sonar.yml

# This workflow is triggered by the completion of our CI workflow
# It then checks out the pull request repository / branch, runs the
# sonar scanner, downloads the coverage report and uploads the report
# to the sonarqube server. This is necessary as forks don't have access
# to secrets and SONAR_TOKEN is required to upload reports.
#
# Adapted from https://github.com/medplum/medplum/

name: Sonar

on:
  workflow_run:
    workflows: [CI]
    types: [completed]

jobs:
  sonar:
    name: Sonar
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'
    steps:
      - uses: actions/checkout@v4
        with:
          repository: ${{ github.event.workflow_run.head_repository.full_name }}
          ref: ${{ github.event.workflow_run.head_branch }}
          fetch-depth: 0

      - name: 'Download code coverage'
        uses: actions/github-script@v7
        with:
          script: |
            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: context.payload.workflow_run.id,
            });
            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "ctapipe-coverage-report"
            })[0];
            let download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            let fs = require('fs');
            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/ctapipe-coverage-report.zip`, Buffer.from(download.data));

      - name: 'Unzip code coverage'
        run: unzip ctapipe-coverage-report.zip -d coverage

      - name: Check artifact
        run: ls -l coverage

      - name: Set environment
        run: |
          cat coverage/sonar_env >> "$GITHUB_ENV"
          cat coverage/sonar_env

      - name: Sonarqube Scan
        uses: SonarSource/sonarqube-scan-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: https://sonar-cta-dpps.zeuthen.desy.de
        with:
          args: >
            -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
            -Dsonar.pullrequest.key=${{ env.PR_NUMBER }}
            -Dsonar.pullrequest.branch=${{ env.SOURCE_BRANCH }}
            -Dsonar.pullrequest.base=${{ env.TARGET_BRANCH }}