Compare commits

...

5 Commits

Author SHA1 Message Date
Francisco Robles Martín
ee95a7cad6
Fix error message when pom or build.gradle are detected (#48) 2024-12-29 22:47:55 +07:00
Dwi Siswanto
616b2df627
docs: update blockquote notes
(adapt https://github.com/orgs/community/discussions/16925)

Signed-off-by: Dwi Siswanto <me@dw1.io>
2023-11-17 21:22:58 +07:00
Ivan Schaller
72254bbe1e fix project basedir path
Signed-off-by: Ivan Schaller <ivan@schaller.sh>
2023-09-25 15:20:37 +07:00
Dwi Siswanto
9017aabde4
chore: update CODEOWNERS 2023-09-12 06:20:22 +07:00
Dwi Siswanto
a76da8f0e6
docs: update README 2023-09-12 06:18:51 +07:00
3 changed files with 20 additions and 17 deletions

View File

@ -1 +1 @@
* @kitabisa/security @dwisiswant0
* @dwisiswant0

View File

@ -2,7 +2,7 @@
Using this GitHub Action, scan your code with SonarQube scanner to detects bugs, vulnerabilities and code smells in more than 20 programming languages!
<img src="https://www.sonarqube.org/assets/logo-31ad3115b1b4b120f3d1efd63e6b13ac9f1f89437f0cf6881cc4d8b5603a52b4.svg" width="320px">
<img src="https://assets-eu-01.kc-usercontent.com/d1e40bf0-65fc-01ef-5235-9aeaedac229b/12e3974b-220d-4cde-8f17-2ff9fa9d9c27/SonarQube_Logo.svg" width="320px">
SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs, code smells, and security vulnerabilities on 20+ programming languages.
@ -58,17 +58,20 @@ with:
These are some of the supported input parameters of action.
- `host` - **_(Required)_** this is the SonarQube server URL.
- `login` - **_(Required)_** the login or authentication token of a SonarQube user with Execute Analysis permission on the project. See [how to generate SonarQube token](https://docs.sonarqube.org/latest/user-guide/user-token/).
- `password` - The password that goes with the `login` username. This should be left blank if an `login` are authentication token.
- `projectBaseDir` - Set custom project base directory analysis.
- `projectKey` - The project's unique key _(allowed characters are: letters, numbers, `-`, `_`, `.` and `:`, with at least one non-digit)_.
- `projectName` - Name of the project that will be displayed on the SonarQube web interface.
- `projectVersion` - The project version.
- `encoding` - Encoding of the source code. Default is UTF-8.
| **Parameter** | **Description** | **Required?** | **Default** | **Note** |
|----------------------|---------------------------------------------------|---------------|-------------|-----------------------------------------------------------------------------------------------|
| **`host`** | SonarQube server URL | 🟢 | | |
| **`login`** | Login or authentication token of a SonarQube user | 🟢 | | `Execute Analysis` permission required. |
| **`password`** | The password that goes with the `login` username | 🔴 | | This should be left blank if an `login` are authentication token. |
| **`projectBaseDir`** | Set custom project base directory analysis | 🔴 | `.` | |
| **`projectKey`** | The project's unique key | 🔴 | | Allowed characters are: letters, numbers, `-`, `_`, `.` and `:`, with at least one non-digit. |
| **`projectName`** | Name of the project | 🔴 | | It will be displayed on the SonarQube web interface. |
| **`projectVersion`** | The project version | 🔴 | | |
| **`encoding`** | Encoding of the source code | 🔴 | `UTF-8` | |
> **Note**:
> If you're thinking of setting project metadata & other related things in a **`sonar-project.properties`** configuration file _(must be declared in the base directory `projectBaseDir`)_ instead of going through the [input parameters](#inputs), this action supports that!
> [!NOTE]
> If you opt to configure the project metadata and other related settings in a **`sonar-project.properties`** file (must be placed within the base directory, `projectBaseDir`) instead of using input parameters, this action is compatible with that approach!
## License

View File

@ -11,19 +11,19 @@ else
SONAR_PASSWORD=""
fi
if [[ -f "${INPUT_PROJECTBASEDIR%/}pom.xml" ]]; then
echo "::error file=${INPUT_PROJECTBASEDIR%/}pom.xml::Maven project detected. You should run the goal 'org.sonarsource.scanner.maven:sonar' during build rather than using this GitHub Action."
if [[ -f "${INPUT_PROJECTBASEDIR%/}/pom.xml" ]]; then
echo "::error file=${INPUT_PROJECTBASEDIR%/}/pom.xml::Maven project detected. You should run the goal 'org.sonarsource.scanner.maven:sonar' during build rather than using this GitHub Action."
exit 1
fi
if [[ -f "${INPUT_PROJECTBASEDIR%/}build.gradle" ]]; then
echo "::error file=${INPUT_PROJECTBASEDIR%/}build.gradle::Gradle project detected. You should use the SonarQube plugin for Gradle during build rather than using this GitHub Action."
if [[ -f "${INPUT_PROJECTBASEDIR%/}/build.gradle" ]]; then
echo "::error file=${INPUT_PROJECTBASEDIR%/}/build.gradle::Gradle project detected. You should use the SonarQube plugin for Gradle during build rather than using this GitHub Action."
exit 1
fi
unset JAVA_HOME
if [[ ! -f "${INPUT_PROJECTBASEDIR%/}sonar-project.properties" ]]; then
if [[ ! -f "${INPUT_PROJECTBASEDIR%/}/sonar-project.properties" ]]; then
[[ -z "${INPUT_PROJECTKEY}" ]] && SONAR_PROJECTKEY="${REPOSITORY_NAME}" || SONAR_PROJECTKEY="${INPUT_PROJECTKEY}"
[[ -z "${INPUT_PROJECTNAME}" ]] && SONAR_PROJECTNAME="${REPOSITORY_NAME}" || SONAR_PROJECTNAME="${INPUT_PROJECTNAME}"
[[ -z "${INPUT_PROJECTVERSION}" ]] && SONAR_PROJECTVERSION="" || SONAR_PROJECTVERSION="${INPUT_PROJECTVERSION}"