英文:
Run Sonar scan for PRs from forks
问题
我正在尝试设置一个GitHub Actions工作流,用于在每个PR上运行Sonar分析。我有一个作业用于运行单元测试并上传测试报告。然后第二个作业下载报告并运行分析。这对于我的PR工作正常。但是由来自分支仓库的PR触发的工作流程无法访问密钥,因此Sonar在那里无法正常工作。
我尝试通过将工作流程拆分为两个部分来解决这个问题,其中Sonar部分由PR的workflow_run
触发。问题是,无论我做什么,Sonar都会忽略测试覆盖率报告,并标记PR为"没有覆盖信息"。
这是我使用的工作流程定义:
on:
workflow_run:
workflows:
- Pull request verification
types:
- completed
env:
JAVA_DISTRIBUTION: 'temurin'
JAVA_VERSION: '17'
jobs:
pr_sonar_analysis:
name: PR sonar analysis
runs-on: ubuntu-latest
container:
image: fedora:38
steps:
- name: Install dependencies
shell: bash
run: dnf --setopt install_weak_deps=False install -y gettext jss unzip tree git
- name: Check out repository
uses: actions/checkout@v3
- name: Download test reports
uses: actions/github-script@v6
with:
script: |
let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: context.payload.workflow_run.id,
});
let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
return artifact.name == "unit_test_reports"
})[0];
let download = await github.rest.actions.downloadArtifact({
owner: context.repo.owner,
repo: context.repo.repo,
artifact_id: matchArtifact.id,
archive_format: 'zip',
});
let fs = require('fs');
fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/unit_test_reports.zip`, Buffer.from(download.data));
- name: 'Unzip artifact'
run: unzip unit_test_reports.zip
- name: Set up Java
uses: actions/setup-java@v3
with:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: Run sonar
uses: gradle/gradle-build-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
with:
arguments: sonar -x coverage
-Dsonar.scm.provider=git
-Dsonar.pullrequest.key=${{ github.event.workflow_run.pull_requests[0].number }}
-Dsonar.pullrequest.base=${{ github.event.workflow_run.pull_requests[0].base.ref }}
-Dsonar.pullrequest.branch=${{ github.event.workflow_run.pull_requests[0].head.ref }}
-Dorg.gradle.jvmargs=-Xmx1g
我尝试过:
- 仅上传覆盖率报告
- 仅上传
jacoco.exec
并在Sonar作业中生成报告 - 上传构建文件夹中的所有内容
- 重新定义Jacoco生成报告和Sonar读取报告的路径
- 在
workflow_run
中同时运行单元测试和Sonar。即使在这种情况下,Sonar也报告"没有覆盖信息"。
是否有什么方法可以强制Sonar使用我提供的覆盖率信息?
英文:
I am trying to setup a Github Actions Workflow that runs Sonar analysis for each PR. I have one job that runs unit tests and uploads the test reports. Second job then downloads the reports and runs the analysis. This works fine for my PRs. But workflows triggered by PR from forked repos do not have access to secrets so the sonar is not working there.
I tried to solve this by splitting the workflow in two where sonar part is triggered by workflow_run
of the PR. The problem is that no matter what I do, the sonar ignores the test coverage reports and marks PR with "No Coverage information".
Here is the workflow definition I am using.
on:
workflow_run:
workflows:
- Pull request verification
types:
- completed
env:
JAVA_DISTRIBUTION: 'temurin'
JAVA_VERSION: '17'
jobs:
pr_sonar_analysis:
name: PR sonar analysis
runs-on: ubuntu-latest
container:
image: fedora:38
steps:
- name: Install dependencies
shell: bash
run: dnf --setopt install_weak_deps=False install -y gettext jss unzip tree git
- name: Check out repository
uses: actions/checkout@v3
- name: Download test reports
uses: actions/github-script@v6
with:
script: |
let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: context.payload.workflow_run.id,
});
let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
return artifact.name == "unit_test_reports"
})[0];
let download = await github.rest.actions.downloadArtifact({
owner: context.repo.owner,
repo: context.repo.repo,
artifact_id: matchArtifact.id,
archive_format: 'zip',
});
let fs = require('fs');
fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/unit_test_reports.zip`, Buffer.from(download.data));
- name: 'Unzip artifact'
run: unzip unit_test_reports.zip
- name: Set up Java
uses: actions/setup-java@v3
with:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
- name: Run sonar
uses: gradle/gradle-build-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
with:
arguments: sonar -x coverage
-Dsonar.scm.provider=git
-Dsonar.pullrequest.key=${{ github.event.workflow_run.pull_requests[0].number }}
-Dsonar.pullrequest.base=${{ github.event.workflow_run.pull_requests[0].base.ref }}
-Dsonar.pullrequest.branch=${{ github.event.workflow_run.pull_requests[0].head.ref }}
-Dorg.gradle.jvmargs=-Xmx1g
I tried:
- Uploading just the coverage report
- Uploading just
jacoco.exec
and generating report in sonar job - Uploading everything in build folder
- Redefining paths where jacoco generates reports and from where sonar reads them
- Running both unit tests and sonar in workflow_run. Even in this case sonar reports "No Coverage information"
Is there something to force sonar to use the coverage I am providing?
答案1
得分: 0
工作流程正在检出错误的分支。在切换分支后,工作流程按预期运行。
- name: 检出仓库
uses: actions/checkout@v3
with:
repository: ${{ github.event.workflow_run.head_repository.full_name }}
# 检出触发此工作流的提交
ref: ${{ github.event.workflow_run.pull_requests[0].head.ref }}
fetch-depth: 0
英文:
Workflow was checking out the wrong branch. After switching branches workflow works as expected.
- name: Check out repository
uses: actions/checkout@v3
with:
repository: ${{ github.event.workflow_run.head_repository.full_name }}
# checkout commit that triggered this workflow
ref: ${{ github.event.workflow_run.pull_requests[0].head.ref }}
fetch-depth: 0
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论