ci(sonar): run SonarCloud scan and upload coverage#10
Conversation
- add sonar-project.properties (org pleaseai, key pleaseai_cli-toolkit) - run SonarCloud scan in CI after tests, uploading coverage via sonar.javascript.lcov.reportPaths=coverage/lcov.info - pin SonarSource/sonarqube-scan-action to a full commit SHA (v8.2.0) - set fetch-depth: 0 so SonarCloud attributes new code accurately - non-blocking (continue-on-error), like the Codecov upload
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds SonarCloud analysis setup to CI and repository config. The workflow now fetches full git history, runs tests with coverage, and executes a SonarCloud scan with environment-provided credentials. ChangesSonarCloud setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the sonar-project.properties file to configure SonarCloud static analysis for the repository. The configuration defines source and test directories, test inclusions, LCOV coverage report paths, and exclusions. The review feedback suggests adding the sonar.typescript.tsconfigPath property to enable TypeScript type-aware rules, which will improve the accuracy of the static analysis.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| - name: SonarCloud Scan | ||
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 | ||
| continue-on-error: true | ||
| env: | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | ||
| SONAR_HOST_URL: https://sonarcloud.io |
There was a problem hiding this comment.
GITHUB_TOKEN in the step's env, the SonarCloud action cannot authenticate with the GitHub API to post inline analysis comments or the PR status check decoration. The dashboard upload still succeeds, but reviewers won't see any SonarCloud feedback directly on the PR.
| - name: SonarCloud Scan | |
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 | |
| continue-on-error: true | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| SONAR_HOST_URL: https://sonarcloud.io | |
| - name: SonarCloud Scan | |
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 | |
| continue-on-error: true | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| SONAR_HOST_URL: https://sonarcloud.io | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 48-53
Comment:
Without `GITHUB_TOKEN` in the step's `env`, the SonarCloud action cannot authenticate with the GitHub API to post inline analysis comments or the PR status check decoration. The dashboard upload still succeeds, but reviewers won't see any SonarCloud feedback directly on the PR.
```suggestion
- name: SonarCloud Scan
uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
continue-on-error: true
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```
How can I resolve this? If you propose a fix, please make it concise.
There was a problem hiding this comment.
Thanks — I checked the official SonarSource/sonarqube-scan-action README (pinned v8.2.0). For SonarQube Cloud, the only required env is SONAR_TOKEN; SONAR_HOST_URL is needed only for self-hosted Server, and GITHUB_TOKEN is not among the action's documented inputs for Cloud. PR decoration (status check + inline comments) on SonarCloud is handled by the SonarCloud GitHub App installed during project onboarding — not by passing GITHUB_TOKEN to the scanner. Adding it would also re-expose the token to this third-party action that the coderabbit/cubic threads just had us remove via persist-credentials: false. So I'm leaving it out and relying on the GitHub App for decoration. Happy to revisit if decoration doesn't appear after onboarding.
There was a problem hiding this comment.
You're right, and I apologize for the incorrect guidance. PR decoration on SonarCloud is indeed handled by the GitHub App installed during project onboarding — GITHUB_TOKEN is not a documented input for the cloud variant of the action, and adding it would contradict the persist-credentials: false posture already established. Your current setup is correct.
Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
48-53: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winSkip the Sonar step when the token is unavailable.
This step always runs, so forked PRs or any repo without
SONAR_TOKENconfigured will emit a known failure on every CI run even though the job is marked non-blocking. Guarding it on secret presence keeps CI signal cleaner.Suggested change
- name: SonarCloud Scan + if: ${{ secrets.SONAR_TOKEN != '' }} uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 continue-on-error: true env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: https://sonarcloud.io🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 48 - 53, The SonarCloud Scan step in the CI workflow always executes even when SONAR_TOKEN is missing, causing avoidable failures on forks or repos without the secret. Update the workflow condition for the SonarCloud Scan job step so it only runs when SONAR_TOKEN is present, keeping the existing SonarSource/sonarqube-scan-action step and continue-on-error behavior intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 17-20: The checkout step in the CI workflow is leaving Git
credentials available to later steps. Update the actions/checkout usage in the
workflow so the checkout configuration for the existing checkout step includes
persist-credentials set to false while preserving the current fetch-depth
setting for SonarCloud attribution.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 48-53: The SonarCloud Scan step in the CI workflow always executes
even when SONAR_TOKEN is missing, causing avoidable failures on forks or repos
without the secret. Update the workflow condition for the SonarCloud Scan job
step so it only runs when SONAR_TOKEN is present, keeping the existing
SonarSource/sonarqube-scan-action step and continue-on-error behavior intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: da6190cc-73eb-4a8a-a871-18a07fc2258c
📒 Files selected for processing (2)
.github/workflows/ci.ymlsonar-project.properties
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Architecture diagram
sequenceDiagram
participant CI as CI Workflow
participant Checkout as Checkout (fetch-depth:0)
participant Test as Test (bun test --coverage)
participant Coverage as coverage/lcov.info
participant Sonar as SonarCloud Scan Action
participant SC as SonarCloud Server
CI->>Checkout: Check out repository
Checkout->>Checkout: Full history for blame attribution
CI->>Test: Run test:coverage
Test->>Coverage: Generate lcov.info
CI->>Sonar: SonarCloud Scan (continue-on-error: true)
Note over Sonar: Uses SONAR_TOKEN from repo secrets
Note over Sonar: SONAR_HOST_URL = https://sonarcloud.io
Sonar->>Sonar: Read sonar-project.properties
Sonar->>Sonar: Resolve org=pleaseai, projectKey=pleaseai_cli-toolkit
Sonar->>Coverage: Read coverage/lcov.info
Sonar->>SC: Upload analysis with coverage
SC-->>Sonar: Analysis acknowledged
Sonar-->>CI: Scan completed (failure ignored)
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
bun test ran, then bun test --coverage re-ran the whole suite. The coverage run already executes and gates on the same tests, so the standalone step was duplicate work. Keep only the coverage run.
|
Added a small related CI cleanup in Re: the new parallel-steps Actions feature — it's technically applicable (single job, independent lint/type-check/test/build steps) but the benefit is marginal for this ~18s job and the feature is too new to verify (exact |
- ci.yml: set persist-credentials: false on checkout so the GITHUB_TOKEN is not persisted in .git/config for the third-party SonarCloud action (zizmor artipacked) - sonar-project.properties: add sonar.typescript.tsconfigPath for type-aware TypeScript analysis
|
1 participant
Adds SonarCloud static analysis to CI and uploads test coverage to SonarCloud.
Changes
sonar-project.properties(new):organization=pleaseai,projectKey=pleaseai_cli-toolkit,sources=src,tests=test, andsonar.javascript.lcov.reportPaths=coverage/lcov.infoso SonarCloud ingests the existing coverage report..github/workflows/ci.yml:test:coverage, so it reuses the generatedcoverage/lcov.info)SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0(per repo policy)SONAR_HOST_URL: https://sonarcloud.io(required — the unified scanner defaults to a SonarQube host otherwise)fetch-depth: 0on checkout for accurate new-code attribution / blamecontinue-on-error: true— non-blocking, matching the Codecov stepCoverage upload
bunfig.tomlalready emitscoverage/lcov.infoviabun test --coverage; the same file now feeds both Codecov and SonarCloud.SONAR_TOKENmust be added to repo secrets (Settings → Secrets and variables → Actions).pleaseai_cli-toolkitmust exist in thepleaseaiSonarCloud org. If your org slug / key differ, updatesonar-project.properties.Summary by cubic
Add SonarCloud static analysis to CI with type-aware TypeScript analysis and upload coverage from
coverage/lcov.info. The scan runs after coverage tests and is non-blocking.New Features
sonar-project.properties(orgpleaseai, keypleaseai_cli-toolkit,src/testpaths, test inclusions,sonar.typescript.tsconfigPath=tsconfig.json, lcov path, exclusions).coverage/lcov.infoto Codecov and SonarCloud; continue on error.fetch-depth: 0andpersist-credentials: false; run SonarCloud Scan via pinnedSonarSource/sonarqube-scan-actionwithSONAR_HOST_URL=https://sonarcloud.ioandSONAR_TOKEN.Migration
SONAR_TOKENto repo secrets.pleaseai_cli-toolkitproject exists in thepleaseaiSonarCloud org or updatesonar-project.properties.Written for commit 732c5e4. Summary will update on new commits.
Summary by CodeRabbit