GitHub Action
sonarqube-mobb-fixer-action
This action is used alongside the Sonarcloud's native Webhook integration with GitHub where SonarCloud publishes a scan report in the Pull Request's comment section.
This action will monitor the presence of such a comment and trigger a job to download the SAST report. The SAST report is submitted to the Mobb vulnerability analysis engine, and a fix is presented to the Pull Request's comment section.
If you are using this on a private repo, the Mobb user to which the API key belongs must have access to the repo and must approve GitHub access for the user on the Mobb platform beforehand.
Required Your SonarCloud API token.
Required The SonarCloud Host URL. Usually it's https://sonarcloud.io
Required The SonarCloud Project (Project Key)
Required The SonarCloud Org (Organization Key)
Required The Mobb API token to use with the action. Find out how to get it here.
Required The GitHub api token to use with the action. Usually available as ${{ secrets.GITHUB_TOKEN }}.
Create a file under the path .github/workflow/mobb.yml.
A sample content of the workflow file:
# Mobb/SonarQube Fixer on pull requests.
#
# This workflow defines the needed steps to run SonarQube on every pull request
# and pass the results to Mobb Fixer.
#
# Secrets in use (add your missing ones):
#
# SONARQUBE_HOST_URL - your SonarQube server host. https://sonarcloud.io for cloud version.
# SONARQUBE_PROJECT - your SonarQube project name.
# SONARQUBE_ORG - your SonarQube organization name.
# SONARQUBE_TOKEN - your SonarQube access token.
# MOBB_API_TOKEN - your Mobb user API token.
# GITHUB_TOKEN - automatically set by GitHub.
#
name: "Mobb/Sonar/PRWebhook"
on:
issue_comment:
types: [created]
jobs:
report-and-fix:
name: Get Sonar Report and Fix
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body,'[![Quality Gate Failed]') }} # This makes sure that the comment originates from a PR and not an issue comment
runs-on: 'ubuntu-latest'
timeout-minutes: 360
permissions:
pull-requests: write
statuses: write
contents: read
actions: read
env:
BRANCH: ${{ github.head_ref || github.ref_name }}
steps:
# - name: Checkout repo to get code
# uses: actions/checkout@v3
- name: Run Mobb on the findings and get fixes
if: always()
uses: mobb-dev/sonarqube-mobb-fixer-action@main
with:
mobb-api-token: ${{ secrets.MOBB_API_TOKEN }}
sonarqube-host-url: ${{ vars.SONARQUBE_HOST_URL }}
sonarqube-project: ${{ vars.SONARQUBE_PROJECT }}
sonarqube-token: ${{ secrets.SONARQUBE_TOKEN }}
sonarqube-org: ${{ vars.SONARQUBE_ORG }}
github-token: ${{ secrets.GITHUB_TOKEN }}