Skip to content

Commit 9430ee6

Browse files
gregaubertsonartech
gregaubert
authored and
sonartech
committed
SC-32878 Migrate SQCB Cirrus Tasks to GHA (#3507)
GitOrigin-RevId: 0b024c615cbf049bdd4233aa53cc4b5ffddecdb6
1 parent d5ad4d3 commit 9430ee6

File tree

13 files changed

+213
-423
lines changed

13 files changed

+213
-423
lines changed

‎.cirrus/Dockerfile‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎.github/actions/yarn-install/action.yml‎

Lines changed: 2 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,6 @@ description: Install dependencies using Yarn and cache them
44
runs:
55
using: composite
66
steps:
7-
- id: secrets
8-
uses: SonarSource/vault-action-wrapper@v3
9-
with:
10-
secrets: |
11-
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader username | ARTIFACTORY_USERNAME;
12-
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_ACCESS_TOKEN;
137
- uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3
148
with:
159
version: 2025.9.12
@@ -18,16 +12,8 @@ runs:
1812
with:
1913
path: |
2014
.yarn
21-
key: yarn-${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
22-
restore-keys: yarn-${{ runner.os }}-
15+
key: yarn-${{ runner.os }}
2316
- name: Yarn install dependencies
2417
shell: bash
25-
env:
26-
ARTIFACTORY_URL: 'https://repox.jfrog.io/artifactory'
27-
ARTIFACTORY_USERNAME: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USERNAME }}
28-
ARTIFACTORY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
2918
run: |
30-
yarn config set npmRegistryServer "${ARTIFACTORY_URL}/api/npm/npm"
31-
yarn config set npmAlwaysAuth true
32-
yarn config set npmAuthIdent ${ARTIFACTORY_USERNAME}:${ARTIFACTORY_ACCESS_TOKEN}
33-
yarn install --immutable
19+
CI=false yarn install

‎.github/copybara/copy.bara.sky‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,20 @@ core.workflow(
1818
[core.move(".github-public/", ".github", overwrite=True)],
1919
reversal=[core.move(".github/", ".github-public/", overwrite=True)],
2020
noop_behavior = "IGNORE_NOOP"),
21+
core.replace(
22+
before = '"~sq-server-addons/*": ["private/libs/sq-server-addons/src/*", "libs/sq-server-addons/src/*"]',
23+
after = '"~sq-server-addons/*": ["libs/sq-server-addons/src/*"]',
24+
paths = ["./tsconfig.base.json"],
25+
),
26+
core.replace(
27+
before = "${x}",
28+
after = "",
29+
multiline = True,
30+
regex_groups = {
31+
"x": "(?m)^.*BEGIN-PRIVATE-FEATURE-TESTS[\\w\\W]*?END-PRIVATE-FEATURE-TESTS.*$\\n",
32+
},
33+
paths = glob(["**-it.tsx?", "**-test.tsx?"]),
34+
),
2135
],
2236
mode = "ITERATIVE"
2337
)

‎.cirrus/scan-sq-server.sh‎ renamed to ‎.github/scripts/scan-sq-cb.sh‎

Lines changed: 32 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,50 @@
11
#!/bin/bash
2+
3+
# The following environment variables are expected to be set:
4+
# SONAR_HOST_URL
5+
# SONARQUBE_NEXT_URL
6+
# SONAR_TOKEN
7+
# SONARQUBE_NEXT_TOKEN
8+
# PROJECT_KEY
9+
# VERSION
10+
11+
# The following are Github Actions default environment variables:
12+
# GITHUB_SHA
13+
# GITHUB_BASE_REF
14+
# GITHUB_REPOSITORY
15+
# GITHUB_RUN_ID
16+
217
set -euo pipefail
318

4-
export GIT_SHA1=${CIRRUS_CHANGE_IN_REPO?}
5-
export GITHUB_BASE_BRANCH=${CIRRUS_BASE_BRANCH:-}
6-
export GITHUB_BRANCH=${CIRRUS_BRANCH?}
7-
export GITHUB_REPO=${CIRRUS_REPO_FULL_NAME?}
8-
export BUILD_NUMBER=${CI_BUILD_NUMBER?}
9-
export PULL_REQUEST=${CIRRUS_PR:-false}
10-
export PULL_REQUEST_SHA=${CIRRUS_BASE_SHA:-}
11-
export PIPELINE_ID=${CIRRUS_BUILD_ID?}
19+
export SONAR_HOST_URL=${SONAR_HOST_URL:-$SONARQUBE_NEXT_URL}
20+
export SONAR_TOKEN=${SONAR_TOKEN:-$SONARQUBE_NEXT_TOKEN}
21+
export PROJECT_KEY=${PROJECT_KEY:-sonarqube-webapp
1222
13-
: "${SONAR_HOST_URL?}" "${SONAR_TOKEN?}"
23+
echo "[DEBUG] GITHUB_SHA: ${GITHUB_SHA}"
24+
echo "[DEBUG] GITHUB_BASE_REF: ${GITHUB_BASE_REF}"
25+
echo "[DEBUG] GITHUB_REPOSITORY: ${GITHUB_REPOSITORY}"
26+
echo "[DEBUG] SONAR_HOST_URL: ${SONAR_HOST_URL}"
27+
echo "[DEBUG] PROJECT_KEY: ${PROJECT_KEY}"
1428
1529
git fetch --unshallow || true
16-
if [ -n "${GITHUB_BASE_BRANCH:-}" ]; then
17-
git fetch origin "${GITHUB_BASE_BRANCH}"
30+
if [ -n "${GITHUB_BASE_REF:-}" ]; then
31+
git fetch origin "${GITHUB_BASE_REF}"
1832
fi
1933
2034
PROJECT_VERSION=$(jq -r .version "apps/sq-server/package.json")
21-
ESLINT_REPORT_PATH=$(find ./ -name eslint-report.json -type f -not -path "**/.nx/*" -not -path "**/node_modules/*" | paste -sd ',')
35+
ESLINT_REPORT_PATH=$(find build/reports/ -name eslint-report.json -type f | paste -sd ',')
2236
2337
scanner_params=(
24-
"-DbuildNumber=${BUILD_NUMBER}"
25-
"-Dsonar.projectKey=sonarqube-webapp"
38+
"-Dsonar.projectKey=${PROJECT_KEY}"
2639
"-Dsonar.projectName=SonarQube Webapp"
2740
"-Dsonar.projectVersion=${PROJECT_VERSION}"
2841
"-Dsonar.host.url=${SONAR_HOST_URL}"
2942
"-Dsonar.token=${SONAR_TOKEN}"
30-
"-Dsonar.analysis.buildNumber=${BUILD_NUMBER}"
31-
"-Dsonar.analysis.pipeline=${PIPELINE_ID}"
32-
"-Dsonar.analysis.repository=${GITHUB_REPO}"
33-
"-Dsonar.analysis.sha1=${GIT_SHA1}"
43+
"-Dsonar.analysis.pipeline=${GITHUB_RUN_ID}"
44+
"-Dsonar.analysis.repository=${GITHUB_REPOSITORY}"
45+
"-Dsonar.analysis.sha1=${GITHUB_SHA}"
3446
"-Dsonar.eslint.reportPaths=${ESLINT_REPORT_PATH}"
35-
"-Dsonar.javascript.lcov.reportPaths=apps/sq-server/build/reports/coverage/lcov.info"
47+
"-Dsonar.javascript.lcov.reportPaths=build/reports/coverage/lcov.info"
3648
"-Dsonar.sources=apps/sq-server/,libs/",
3749
"-Dsonar.inclusions=**/src/**"
3850
"-Dsonar.exclusions=**/__tests__/**"
@@ -65,4 +77,4 @@ scanner_params=(
6577
**/helpers/cookies.ts,
6678
**/*Legacy.*")
6779
68-
sonar-scanner "${scanner_params[@]}"
80+
yarn run sonar-scanner "${scanner_params[@]}"

‎.github/scripts/scan-sq-cloud.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
# GITHUB_SHA
1616
# GITHUB_BASE_REF
1717
# GITHUB_REPOSITORY
18+
# GITHUB_RUN_ID
1819

1920
set -euo pipefail
2021

‎.github/scripts/scan-sq-server.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
# GITHUB_SHA
1616
# GITHUB_BASE_REF
1717
# GITHUB_REPOSITORY
18+
# GITHUB_RUN_ID
1819

1920
set -euo pipefail
2021

‎.github/workflows/build-sq-cb.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
name: Build SQ-Community Build Webapp
2+
on:
3+
push:
4+
branches:
5+
- master
6+
- branch-sqs-*
7+
8+
permissions:
9+
id-token: write # OIDC auth for vault
10+
contents: read # Checkout
11+
12+
env:
13+
ARTIFACTORY_URL: "https://repox.jfrog.io/artifactory"
14+
ARTIFACTORY_DEPLOY_REPO: "sonarsource-private-qa"
15+
ARTIFACTORY_DEPLOY_REPO_PUBLIC: "sonarsource-public-qa"
16+
REPORTS_PATH: apps/sq-server/build/reports
17+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
18+
GITHUB_BRANCH: ${{ github.head_ref || github.ref_name }}
19+
20+
concurrency:
21+
group: ${{ github.workflow }}-${{ github.ref }}
22+
cancel-in-progress: true
23+
24+
jobs:
25+
build:
26+
name: Build SQ-Community Build
27+
runs-on: github-ubuntu-latest-s
28+
steps:
29+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
30+
- uses: ./.github/actions/yarn-install
31+
- name: Build SQ-Community Build
32+
id: build-sq-cb
33+
shell: bash
34+
run: |
35+
yarn nx build sq-server --output-style=static
36+
- name: Upload build results
37+
if: success()
38+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
39+
with:
40+
name: sq-community-build
41+
path: |
42+
apps/sq-server/build/**
43+
if-no-files-found: warn
44+
45+
lint:
46+
name: Lint SQ-Community Build
47+
runs-on: github-ubuntu-latest-s
48+
steps:
49+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
50+
- uses: ./.github/actions/yarn-install
51+
- name: Lint SQ-Community Build
52+
id: lint-sq-cb
53+
shell: bash
54+
env:
55+
NODE_OPTIONS: --max-old-space-size=4096
56+
run: |
57+
yarn nx run-many -t lint-report -p sq-server,tag:scope:shared,tag:scope:server --output-style=static
58+
- name: Upload lint results
59+
if: success()
60+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
61+
with:
62+
name: sq-cb-results-scan-lint
63+
path: |
64+
**/build/reports/**
65+
!**/node_modules/**
66+
if-no-files-found: warn
67+
68+
unit-test:
69+
name: Unit tests SQ-Community Build
70+
runs-on: github-ubuntu-latest-l
71+
steps:
72+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
73+
- uses: ./.github/actions/yarn-install
74+
- name: Unit tests SQ-Community Build
75+
id: unit-tests-sq-community-build
76+
shell: bash
77+
env:
78+
NODE_OPTIONS: --max-old-space-size=8192
79+
SHARD_VALUE: 1
80+
SHARD_TOTAL: 1
81+
run: |
82+
yarn nx test-ci-shard sq-server --output-style=static
83+
- name: Upload unit test results
84+
if: success()
85+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
86+
with:
87+
name: sq-cb-results-scan-coverage
88+
path: |
89+
${{ env.REPORTS_PATH }}/**
90+
if-no-files-found: warn
91+
92+
scan:
93+
name: Scan SQ-Community Build
94+
needs: [build, lint, unit-test]
95+
runs-on: github-ubuntu-latest-s
96+
steps:
97+
- id: secrets
98+
uses: SonarSource/vault-action-wrapper@v3
99+
with:
100+
secrets: |
101+
development/kv/data/next url | NEXT_URL;
102+
development/kv/data/next token | NEXT_TOKEN;
103+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
104+
with:
105+
# Disabling shallow clones is recommended for improving the relevance of reporting
106+
fetch-depth: 0
107+
- uses: ./.github/actions/yarn-install
108+
- name: Download coverage and lint reports
109+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
110+
with:
111+
pattern: sq-cb-results-scan-*
112+
path: build/reports/
113+
merge-multiple: true
114+
- name: Scan SQ-Community Build on Next
115+
shell: bash
116+
env:
117+
SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_URL }}
118+
SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN }}
119+
run: |
120+
ls -la build/reports/
121+
.github/scripts/scan-sq-cb.sh
122+
123+
slack-notifications:
124+
runs-on: github-ubuntu-latest-s # Public GH runner is required, runners starting with sonar-* do not support this action
125+
if: failure() && github.ref_name == 'master'
126+
needs: [build, scan]
127+
permissions:
128+
id-token: write
129+
steps:
130+
- name: Vault Secrets
131+
id: secrets
132+
uses: SonarSource/vault-action-wrapper@v3
133+
with:
134+
secrets: |
135+
development/kv/data/slack token | SLACK_TOKEN;
136+
137+
- name: Slack Notification rtCamp
138+
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
139+
env:
140+
SLACK_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SLACK_TOKEN }}
141+
SLACK_CHANNEL: ops-sonarqube-webapp
142+
SLACK_TITLE: SQ-Community Build failed 🚨
143+
SLACK_ICON_EMOJI: ":github:"
144+
SLACK_USERNAME: BuildBot
145+
SLACK_COLOR: danger
146+
SLACK_MESSAGE: |
147+
Workflow failed in ${{ github.repository }}
148+
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
149+
Branch: ${{ github.head_ref || github.ref_name }}

‎apps/sq-server/jest.config.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,9 @@ module.exports = {
4747
'~adapters/(.+)': '<rootDir>/libs/sq-server-commons/src/sq-server-adapters/$1',
4848

4949
// sq-server specific modules aliases
50-
'~sq-server-addons': isPrivateEdition
51-
? '<rootDir>/private/libs/sq-server-addons/src/index.ts'
52-
: '<rootDir>/libs/sq-server-addons/src/index.ts',
50+
'~sq-server-addons/(.+)': isPrivateEdition
51+
? '<rootDir>/private/libs/sq-server-addons/src/$1'
52+
: '<rootDir>/libs/sq-server-addons/src/$1',
5353
'~sq-server-features/(.+)': '<rootDir>/private/libs/sq-server-features/src/$1',
5454
'~sq-server-commons/(.+)': '<rootDir>/libs/sq-server-commons/src/$1',
5555

0 commit comments

Comments
 (0)