Create sonarcloud.yml #365
Conversation
WalkthroughA new GitHub Actions workflow named Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
github-actions
bot
added
the
size/M
gstraccini
bot
added
the
☑️ auto-merge
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (3)
.github/workflows/sonarcloud.yml (3)
10-13: Consider pinning the Ubuntu version.While
ubuntu-latestworks, consider pinning to a specific version (e.g.,ubuntu-22.04) for better stability and predictability.- runs-on: ubuntu-latest + runs-on: ubuntu-22.04
16-20: Consider using Java 17 LTS instead of Java 21.While Java 21 works, Java 17 is the current LTS version and would be more suitable for CI environments. SonarCloud scanner doesn't require Java 21 specific features.
- java-version: 21 + java-version: 17
9-9: Remove trailing spaces.There are trailing spaces on several lines that should be removed for consistency.
Also applies to: 14-14, 21-21, 32-32, 40-40, 44-44, 52-52
🧰 Tools
🪛 yamllint
[error] 9-9: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
.github/workflows/sonarcloud.yml(1 hunks)
🧰 Additional context used
🪛 yamllint
.github/workflows/sonarcloud.yml
[error] 9-9: trailing spaces
(trailing-spaces)
[error] 14-14: trailing spaces
(trailing-spaces)
[error] 21-21: trailing spaces
(trailing-spaces)
[error] 32-32: trailing spaces
(trailing-spaces)
[error] 40-40: trailing spaces
(trailing-spaces)
[error] 44-44: trailing spaces
(trailing-spaces)
[error] 52-52: trailing spaces
(trailing-spaces)
🔇 Additional comments (4)
.github/workflows/sonarcloud.yml (4)
3-8: LGTM! Workflow triggers are properly configured.
The workflow triggers are appropriately set for both push events to main and relevant pull request events.
22-24: LGTM! Proper checkout configuration for SonarCloud.
The checkout configuration with full history is correct for accurate SCM blame information in SonarCloud.
54-57: Verify SONAR_TOKEN secret availability.
Ensure the SONAR_TOKEN secret is configured in your repository's secrets.
#!/bin/bash
# Check if SONAR_TOKEN is mentioned in repository documentation
rg -g '*.md' 'SONAR_TOKEN'45-51: Verify the SonarCloud project key format.
The current key format (owner_repo) might need validation against your SonarCloud organization's conventions.
✅ Verification successful
SonarCloud project key format is correct
Based on the existing SonarCloud badges in README.md, the current project key format matches the convention used in this repository. The existing project key guibranco_VTEX-SDK-dotnet follows the same owner_repo pattern that's being implemented in the workflow (${{ github.repository_owner }}_${{ github.event.repository.name }}).
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check if there are any existing SonarCloud configurations in the repository
# that might indicate the expected key format
rg -g '!.github/' -l 'sonar.projectKey|sonar.organization'
Length of output: 198
Script:
#!/bin/bash
# Let's check for sonar-project.properties file and any other potential SonarCloud configuration files
fd -t f "sonar-project.properties|sonar.properties"
# Also check for any SonarCloud related configuration in package.json or similar files
fd -t f "package.json|pom.xml|build.gradle" -x cat {} \; | grep -i "sonar"
# Check for any existing SonarCloud analysis in the repository
fd -t f ".sonarcloud.properties|sonar-project.js"
# Look for any documentation mentioning SonarCloud setup
rg -i "sonarcloud" -g "*.md"
Length of output: 2797
| ~/.sonar/cache/dotnet-sonarscanner begin /k:"${{ env.KEY }}" /o:"${{ env.ORG }}" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.scanner.scanAll=false /d:sonar.cs.opencover.reportsPaths="Tests/**/coverage.net8.0.opencover.xml" | ||
| dotnet build -c Release --verbosity minimal | ||
| dotnet test -c Release --verbosity minimal --no-build --no-restore /p:CollectCoverage=true /p:CoverletOutputFormat="opencover" | ||
| ~/.sonar/cache/dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}" |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add explicit restore step and make coverage path more flexible.
The current configuration has several potential improvements:
- Add an explicit
dotnet restorestep - Make the coverage path pattern more flexible to support multiple .NET versions
- ~/.sonar/cache/dotnet-sonarscanner begin /k:"${{ env.KEY }}" /o:"${{ env.ORG }}" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.scanner.scanAll=false /d:sonar.cs.opencover.reportsPaths="Tests/**/coverage.net8.0.opencover.xml"
+ ~/.sonar/cache/dotnet-sonarscanner begin /k:"${{ env.KEY }}" /o:"${{ env.ORG }}" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.scanner.scanAll=false /d:sonar.cs.opencover.reportsPaths="Tests/**/coverage.*.opencover.xml"
+ dotnet restore
dotnet build -c Release --verbosity minimal
dotnet test -c Release --verbosity minimal --no-build --no-restore /p:CollectCoverage=true /p:CoverletOutputFormat="opencover"
~/.sonar/cache/dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ~/.sonar/cache/dotnet-sonarscanner begin /k:"${{ env.KEY }}" /o:"${{ env.ORG }}" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.scanner.scanAll=false /d:sonar.cs.opencover.reportsPaths="Tests/**/coverage.net8.0.opencover.xml" | |
| dotnet build -c Release --verbosity minimal | |
| dotnet test -c Release --verbosity minimal --no-build --no-restore /p:CollectCoverage=true /p:CoverletOutputFormat="opencover" | |
| ~/.sonar/cache/dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}" | |
| ~/.sonar/cache/dotnet-sonarscanner begin /k:"${{ env.KEY }}" /o:"${{ env.ORG }}" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.scanner.scanAll=false /d:sonar.cs.opencover.reportsPaths="Tests/**/coverage.*.opencover.xml" | |
| dotnet restore | |
| dotnet build -c Release --verbosity minimal | |
| dotnet test -c Release --verbosity minimal --no-build --no-restore /p:CollectCoverage=true /p:CoverletOutputFormat="opencover" | |
| ~/.sonar/cache/dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}" |
| - name: Cache SonarCloud packages | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: ~/.sonar/cache | ||
| key: ${{ runner.os }}-sonar | ||
| restore-keys: ${{ runner.os }}-sonar | ||
|
|
||
| - name: Cache SonarCloud scanner | ||
| id: cache-sonar-scanner | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: ~/.sonar/cache | ||
| key: ${{ runner.os }}-sonar-scanner | ||
| restore-keys: ${{ runner.os }}-sonar-scanner | ||
|
|
||
| - name: Install SonarCloud scanner | ||
| if: steps.cache-sonar-scanner.outputs.cache-hit != 'true' | ||
| run: dotnet tool update dotnet-sonarscanner --tool-path ~/.sonar/cache/ |
There was a problem hiding this comment.
Fix conflicting cache paths.
Both cache steps are using the same path (~/.sonar/cache), which will cause conflicts. The scanner should use a different path.
- name: Cache SonarCloud scanner
id: cache-sonar-scanner
uses: actions/cache@v4
with:
- path: ~/.sonar/cache
+ path: ./.sonar/scanner
key: ${{ runner.os }}-sonar-scanner
restore-keys: ${{ runner.os }}-sonar-scanner
- name: Install SonarCloud scanner
if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
- run: dotnet tool update dotnet-sonarscanner --tool-path ~/.sonar/cache/
+ run: dotnet tool update dotnet-sonarscanner --tool-path ./.sonar/scanner/📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Cache SonarCloud packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.sonar/cache | |
| key: ${{ runner.os }}-sonar | |
| restore-keys: ${{ runner.os }}-sonar | |
| - name: Cache SonarCloud scanner | |
| id: cache-sonar-scanner | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.sonar/cache | |
| key: ${{ runner.os }}-sonar-scanner | |
| restore-keys: ${{ runner.os }}-sonar-scanner | |
| - name: Install SonarCloud scanner | |
| if: steps.cache-sonar-scanner.outputs.cache-hit != 'true' | |
| run: dotnet tool update dotnet-sonarscanner --tool-path ~/.sonar/cache/ | |
| - name: Cache SonarCloud packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.sonar/cache | |
| key: ${{ runner.os }}-sonar | |
| restore-keys: ${{ runner.os }}-sonar | |
| - name: Cache SonarCloud scanner | |
| id: cache-sonar-scanner | |
| uses: actions/cache@v4 | |
| with: | |
| path: ./.sonar/scanner | |
| key: ${{ runner.os }}-sonar-scanner | |
| restore-keys: ${{ runner.os }}-sonar-scanner | |
| - name: Install SonarCloud scanner | |
| if: steps.cache-sonar-scanner.outputs.cache-hit != 'true' | |
| run: dotnet tool update dotnet-sonarscanner --tool-path ./.sonar/scanner/ |
🧰 Tools
🪛 yamllint
[error] 32-32: trailing spaces
(trailing-spaces)
[error] 40-40: trailing spaces
(trailing-spaces)
|
✅ Build VTEX-SDK-dotnet 2.3.1646 completed (commit c03a513d4d by @gstraccini[bot]) |
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferencesCodacy stopped sending the deprecated coverage status on June 5th, 2024. Learn more |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #365 +/- ##
=====================================
Coverage 0.22% 0.22%
=====================================
Files 117 117
Lines 1774 1774
Branches 75 75
=====================================
Hits 4 4
+ Misses 1770 1768 -2
- Partials 0 2 +2 ☔ View full report in Codecov by Sentry. |
|
Infisical secrets check: ✅ No secrets leaked! 💻 Scan logs2:36PM INF scanning for exposed secrets...
2:36PM INF 559 commits scanned.
2:36PM INF scan completed in 293ms
2:36PM INF no leaks found
|
|
|
✅ Build VTEX-SDK-dotnet 2.3.1684 completed (commit 21ede976fa by @gstraccini[bot]) |
Closes #
📑 Description
✅ Checks
☢️ Does this introduce a breaking change?
ℹ Additional Information
Summary by CodeRabbit