Repository navigation
chore(deps): update ferrlabs/.github digest to 3df97ce #539
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SonarQube | |
| # Static analysis on the self-hosted SonarQube (https://sonar.ferrlabs.com), | |
| # via the org-wide reusable workflow, the way FerrFlow calls it. | |
| # | |
| # Runs on a GitHub-hosted runner: this repo is public and the self-hosted | |
| # `ferrlabs-k8s` group has allows_public_repositories=false. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| version: | |
| name: Resolve latest release tag | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.tag.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - id: tag | |
| # Highest semver release tag, independent of branch reachability, | |
| # `git describe` returns the nearest ancestor tag, which goes stale on | |
| # feature branches and pull requests. | |
| run: | | |
| set -euo pipefail | |
| TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n1) | |
| VERSION="${TAG#v}" | |
| echo "version=${VERSION:-0.0.0}" >> "$GITHUB_OUTPUT" | |
| echo "Latest release tag: ${TAG:-<none>} -> projectVersion=${VERSION:-0.0.0}" | |
| coverage: | |
| name: Coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| with: | |
| components: llvm-tools-preview | |
| - name: Cache cargo | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| # Instrumented artefacts are not interchangeable with the ones the | |
| # Check job builds, so this keeps its own key rather than evicting them. | |
| key: ${{ runner.os }}-cargo-cov-${{ hashFiles('Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo-cov- | |
| - uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2 | |
| with: | |
| tool: cargo-llvm-cov | |
| - run: cargo llvm-cov --locked --workspace --lcov --output-path lcov.info | |
| - name: Rebase the report onto the repository root | |
| # llvm-cov writes absolute SF: paths. SonarQube resolves them against | |
| # projectBaseDir, so a report that only matches because both jobs happen | |
| # to check out at the same absolute path would silently report 0% | |
| # coverage the day one of them does not. | |
| run: | | |
| set -euo pipefail | |
| awk -v ws="$GITHUB_WORKSPACE" ' | |
| /^SF:/ { | |
| p = substr($0, 4) | |
| if (substr(p, 1, length(ws) + 1) == ws "/") p = substr(p, length(ws) + 2) | |
| print "SF:" p; next | |
| } | |
| { print } | |
| ' lcov.info > lcov.rebased.info | |
| mv lcov.rebased.info lcov.info | |
| grep -c '^SF:' lcov.info | |
| - name: Hand the report to the scan | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: sonar-coverage-lfsx | |
| path: lcov.info | |
| if-no-files-found: error | |
| retention-days: 1 | |
| scan: | |
| needs: [version, coverage] | |
| # The reusable comments the issue delta on pull requests, and a called | |
| # workflow cannot be granted more than its caller holds. Without this the | |
| # whole run fails at startup with no job to look at. | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| uses: FerrLabs/.github/.github/workflows/reusable-sonarqube-scan.yml@3df97ce594e954bfed6db38189bcad25452ad034 # main | |
| with: | |
| runner: ubuntu-latest | |
| project-key: lfsx | |
| coverage-artifact: sonar-coverage-lfsx | |
| # The reusable's defaults, plus the two directories whose duplication and | |
| # smells say nothing about the server: the end-to-end script is a script, | |
| # and the stub forge exists to be a crude stand-in. | |
| # | |
| # Test files leave sonar.sources here and arrive as sonar.tests below. | |
| # Without that they count as production code, and since a Rust unit test | |
| # lives in a tests.rs beside the module it covers, every fixture and every | |
| # repeated bit of setup was being reported as duplication in the server. | |
| exclusions: '**/node_modules/**,**/dist/**,**/build/**,**/target/**,**/coverage/**,**/.next/**,**/out/**,**/vendor/**,**/*.min.js,**/*.min.css,ci/**,server/examples/**,**/tests.rs,**/tests/**' | |
| args: >- | |
| -Dsonar.projectVersion=${{ needs.version.outputs.version }} | |
| -Dsonar.rust.lcov.reportPaths=.sonarcov/lcov.info | |
| -Dsonar.tests=. | |
| -Dsonar.test.inclusions=**/tests.rs,**/tests/** | |
| secrets: inherit |