Skip to content

ci(sonar): run SonarCloud scan and upload coverage #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amondnet merged 3 commits into from
Jun 27, 2026
Merged

ci(sonar): run SonarCloud scan and upload coverage #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
29f7999
ci(sonar): run SonarCloud scan and upload coverage
amondnet Jun 27, 2026
7ef6043
ci: drop redundant standalone test run
amondnet Jun 27, 2026
732c5e4
chore: apply AI code review suggestions
amondnet Jun 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 13 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,11 @@ jobs:

steps:
- uses: actions/checkout@v4
with:
# Full history so SonarCloud can attribute new code / blame accurately.
fetch-depth: 0
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Comment thread
amondnet marked this conversation as resolved.
# No later step needs authenticated git; keep the token out of .git/config.
persist-credentials: false

- uses: oven-sh/setup-bun@v2
with:
Expand All @@ -29,10 +34,7 @@ jobs:
- name: Type check
run: bun run type-check

- name: Run tests
run: bun test

- name: Generate coverage report
- name: Run tests with coverage
run: bun run test:coverage

- name: Upload coverage reports to Codecov
Expand All @@ -42,6 +44,13 @@ jobs:
files: ./coverage/lcov.info
continue-on-error: true

- name: SonarCloud Scan
uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
continue-on-error: true
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
Comment on lines +47 to +52

@greptile-apps greptile-apps Bot Jun 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Without GITHUB_TOKEN in the step's env, the SonarCloud action cannot authenticate with the GitHub API to post inline analysis comments or the PR status check decoration. The dashboard upload still succeeds, but reviewers won't see any SonarCloud feedback directly on the PR.

Suggested change
- name: SonarCloud Scan
uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
continue-on-error: true
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
- name: SonarCloud Scan
uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
continue-on-error: true
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 48-53

Comment:
Without `GITHUB_TOKEN` in the step's `env`, the SonarCloud action cannot authenticate with the GitHub API to post inline analysis comments or the PR status check decoration. The dashboard upload still succeeds, but reviewers won't see any SonarCloud feedback directly on the PR.

```suggestion
      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
        continue-on-error: true
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: https://sonarcloud.io
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

How can I resolve this? If you propose a fix, please make it concise.

Fix in Claude Code

@amondnet amondnet Jun 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks — I checked the official SonarSource/sonarqube-scan-action README (pinned v8.2.0). For SonarQube Cloud, the only required env is SONAR_TOKEN; SONAR_HOST_URL is needed only for self-hosted Server, and GITHUB_TOKEN is not among the action's documented inputs for Cloud. PR decoration (status check + inline comments) on SonarCloud is handled by the SonarCloud GitHub App installed during project onboarding — not by passing GITHUB_TOKEN to the scanner. Adding it would also re-expose the token to this third-party action that the coderabbit/cubic threads just had us remove via persist-credentials: false. So I'm leaving it out and relying on the GitHub App for decoration. Happy to revisit if decoration doesn't appear after onboarding.

@greptile-apps greptile-apps Bot Jun 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right, and I apologize for the incorrect guidance. PR decoration on SonarCloud is indeed handled by the GitHub App installed during project onboarding — GITHUB_TOKEN is not a documented input for the cloud variant of the action, and adding it would contradict the persist-credentials: false posture already established. Your current setup is correct.

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.


- name: Build
run: bun run build

Expand Down
16 changes: 16 additions & 0 deletions sonar-project.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
sonar.organization=pleaseai
sonar.projectKey=pleaseai_cli-toolkit

# Analyze source; tests live under test/
sonar.sources=src
sonar.tests=test
sonar.test.inclusions=test/**/*.test.ts
Comment thread
amondnet marked this conversation as resolved.

# Enable type-aware TypeScript analysis
sonar.typescript.tsconfigPath=tsconfig.json

# Coverage produced by `bun test --coverage` (see bunfig.toml)
sonar.javascript.lcov.reportPaths=coverage/lcov.info

# Build output and coverage artifacts are not source
sonar.exclusions=dist/**,coverage/**
Loading