 | + |
| 36 | +permissions: |
| 37 | + pull-requests: read # allows SonarQube to decorate PRs with analysis results |
| 38 | + |
| 39 | +jobs: |
| 40 | + Analysis: |
| 41 | + runs-on: ubuntu-latest |
| 42 | + |
| 43 | + steps: |
| 44 | + - name: Run Maven Build |
| 45 | + run: mvn clean install |
| 46 | + - name: SonarQube Scan |
| 47 | + uses: sonarsource/sonarqube-scan-action@master |
| 48 | + env: |
| 49 | + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |
| 50 | + SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} |
0 commit comments