Skip to content

Commit fda7ac0

Browse files
GabrielFleischerGabrielFleischer
committed
Bootstrap GHA for sonar-java-symbolic-execution
1 parent ed47117 commit fda7ac0

File tree

4 files changed

+170
-0
lines changed

4 files changed

+170
-0
lines changed

‎.github/scripts/resolve-sonar-java-plugin-version.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
function resolve_version() {
6+
local VERSION="${1:-}"
7+
local REPOSITORY
8+
if [[ -z "${VERSION}" ]]; then
9+
echo "Usage: resolve-sonar-java-plugin-version.sh <version>"
10+
return 1
11+
elif [[ "${VERSION}" =~ ^[0-9]+(\.[0-9]+)*$ ]]; then
12+
echo -n "${VERSION}"
13+
return 0
14+
elif [[ "${VERSION}" == "POM_PROPERTY" ]]; then
15+
sed -E -n 's/^ *<sonar\.java\.version>([^<]+)<\/sonar\.java\.version> *$/\1/p' pom.xml
16+
return 0
17+
elif [[ "${VERSION}" == "LATEST_RELEASE" ]]; then
18+
REPOSITORY="sonarsource-public-releases"
19+
elif [[ "${VERSION}" == "LATEST_MASTER" ]]; then
20+
REPOSITORY="sonarsource-public-builds"
21+
elif [[ "${VERSION}" == "LATEST_DOGFOOD" ]]; then
22+
REPOSITORY="sonarsource-dogfood-builds"
23+
else
24+
echo "Invalid version format: ${VERSION}"
25+
return 1
26+
fi
27+
local REPOX_URL="https://repox.jfrog.io/repox/${REPOSITORY}/org/sonarsource/java/sonar-java-plugin/maven-metadata.xml"
28+
local REPOX_AUTHORIZATION="Authorization: Bearer ${ARTIFACTORY_PRIVATE_PASSWORD:-$ARTIFACTORY_PASSWORD}"
29+
local LATEST_VERSION
30+
LATEST_VERSION="$(curl -slf -H "${REPOX_AUTHORIZATION}" -o - "${REPOX_URL}" | sed -E -n 's/^ *<latest>([^<]+)<\/latest> *$/\1/p')"
31+
if [[ -z "${LATEST_VERSION}" ]]; then
32+
echo "No version found for ${GROUP_ID}:${ARTIFACT_ID}"
33+
return 1
34+
fi
35+
echo -n "${LATEST_VERSION}"
36+
}
37+
38+
resolve_version "$@"

‎.github/workflows/build.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Build
2+
on:
3+
push:
4+
branches:
5+
- master
6+
- branch-*
7+
- dogfood-*
8+
pull_request:
9+
workflow_dispatch:
10+
schedule:
11+
- cron: "30 1 * * *" # Run daily at 1:30 AM UTC
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
build:
19+
name: Build
20+
runs-on: github-ubuntu-latest-s
21+
permissions:
22+
id-token: write
23+
contents: write
24+
outputs:
25+
build-number: ${{ steps.build-maven.outputs.BUILD_NUMBER }}
26+
steps:
27+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
- uses: jdx/mise-action@d6e32c1796099e0f1f3ac741c220a8b7eae9e5dd # v3.2.0
29+
with:
30+
version: 2025.7.12
31+
- uses: SonarSource/ci-github-actions/build-maven@v1
32+
id: build-maven
33+
with:
34+
deploy-pull-request: true
35+
artifactory-reader-role: private-reader # Override default public-reader
36+
artifactory-deployer-role: qa-deployer # Override default public-deployer
37+
38+
qa:
39+
needs: [build]
40+
runs-on: github-ubuntu-latest-l
41+
if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
42+
permissions:
43+
id-token: write
44+
strategy:
45+
fail-fast: false
46+
matrix:
47+
item:
48+
- { name: "with Lastest SonarJava Plugin", profile: "without-sonarqube-project", java_plugin_version: "LATEST_MASTER" }
49+
- { name: "for SonarQube Project Only", profile: "only-sonarqube-project", java_plugin_version: "LATEST_MASTER" }
50+
- { name: "with Prod SonarJava Plugin", profile: "without-sonarqube-project", java_plugin_version: "POM_PROPERTY" }
51+
name: "QA Tests ${{ matrix.item.name }}"
52+
steps:
53+
- name: Checkout repository
54+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
55+
with:
56+
submodules: recursive
57+
- uses: jdx/mise-action@d6e32c1796099e0f1f3ac741c220a8b7eae9e5dd # v3.2.0
58+
with:
59+
version: 2025.7.12
60+
- name: Get GitHub Token for QA Licenses
61+
id: secrets
62+
uses: SonarSource/vault-action-wrapper@v3
63+
with:
64+
secrets: |
65+
development/github/token/licenses-ro token | GITHUB_TOKEN;
66+
- name: Configure Maven
67+
id: configure-maven
68+
uses: SonarSource/ci-github-actions/config-maven@v1
69+
with:
70+
artifactory-reader-role: private-reader # Override default public-reader
71+
- name: Get Sonar Java plugin version
72+
id: resolve-sonar-java-plugin-version
73+
run: |
74+
VERSION=$(.github/scripts/resolve-sonar-java-plugin-version.sh "${{ matrix.item.java_plugin_version }}")
75+
echo "version=${VERSION}" >> $GITHUB_OUTPUT
76+
- name: Run QA Tests
77+
env:
78+
GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
79+
BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
80+
MAVEN_OPTS: "-Xmx3g"
81+
SONAR_JAVA_VERSION: ${{ steps.resolve-sonar-java-plugin-version.outputs.version }}
82+
run: |
83+
cd its/ruling
84+
mvn package --batch-mode \
85+
"-Pit-ruling,${{ matrix.item.profile }}" \
86+
"-Dsonar.java.version=${SONAR_JAVA_VERSION}" \
87+
"-Dorchestrator.artifactory.accessToken=${ARTIFACTORY_ACCESS_TOKEN}" \
88+
"-Dsonar.runtimeVersion=LATEST_RELEASE" \
89+
"-Dmaven.test.redirectTestOutputToFile=false" \
90+
"-DbuildNumber=${BUILD_NUMBER}" \
91+
-B -e -V \
92+
"-Dparallel=methods" \
93+
"-DuseUnlimitedThreads=true"
94+
- name: Upload ruling artifacts on failure
95+
if: failure()
96+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.5.0
97+
with:
98+
name: ruling-actual-${{ matrix.item.profile }}-${{ matrix.item.java_plugin_version }}
99+
path: its/ruling/target/actual/**/*
100+
101+
promote:
102+
name: Promote
103+
needs: [build, qa]
104+
runs-on: github-ubuntu-latest-s
105+
if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
106+
permissions:
107+
id-token: write
108+
steps:
109+
- name: Checkout repository
110+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
111+
- uses: jdx/mise-action@d6e32c1796099e0f1f3ac741c220a8b7eae9e5dd # v3.2.0
112+
with:
113+
cache_save: false
114+
version: 2025.7.12
115+
- name: Promote artifacts
116+
uses: SonarSource/ci-github-actions/promote@v1

‎.github/workflows/pr-cleanup.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Cleanup PR Resources
2+
on:
3+
pull_request:
4+
types:
5+
- closed
6+
7+
jobs:
8+
cleanup:
9+
runs-on: github-ubuntu-latest-s
10+
permissions:
11+
actions: write
12+
steps:
13+
- uses: SonarSource/ci-github-actions/pr_cleanup@v1

‎mise.toml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[tools]
2+
java = "17.0"
3+
maven = "3.9"

0 commit comments

Comments
 (0)