From e9c1c165025921f457f13bb974bfb610323fec4b Mon Sep 17 00:00:00 2001 From: sandeep-ctds Date: Thu, 20 Aug 2026 17:26:34 +0530 Subject: [PATCH 1/3] Added sonarqube scanning to PR, commit and workflows --- .github/workflows/sonarqube.yaml | 105 +++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 .github/workflows/sonarqube.yaml diff --git a/.github/workflows/sonarqube.yaml b/.github/workflows/sonarqube.yaml new file mode 100644 index 0000000..bece4dd --- /dev/null +++ b/.github/workflows/sonarqube.yaml @@ -0,0 +1,105 @@ +name: SonarQube Scan + +on: + push: + branches: + - master + pull_request: + types: [opened, synchronize, reopened] + branches: + - master + workflow_dispatch: + inputs: + scan_type: + description: 'Type of scan to run' + required: true + type: choice + options: + - branch + - pr + default: branch + ref: + description: 'Commit SHA, branch, or tag to check out and scan (leave blank to use the default branch)' + required: false + type: string + default: '' + +concurrency: + group: sonarqube-${{ github.ref }} + cancel-in-progress: true + +env: + SONAR_HOST_URL: https://sonarqube-prod.whitewater.ibm.com + TRUSTSTORE_PATH: ./ibm_castorevpcprod + # Maven tuning — mirrors settings used across the rest of the CI workflows. + MAVEN_OPTS: >- + -Xss1500k + -Xmx2048m + -XX:+UnlockDiagnosticVMOptions + -XX:+IgnoreUnrecognizedVMOptions + -XX:GCLockerRetryAllocationCount=100 + -Daether.connector.http.reuseConnections=false + -Daether.connector.requestTimeout=60000 + -Dhttp.keepAlive=false + -Dmaven.wagon.http.pool=false + -Dmaven.wagon.http.retryHandler.class=standard + -Dmaven.wagon.http.retryHandler.count=3 + -Dmaven.wagon.http.retryHandler.requestSentEnabled=true + -Dmaven.wagon.http.serviceUnavailableRetryStrategy.class=standard + -Dmaven.wagon.rto=60000 + +jobs: + sonarqube-scan: + name: SonarQube Scan + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + # Full history required for accurate blame and new-code period detection. + fetch-depth: 0 + # When triggered manually with a specific ref (commit SHA, branch, tag), + # check out that ref; otherwise fall back to the default event ref. + ref: ${{ (github.event_name == 'workflow_dispatch' && inputs.ref != '') && inputs.ref || github.ref }} + + - name: Set up JDK 17 + uses: actions/setup-java@v4 + with: + distribution: corretto + java-version: '17' + cache: maven + + # Decode the IBM truststore from the base64 secret and write it to disk. + # Secret is bound to an env var to avoid shell-injection (S7636). + - name: Decode IBM SonarQube truststore + env: + TRUSTSTORE_B64: ${{ secrets.IBM_SONARQUBE_CERT_TRUSTSTORE_BASE64 }} + run: | + echo "$TRUSTSTORE_B64" | base64 --decode > "${{ env.TRUSTSTORE_PATH }}" + + # Produce .class files required by SonarQube's Java bytecode analyser. + - name: Build + run: mvn -B package -DskipTests --no-transfer-progress + + # Pinned to v8.2.1 (SHA: 22918119ff8e1ca75a623e15c8296b6ea4fbe28f). + - name: Run SonarQube scan + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f + env: + SONAR_TOKEN: ${{ secrets.IBM_SONARQUBE_API_TOKEN }} + SONAR_HOST_URL: ${{ env.SONAR_HOST_URL }} + with: + args: > + -D sonar.projectKey=${{ vars.SONAR_PROJECT_KEY }} + -D sonar.projectName=${{ vars.SONAR_PROJECT_NAME }} + -D sonar.java.source=17 + -D sonar.sources=. + -D sonar.exclusions=**/proto/**,**/shade/**,**/shaded/**,**/target/** + -D sonar.java.binaries=**/target/classes + -D sonar.scanner.truststorePath=${{ env.TRUSTSTORE_PATH }} + -D sonar.scanner.truststorePassword=${{ secrets.IBM_SONARQUBE_CERT_PASSWORD }} + ${{ (github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.scan_type == 'pr')) + && format('-Dsonar.pullrequest.key={0} -Dsonar.pullrequest.branch={1} -Dsonar.pullrequest.base={2}', + github.event.pull_request.number, github.head_ref, github.base_ref) + || format('-Dsonar.branch.name={0}', + (github.event_name == 'workflow_dispatch' && inputs.ref != '') && inputs.ref || github.ref_name) }} \ No newline at end of file From a6d855b0ab86f5ff9561669f0302dff3ad9b9340 Mon Sep 17 00:00:00 2001 From: sandeep-ctds Date: Thu, 20 Aug 2026 17:27:53 +0530 Subject: [PATCH 2/3] Updated sonar_host_url to use the value from vars --- .github/workflows/sonarqube.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/sonarqube.yaml b/.github/workflows/sonarqube.yaml index bece4dd..9630125 100644 --- a/.github/workflows/sonarqube.yaml +++ b/.github/workflows/sonarqube.yaml @@ -29,7 +29,6 @@ concurrency: cancel-in-progress: true env: - SONAR_HOST_URL: https://sonarqube-prod.whitewater.ibm.com TRUSTSTORE_PATH: ./ibm_castorevpcprod # Maven tuning — mirrors settings used across the rest of the CI workflows. MAVEN_OPTS: >- @@ -87,7 +86,7 @@ jobs: uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f env: SONAR_TOKEN: ${{ secrets.IBM_SONARQUBE_API_TOKEN }} - SONAR_HOST_URL: ${{ env.SONAR_HOST_URL }} + SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} with: args: > -D sonar.projectKey=${{ vars.SONAR_PROJECT_KEY }} From 4bb4c30a2959df4f04e60e6c5b970f29eaa507ac Mon Sep 17 00:00:00 2001 From: sandeep-ctds Date: Thu, 20 Aug 2026 21:52:17 +0530 Subject: [PATCH 3/3] Change SONAR_HOST_URL from vars to secrets --- .github/workflows/sonarqube.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sonarqube.yaml b/.github/workflows/sonarqube.yaml index 9630125..b159c34 100644 --- a/.github/workflows/sonarqube.yaml +++ b/.github/workflows/sonarqube.yaml @@ -86,7 +86,7 @@ jobs: uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f env: SONAR_TOKEN: ${{ secrets.IBM_SONARQUBE_API_TOKEN }} - SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }} + SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} with: args: > -D sonar.projectKey=${{ vars.SONAR_PROJECT_KEY }} @@ -101,4 +101,4 @@ jobs: && format('-Dsonar.pullrequest.key={0} -Dsonar.pullrequest.branch={1} -Dsonar.pullrequest.base={2}', github.event.pull_request.number, github.head_ref, github.base_ref) || format('-Dsonar.branch.name={0}', - (github.event_name == 'workflow_dispatch' && inputs.ref != '') && inputs.ref || github.ref_name) }} \ No newline at end of file + (github.event_name == 'workflow_dispatch' && inputs.ref != '') && inputs.ref || github.ref_name) }}