|
1 | | -# Create Sonar Scan Evidence predicate from the build CI and attach it to the build info |
2 | | -Sonar is a code scanning tool that helps to identify bugs, vulnerabilities, and code smells in your code. |
3 | | -It is important to track the code quality and security of the code changes done and released. |
4 | | -To allow automation of proper code quality and security checks, we create an evidence of the Sonar scan results |
5 | | -during the build with confirmation that the code quality and security checks passed before the code was committed. |
6 | | -using the `FailOnAnalysisFailure` argument the customer can decide if to create the sonar scan evidence if the scan did not pass |
7 | | -sonar quality gates, or fail the predicate creation with exist status 1. |
8 | | -If the Analysis status is not 'OK', but `FailOnAnalysisFailure` was not set, then the predicate is created with analysis.status = 'ERROR' which |
9 | | -should be checked using a policy. |
10 | | - |
11 | | -## Environment variables |
12 | | -- `SONAR_TOKEN` - The sonar server token. |
13 | | -- `SONAR_TYPE` - Should be Either SAAS or SELFHOSTED, defaulting to SAAS. |
14 | | -- `SONAR_HOST_URL` - The sonar server host name, for example https://mysonar.mycorp.com, for example sonar.myconpany.org. required for SELFHOSTED type, if not provided for SAAS type sonarcloud.io is used as default. |
15 | | -- `SONAR_PROXY_URL` - The proxy server URL, in the format of http://your-proxy-server:port. or https://username:password@your-proxy-server:port |
16 | | - |
17 | | -## Arguments |
18 | | -`--reportTaskFile=<path>` - The path to the sonar report task file. |
19 | | -`--FailOnAnalysisFailure` - Fail with exit code 1 if the sonar analysis failed in sonar quality gate. |
20 | | -`--WaitTime=<seconds>` - between sonar analysis results checks> |
21 | | -`--MaxRetries=<number>` - The maximum number of retries to check the sonar analysis results. |
22 | | -`--UseProxy` - Use a proxy server URL, requires PROXY_URL environment variable to be set. |
23 | | - |
24 | | -## The example is based on the following steps: |
25 | | -1. set sonar token as an environment variable |
26 | | -2. call sonar scan |
27 | | -for example: |
28 | | -`` |
29 | | -$PWD/sonar-scanner-6.2.1.4610/bin/sonar-scanner \ |
30 | | - -Dsonar.projectKey=my-sonar-project-key \ |
31 | | - -Dsonar.organization=my-sonar-org \ |
32 | | - -Dsonar.host.url=https://sonarcloud.io \ |
33 | | - -Dsonar.java.jdkHome=$JAVA_HOME \ |
34 | | - -Dsonar.verbose=true \ |
35 | | - -Dsonar.token=$SONAR_TOKEN |
36 | | -`` |
37 | | -3. call the jira-transition-checker utility (use the binary for your build platform) with these arguments: "transition name" JIRA-ID [,JIRA-ID] |
38 | | -for example: |
39 | | - ``./examples/sonar-scan/bin/sonar-scan-extractor-linux-amd64 --reportTaskFile=$PWD/.scannerwork/report-task.txt --FailOnAnalysisFailure > predicate.json |
40 | | -`` |
41 | | -4. call the evidence create cli with the predicate.json file |
42 | | -for example: |
43 | | -`` |
44 | | -jf evd create \ |
45 | | - --build-name $GITHUB_WORKFLOW \ |
46 | | - --build-number "${{ github.run_number }}" \ |
47 | | - --predicate ./predicate.json \ |
48 | | - --predicate-type https://jfrog.com/evidence/sonar-scan/v1 \ |
49 | | - --provider-id "sonar" \ |
50 | | - --key "${{ secrets.JIRA_TEST_PKEY }}" \ |
51 | | - --key-alias ${{ vars.JIRA_TEST_KEY }} |
52 | | -`` |
53 | | - |
54 | | -## Additional considerations |
55 | | -```plaintext |
56 | | -It is advised to decide if to create an evidence with sonar analysis failure scan or refrain from creating the evidence. |
57 | | -to create the evidence with an analysis gateway failure content, do **not** add the `--FailOnAnalysisFailure` argument. |
58 | | -
|
59 | | -to refrain from creating the evidence with an analysis gateway failure content, add the `--FailOnAnalysisFailure` argument. |
60 | | -then check the exit code of the script and decide if to create the evidence or not. |
61 | | -``` |
| 1 | +## Sonar evidence creation |
| 2 | + |
| 3 | +This example shows how to create and attach Sonar analysis evidence using the JFrog CLI. |
| 4 | + |
| 5 | +### Prerequisites |
| 6 | +- SONAR_TOKEN: SonarCloud/SonarQube token. |
| 7 | +- A completed Sonar scan that produced a `report-task.txt` file. |
| 8 | + |
| 9 | +### Default report-task.txt discovery |
| 10 | +When you run: |
| 11 | +```bash |
| 12 | +jf evd create --integration sonar |
| 13 | +``` |
| 14 | +the tool auto-detects the Sonar task file using these paths (in order): |
| 15 | +- target/sonar/report-task.txt (Maven) |
| 16 | +- build/sonar/report-task.txt (Gradle) |
| 17 | +- .scannerwork/report-task.txt (CLI scanner) |
| 18 | +- .sonarqube/out/.sonar/report-task.txt (MSBuild) |
| 19 | + |
| 20 | +If the file is not found, configure its location via YAML or env var (see below). |
| 21 | + |
| 22 | +### Minimal workflow step (example) |
| 23 | +```yaml |
| 24 | +- name: Create evidence |
| 25 | + env: |
| 26 | + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |
| 27 | + run: | |
| 28 | + jf evd create \ |
| 29 | + --build-name $GITHUB_WORKFLOW \ |
| 30 | + --build-number "${{ github.run_number }}" \ |
| 31 | + --key "${{ secrets.SIGNING_KEY }}" \ |
| 32 | + --key-alias ${{ vars.SIGNING_KEY_ALIAS }} \ |
| 33 | + --integration sonar |
| 34 | +``` |
| 35 | +
|
| 36 | +### Configuration |
| 37 | +You can configure the integration via YAML or environment variables. YAML keys have 1:1 env equivalents. |
| 38 | +
|
| 39 | +1) YAML: .jfrog/evidence/evidence.yml |
| 40 | +```yaml |
| 41 | +sonar: |
| 42 | + url: https://sonarcloud.io |
| 43 | + reportTaskFile: .scannerwork/report-task.txt |
| 44 | + pollingMaxRetries: 30 |
| 45 | + pollingRetryIntervalMs: 5000 |
| 46 | +``` |
| 47 | +
|
| 48 | +2) Environment variables |
| 49 | +- SONAR_URL |
| 50 | +- SONAR_REPORT_TASK_FILE |
| 51 | +- SONAR_POLLING_MAX_RETRIES |
| 52 | +- SONAR_POLLING_RETRY_INTERVAL_MS |
| 53 | +
|
| 54 | +### Parameters reference |
| 55 | +Evidence creation: |
| 56 | +
|
| 57 | +- --integration sonar |
| 58 | + - Selects the Sonar integration. |
| 59 | +
|
| 60 | +Sonar resolution (via YAML/env): |
| 61 | +
|
| 62 | +- sonar.url / SONAR_URL |
| 63 | + - Sonar base URL. By default url is parsed from report-task.txt. If not found there, defaults to https://sonarcloud.io. |
| 64 | +
|
| 65 | +- sonar.reportTaskFile / SONAR_REPORT_TASK_FILE |
| 66 | + - Path to report-task.txt. If omitted, auto-detection (see order above) is used. |
| 67 | +
|
| 68 | +- sonar.pollingMaxRetries / SONAR_POLLING_MAX_RETRIES |
| 69 | + - Maximum polling attempts to wait for analysis results. |
| 70 | +
|
| 71 | +- sonar.pollingRetryIntervalMs / SONAR_POLLING_RETRY_INTERVAL_MS |
| 72 | + - Milliseconds to wait between polling attempts. |
| 73 | +
|
| 74 | +### Behavior |
| 75 | +Evidence is created for both successful and failed Sonar analyses (including failed quality gates). |
0 commit comments