ci: set up SonarCloud analysis and Rust coverage upload #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sonar | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: sonar-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| sonar: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| # Full history so SonarQube Cloud can attribute new code / blame. | |
| fetch-depth: 0 | |
| # --- TypeScript coverage (coverage/lcov.info) --- | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Test with coverage (TypeScript) | |
| run: bun test --coverage --coverage-reporter=lcov | |
| # --- Rust coverage (coverage/rust-lcov.info) --- | |
| # rust-toolchain.toml uses `profile = "minimal"`, so the llvm-tools-preview | |
| # component (required by cargo-llvm-cov) is not present by default. | |
| - name: Add llvm-tools-preview component | |
| run: rustup component add llvm-tools-preview | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2 | |
| with: | |
| tool: cargo-llvm-cov | |
| - name: Test with coverage (Rust) | |
| # #[ignore] (network-gated) tests are excluded by default, keeping this | |
| # offline (see ADR-0004). --all-features mirrors the Rust CI gate. | |
| run: cargo llvm-cov --workspace --locked --all-features --lcov --output-path coverage/rust-lcov.info | |
| # --- SonarQube Cloud analysis --- | |
| - name: SonarQube Cloud scan | |
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |