Skip to content

SONARCLOUD.md

Latest commit

 

History

History
99 lines (70 loc) · 4.63 KB

SONARCLOUD.md

File metadata and controls

99 lines (70 loc) · 4.63 KB
Raw

SonarCloud setup — CVE Radar

Static analysis, security hotspots, duplication, and test coverage for src/, server/, and shared/.

Item Location
Project sonarcloud.io/project/overview?id=RaminNietzsche_CVE-Radar
Config sonar-project.properties (CI)
CI workflow .github/workflows/quality-sonarcloud.yml
GitHub secret SONAR_TOKEN
Coverage npm run test:ci → coverage/lcov.info (Node node:test + V8)

One-time setup checklist

1. SonarCloud project (already created)

2. Analysis method (important)

In SonarCloud → CVE-Radar → Administration → Analysis Method:

  1. Select CI-based analysis (GitHub Actions).
  2. Disable Automatic Analysis — required for CI. The workflow runs scripts/disable-sonar-autoscan.sh on each analysis; if it still fails, open Administration → Analysis Method and turn off Automatic Analysis manually.

3. Generate token

  1. SonarCloud → My Account → Security
  2. Generate Token — name e.g. github-actions-cve-radar
  3. Type: Global Analysis Token or Project Analysis Token for RaminNietzsche_CVE-Radar
  4. Copy the token (shown once).

4. GitHub repository secret

Web UI: Settings → Secrets → Actions → New repository secret → name SONAR_TOKEN

CLI (from maintainer machine):

gh secret set SONAR_TOKEN --repo RaminNietzsche/CVE-Radar
# paste token when prompted

Verify:

gh secret list --repo RaminNietzsche/CVE-Radar | grep SONAR_TOKEN

5. Run first analysis

gh workflow run quality-sonarcloud.yml --repo RaminNietzsche/CVE-Radar

Or push a change under src/ / server/ / tests/.

6. Branch protection (optional)

Require check SonarCloud Code Analysis on main after the first green run.

CI behaviour

  • Workflow: Quality / SonarCloud — job SonarCloud Code Analysis
  • Triggers: PR/push to main (app paths); workflow_dispatch
  • Steps: token check → checkout (full history) → npm ci → npm run test:ci → verify coverage/lcov.info → Sonar scan → Quality Gate
  • Missing token: job fails with link to this doc and Actions secrets page
  • PR decoration: requires pull-requests: write on GITHUB_TOKEN (configured in workflow)

Local parity

npm run test:ci
# Optional — requires SonarScanner CLI + SONAR_TOKEN in env:
sonar-scanner

Troubleshooting

Symptom Action
sonar.projectKey, sonar.organization missing Ensure sonar-project.properties exists at repo root (not .sonarcloud.properties).
SONAR_TOKEN is not set Complete step 4 above.
0% coverage Run npm run test:ci first; confirm coverage/lcov.info and sonar.javascript.lcov.reportPaths.
Duplicate PR comments Disable Automatic Analysis in SonarCloud (step 2).
CI + Automatic Analysis conflict Error: running CI analysis while Automatic Analysis is enabled — run scripts/disable-sonar-autoscan.sh or disable in SonarCloud UI.
Python “all versions” warning Set sonar.python.version=3.12 in sonar-project.properties (CI arg also passed).
Quality Gate failed Run failed step Quality Gate details in the workflow log. Common: new_reliability_rating — fix bugs in SonarCloud dashboard.
PLSQL data dictionary warning Project uses PostgreSQL migrations, not Oracle. sonar-project.properties sets sonar.plsql.file.suffixes=pks,pkb and excludes server/db/migrations/**. Do not configure Oracle JDBC — rules S3641/S3921/S3618/S3651 are N/A.
Workflow skipped Path filters — run workflow_dispatch or touch app paths.

Related