diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml deleted file mode 100644 index 33e204378..000000000 --- a/.github/workflows/sonar.yaml +++ /dev/null @@ -1,48 +0,0 @@ -name: Sonarqube Workflow - -on: - workflow_dispatch: - push: - branches: - - develop - pull_request: - types: [opened, synchronize, reopened] - -jobs: - sonarqube: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - with: - # Disabling shallow clone is recommended for improving relevancy of reporting - fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} - - uses: nrwl/nx-set-shas@v3 - with: - main-branch-name: 'develop' - - name: Install pnpm - uses: pnpm/action-setup@v2 - with: - version: 7.25.1 - - uses: actions/setup-node@v3 - with: - node-version: 18.13.0 - cache: pnpm - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Test - run: pnpm run test:ci - env: - NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }} - - name: SonarQube Scan - run: ./scripts/sonar/run-sonar.sh - env: - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} - timeout-minutes: 30 - - services: - sonarqube: - image: sonarqube:8.9-community - ports: - - 9000:9000 diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml new file mode 100644 index 000000000..5945d8151 --- /dev/null +++ b/.github/workflows/sonarcloud.yml @@ -0,0 +1,134 @@ +name: SonarCloud +on: + workflow_dispatch: + push: + branches: + - master + - develop + pull_request: + types: [opened, synchronize, reopened] + +jobs: + # Snap + sonarcloud-snap: + name: SonarCloud snap + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 0 + - uses: nrwl/nx-set-shas@v3 + with: + main-branch-name: 'develop' + - name: Install pnpm + uses: pnpm/action-setup@v2 + with: + version: 7.25.1 + - uses: actions/setup-node@v3 + with: + node-version: 18.13.0 + cache: pnpm + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Test snap + run: pnpm nx test:ci @blockchain-lab-um/ssi-snap + env: + NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }} + - name: Scan snap + uses: SonarSource/sonarcloud-github-action@master + with: + projectBaseDir: packages/snap + args: > + -Dsonar.organization=blockchain-lab-um + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }} + + # VC Manager + sonarcloud-vcmanager: + name: SonarCloud VC Manager + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 0 + - uses: nrwl/nx-set-shas@v3 + with: + main-branch-name: 'develop' + - name: Install pnpm + uses: pnpm/action-setup@v2 + with: + version: 7.25.1 + - uses: actions/setup-node@v3 + with: + node-version: 18.13.0 + cache: pnpm + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Test snap + run: pnpm nx test:ci @blockchain-lab-um/veramo-vc-manager + env: + NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }} + - name: Scan VC Manager + uses: SonarSource/sonarcloud-github-action@master + with: + projectBaseDir: packages/vcmanager + args: > + -Dsonar.organization=blockchain-lab-um + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }} + + # Connector + sonarcloud-connector: + name: SonarCloud connector + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 0 + - name: Scan connector + uses: SonarSource/sonarcloud-github-action@master + with: + projectBaseDir: packages/connector + args: > + -Dsonar.organization=blockchain-lab-um + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }} + + # Dapp + sonarcloud-dapp: + name: SonarCloud dapp + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 0 + - name: Scan dapp + uses: SonarSource/sonarcloud-github-action@master + with: + projectBaseDir: packages/dapp + args: > + -Dsonar.organization=blockchain-lab-um + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }} + + # Docs + sonarcloud-docs: + name: SonarCloud docs + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 0 + - name: Scan docs + uses: SonarSource/sonarcloud-github-action@master + with: + projectBaseDir: packages/docs + args: > + -Dsonar.organization=blockchain-lab-um + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }} diff --git a/packages/connector/sonar-project.properties b/packages/connector/sonar-project.properties index f80b64457..e6d20c414 100644 --- a/packages/connector/sonar-project.properties +++ b/packages/connector/sonar-project.properties @@ -1,5 +1,5 @@ -sonar.projectKey=connector -sonar.projectName=connector +sonar.projectKey=blockchain-lab-um_connector +sonar.projectName=blockchain-lab-um_connector sonar.sourceEncoding=UTF-8 sonar.sources=src sonar.exclusions=**/node_modules/**,**/*spec.ts,**/*.e2e-spec.ts diff --git a/packages/dapp/sonar-project.properties b/packages/dapp/sonar-project.properties new file mode 100644 index 000000000..b742f439a --- /dev/null +++ b/packages/dapp/sonar-project.properties @@ -0,0 +1,7 @@ +sonar.projectKey=blockchain-lab-um_dapp +sonar.projectName=blockchain-lab-um_dapp +sonar.sourceEncoding=UTF-8 +sonar.sources=src +sonar.exclusions=**/node_modules/**,**/*spec.ts,**/*.e2e-spec.ts +sonar.test.inclusions=**/*spec.ts,**/*.e2e-spec.ts +sonar.javascript.lcov.reportPaths=coverage/lcov.info diff --git a/packages/docs/sonar-project.properties b/packages/docs/sonar-project.properties index 878cc7601..b8ec8e861 100644 --- a/packages/docs/sonar-project.properties +++ b/packages/docs/sonar-project.properties @@ -1,5 +1,5 @@ -sonar.projectKey=docs -sonar.projectName=docs +sonar.projectKey=blockchain-lab-um_docs +sonar.projectName=blockchain-lab-um_docs sonar.sourceEncoding=UTF-8 sonar.sources=src sonar.exclusions=**/node_modules/**,**/*spec.ts,**/*.e2e-spec.ts diff --git a/packages/snap/sonar-project.properties b/packages/snap/sonar-project.properties index f6b217110..fce8bc88d 100644 --- a/packages/snap/sonar-project.properties +++ b/packages/snap/sonar-project.properties @@ -1,5 +1,5 @@ -sonar.projectKey=snap -sonar.projectName=snap +sonar.projectKey=blockchain-lab-um_snap +sonar.projectName=blockchain-lab-um_snap sonar.sourceEncoding=UTF-8 sonar.sources=src sonar.exclusions=**/node_modules/**,**/*spec.ts,**/*.e2e-spec.ts diff --git a/packages/vcmanager/package.json b/packages/vcmanager/package.json index 99c298c5e..fe9cd3413 100644 --- a/packages/vcmanager/package.json +++ b/packages/vcmanager/package.json @@ -20,7 +20,8 @@ "lint:eslint": "eslint .", "lint:prettier": "prettier . --check", "prepack": "pnpm build", - "test": "pnpm jest" + "test": "pnpm jest", + "test:ci": "pnpm run test --silent --coverage" }, "dependencies": { "@blockchain-lab-um/ssi-snap-types": "*", diff --git a/packages/vcmanager/sonar-project.properties b/packages/vcmanager/sonar-project.properties index 261fccd6b..e0c1ae1c5 100644 --- a/packages/vcmanager/sonar-project.properties +++ b/packages/vcmanager/sonar-project.properties @@ -1,5 +1,5 @@ -sonar.projectKey=vcmanager -sonar.projectName=vcmanager +sonar.projectKey=blockchain-lab-um_vc-manager +sonar.projectName=blockchain-lab-um_vc-manager sonar.sourceEncoding=UTF-8 sonar.sources=src sonar.exclusions=**/node_modules/**,**/*spec.ts,**/*.e2e-spec.ts diff --git a/scripts/sonar/Dockerfile b/scripts/sonar/Dockerfile deleted file mode 100644 index 5425bf9d7..000000000 --- a/scripts/sonar/Dockerfile +++ /dev/null @@ -1,17 +0,0 @@ -FROM sonarsource/sonar-scanner-cli:4.7 - -LABEL version="1.1.0" \ - repository="https://github.com/sonarsource/sonarqube-scan-action" \ - homepage="https://github.com/sonarsource/sonarqube-scan-action" \ - maintainer="SonarSource" \ - com.github.actions.name="SonarQube Scan" \ - com.github.actions.description="Scan your code with SonarQube to detect Bugs, Vulnerabilities and Code Smells in up to 27 programming languages!" \ - com.github.actions.icon="check" \ - com.github.actions.color="green" - - -COPY entrypoint.sh /entrypoint.sh -RUN chmod +x /entrypoint.sh -COPY cleanup.sh /cleanup.sh -RUN chmod +x /cleanup.sh -ENTRYPOINT ["/entrypoint.sh"] diff --git a/scripts/sonar/cleanup.sh b/scripts/sonar/cleanup.sh deleted file mode 100755 index a2606ba33..000000000 --- a/scripts/sonar/cleanup.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -set -e - -_tmp_file=$(ls "${INPUT_PROJECTBASEDIR}/" | head -1) -PERM=$(stat -c "%u:%g" "${INPUT_PROJECTBASEDIR}/$_tmp_file") - -chown -R $PERM "${INPUT_PROJECTBASEDIR}/" diff --git a/scripts/sonar/entrypoint.sh b/scripts/sonar/entrypoint.sh deleted file mode 100755 index 88f61cd89..000000000 --- a/scripts/sonar/entrypoint.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash - -set -e - -if [[ -z "${SONAR_TOKEN}" ]]; then - echo "============================ WARNING ============================" - echo "Running this GitHub Action without SONAR_TOKEN is not recommended" - echo "============================ WARNING ============================" -fi - -if [[ -z "${SONAR_HOST_URL}" ]]; then - echo "This GitHub Action requires the SONAR_HOST_URL env variable." - exit 1 -fi - -if [[ -n "${SONAR_ROOT_CERT}" ]]; then - echo "Adding custom root certificate to java certificate store" - rm -f /tmp/tmpcert.pem - echo "${SONAR_ROOT_CERT}" > /tmp/tmpcert.pem - keytool -keystore /etc/ssl/certs/java/cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias sonarqube -file /tmp/tmpcert.pem -fi - -unset JAVA_HOME - -sonar-scanner -Dsonar.projectBaseDir=${INPUT_PROJECTBASEDIR} ${INPUT_ARGS} diff --git a/scripts/sonar/run-sonar.sh b/scripts/sonar/run-sonar.sh deleted file mode 100755 index a9761affc..000000000 --- a/scripts/sonar/run-sonar.sh +++ /dev/null @@ -1,97 +0,0 @@ -#!/bin/bash - -# Helper functions for coloring output. -info() { echo -e "\\e[36m$*\\e[0m"; } -error() { echo -e "\\e[31m✗ $*\\e[0m"; } -success() { echo -e "\\e[32m✔ $*\\e[0m"; } - -# Helper function to check if SonarQube is up and running. -check_sq_is_up() { - local statusCall="$(curl --silent --user admin:admin http://127.0.0.1:9000/api/system/status)" - local status="$(jq -r '.status' <<< "$statusCall")" - if [[ ! $? -eq 0 ]]; then - error "Failed to check if SonarQube is up and running." - exit 1 - fi - echo $status; -} - - -info "Build scanner action..." - -docker build --no-cache -t sonarsource/sonarqube-scan-action ./scripts/sonar/ -if [[ ! $? -eq 0 ]]; then - error "Failed to build the scanner action." - exit 1 -fi -success "Scanner action built." - -info "Find the network SonarQube is running on..." -network=$(docker network ls -f 'name=github_network' --format "{{.Name}}") -if [[ $network != "github_network_"* ]]; then - error "Failed to find the local Docker network." - exit 1 -fi -success "Found the network ($network)." - -info "Wait until SonarQube is up..." -sleep 10 -isUp=$(check_sq_is_up) -until [[ "$isUp" == "UP" ]]; do - sleep 1 - isUp=$(check_sq_is_up) -done -success "SonarQube is up and running." - -info "Generate a new token..." -tokenCall=$(curl --silent --user admin:admin -d "name=token" http://127.0.0.1:9000/api/user_tokens/generate) -token="$(jq -r '.token' <<< "$tokenCall")" -if [[ -z "$token" ]]; then - error "Failed to generate a new token." - exit 1 -fi -success "New token generated." - -info "Test fail-fast if SONAR_TOKEN is omitted..." -docker run -v `pwd`:/github/workspace/ --workdir /github/workspace --network $network sonarsource/sonarqube-scan-action -if [[ $? -eq 0 ]]; then - error "Should have failed fast." - exit 1 -fi -success "Correctly failed fast." - -info "Test fail-fast if SONAR_HOST_URL is omitted..." -docker run -v `pwd`:/github/workspace/ --workdir /github/workspace --network $network --env SONAR_TOKEN=$token sonarsource/sonarqube-scan-action -if [[ $? -eq 0 ]]; then - error "Should have failed fast." - exit 1 -fi -success "Correctly failed fast." - -info "Analyze projects..." -# Loop over packages subdirectories. -for package in packages/*; do - dir="/github/workspace/${package%*/}" # remove the trailing "/" - if [[ -f "$package/sonar-project.properties" ]]; then - echo "Analyzing $package..." - docker run -v `pwd`:/github/workspace/ --workdir /github/workspace --network $network --env INPUT_PROJECTBASEDIR=$dir --env SONAR_TOKEN=$SONAR_TOKEN --env SONAR_HOST_URL=$SONAR_HOST_URL sonarsource/sonarqube-scan-action - docker run -v `pwd`:/github/workspace/ --workdir /github/workspace --network $network --env INPUT_PROJECTBASEDIR=$dir --entrypoint /cleanup.sh sonarsource/sonarqube-scan-action - if [[ ! $? -eq 0 ]]; then - error "Failed to analyze $package." - exit 1 - elif [[ ! -f "$package/.scannerwork/report-task.txt" ]]; then - error "Couldn't find the report task file. Analysis failed." - exit 1 - fi - else - echo "Skipping $package..." - fi - echo $dir -done - -success "Analysis successful." - -echo "" # new line -echo "============================" -echo "" # new line -success "QA successful!"