ci: add Sourcery AI and SonarCloud review tools#1
Closed
Conversation
- .sourcery.yaml: auto-review PRs, ignore dist/plugin/json/md - CI workflow: add sonarcloud job with SonarSource scan action Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reviewer's GuideAdds Sourcery AI configuration for automated PR reviews and introduces a new SonarCloud scan job to the CI workflow, including basic conditions and path exclusions for generated and non-source files. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/ci.yml" line_range="31-33" />
<code_context>
- name: Quality checks
run: npm run check
+
+ sonarcloud:
+ runs-on: ubuntu-latest
+ if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+
+ steps:
</code_context>
<issue_to_address>
**issue (bug_risk):** Consider using the SonarCloud-specific GitHub Action rather than the SonarQube scan action.
`SonarSource/sonarqube-scan-action@v5` is intended for self-hosted SonarQube. For SonarCloud, prefer `SonarSource/sonarcloud-github-action@v2`, which applies SonarCloud-specific defaults (host URL, auth, etc.) and better matches the `sonar.organization` / `sonar.projectKey` configuration used here, reducing configuration risk.
</issue_to_address>
### Comment 2
<location path=".github/workflows/ci.yml" line_range="40-47" />
<code_context>
+ with:
+ fetch-depth: 0
+
+ - name: SonarCloud Scan
+ uses: SonarSource/sonarqube-scan-action@v5
+ env:
+ SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+ with:
+ args: >
+ -Dsonar.organization=zaferdace
+ -Dsonar.projectKey=zaferdace_roblox-shipcheck
</code_context>
<issue_to_address>
**suggestion (testing):** The Sonar job runs without any build/test steps, which may lead to incomplete analysis (e.g. missing coverage).
Since this job only checks out the repo and runs the scan, Sonar won’t see build artifacts, type information, or coverage reports. Please either consume artifacts from an existing build/test job or add the minimal install/build/test steps here before running the scan so Sonar can use the generated reports.
Suggested implementation:
```
sonarcloud:
runs-on: ubuntu-latest
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
- name: Install dependencies
run: npm ci
- name: Run tests with coverage
run: npm test -- --coverage
- name: SonarCloud Scan
uses: SonarSource/sonarqube-scan-action@v5
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
with:
args: >
-Dsonar.organization=zaferdace
-Dsonar.projectKey=zaferdace_roblox-shipcheck
-Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
```
1. If this project is not Node.js-based, replace the `setup-node`, `npm ci`, and `npm test -- --coverage` steps with the appropriate toolchain setup, build, and test commands that generate coverage for your language.
2. Update the Sonar argument `-Dsonar.javascript.lcov.reportPaths=coverage/lcov.info` to the correct coverage property and path for your stack (e.g., `sonar.python.coverage.reportPaths`, `sonar.go.coverage.reportPaths`, etc.).
3. If you already produce coverage in another job, you may instead:
- Use `actions/download-artifact` here to fetch that coverage artifact.
- Remove the install/test steps from this job.
- Point the Sonar args to the downloaded coverage file(s).
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+40
to
+47
| - name: SonarCloud Scan | ||
| uses: SonarSource/sonarqube-scan-action@v5 | ||
| env: | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | ||
| with: | ||
| args: > | ||
| -Dsonar.organization=zaferdace | ||
| -Dsonar.projectKey=zaferdace_roblox-shipcheck |
There was a problem hiding this comment.
suggestion (testing): The Sonar job runs without any build/test steps, which may lead to incomplete analysis (e.g. missing coverage).
Since this job only checks out the repo and runs the scan, Sonar won’t see build artifacts, type information, or coverage reports. Please either consume artifacts from an existing build/test job or add the minimal install/build/test steps here before running the scan so Sonar can use the generated reports.
Suggested implementation:
sonarcloud:
runs-on: ubuntu-latest
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
- name: Install dependencies
run: npm ci
- name: Run tests with coverage
run: npm test -- --coverage
- name: SonarCloud Scan
uses: SonarSource/sonarqube-scan-action@v5
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
with:
args: >
-Dsonar.organization=zaferdace
-Dsonar.projectKey=zaferdace_roblox-shipcheck
-Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
- If this project is not Node.js-based, replace the
setup-node,npm ci, andnpm test -- --coveragesteps with the appropriate toolchain setup, build, and test commands that generate coverage for your language. - Update the Sonar argument
-Dsonar.javascript.lcov.reportPaths=coverage/lcov.infoto the correct coverage property and path for your stack (e.g.,sonar.python.coverage.reportPaths,sonar.go.coverage.reportPaths, etc.). - If you already produce coverage in another job, you may instead:
- Use
actions/download-artifacthere to fetch that coverage artifact. - Remove the install/test steps from this job.
- Point the Sonar args to the downloaded coverage file(s).
- Use
- Switch from sonarqube-scan-action to sonarcloud-github-action@v5 - Add Node.js setup + npm ci + build before SonarCloud scan - Remove redundant args (read from sonar-project.properties) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Owner
Author
|
Superseded by PR #2 which includes these CI changes plus shooter genre features. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.sourcery.yamlfor automatic PR code reviewSetup Required
After merge:
SONAR_TOKENsecret (Settings → Secrets → Actions)Test plan
🤖 Generated with Claude Code
Summary by Sourcery
Add automated static analysis and review tooling configuration for Sourcery AI and SonarCloud in the repository and CI pipeline.
Build:
CI:
Chores: