[AAP-52663] Refactor SonarCloud workflow to use workflow_run pattern (ansible#857)

john-westcott-iv · claude · web-flow · commit b30ddb85eedf · 2025-10-06T16:26:17.000-04:00
## Summary Refactor the SonarCloud analysis workflow to use the `workflow_run` trigger pattern instead of executing directly in the CI workflow. This provides better separation of concerns and ensures coverage data is always available before analysis runs. ## Changes ### 1. Split SonarCloud workflow into two jobs - **sonar-pr-analysis**: Runs for pull requests with PR-specific quality gate analysis - **sonar-branch-analysis**: Runs for branch pushes (devel/stable-*) with full codebase analysis ### 2. Security improvements - Pin third-party actions (`dawidd6/action-download-artifact`, `SonarSource/sonarcloud-github-action`) to commit SHAs - Add `permissions: read-all` for principle of least privilege - Use environment variables for sensitive data ### 3. Robustness improvements - Better error handling with clear error messages when PR metadata is missing - Use `gh api` with `jq` for PR metadata extraction (more reliable than octokit action) - Comprehensive logging showing analysis decisions - Coverage availability detection and status reporting ### 4. Removed direct SonarCloud execution from CI - Lines 69-74 removed from `.github/workflows/ci.yml` - SonarCloud now runs via `workflow_run` trigger after CI completes - Ensures coverage artifact is always available ## Testing - Workflow will trigger on next PR to verify PR analysis job - Branch push to devel will verify branch analysis job ## JIRA https://issues.redhat.com/browse/AAP-52663 Co-authored-by: Claude <noreply@anthropic.com>
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -66,13 +66,6 @@ jobs:
           name: coverage
           path: coverage.xml
 
-      - name: SonarCloud Scan (on push)
-        uses: SonarSource/sonarqube-scan-action@master
-        if: matrix.tests.sonar && github.event_name == 'push' && github.repository == 'ansible/django-ansible-base'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
-
       - name: Upload jUnit XML test results
         if: matrix.tests.junit-xml-upload && github.event_name == 'push' && github.repository == 'ansible/django-ansible-base' && github.ref_name == 'devel'
         continue-on-error: true
diff --git a/.github/workflows/sonar-pr.yml b/.github/workflows/sonar-pr.yml
@@ -1,207 +1,172 @@
-# SonarCloud PR Workflow for django-ansible-base
+# SonarCloud Analysis Workflow for django-ansible-base
 #
-# This workflow runs on every pull request and push to the repository.
+# This workflow runs SonarCloud analysis triggered by CI workflow completion.
+# It is split into two separate jobs for clarity and maintainability:
 #
-# Steps overview:
-# 1. Download coverage data from CI workflow
-# 2. Check for backport labels (skip if found)
-# 3. Check for Python file changes (skip if none)
-# 4. Extract PR info and set environment
-# 5. Run SonarCloud analysis with quality gate
+# FLOW: CI completes → workflow_run triggers this workflow → appropriate job runs
 #
-# What files are scanned:
-# - All Python files (.py) in the repository
-# - Excludes: tests, scripts, dev environments, external collections
-# - Quality gate focuses on new/changed code in PR only
+# JOB 1: sonar-pr-analysis (for PRs)
+# - Triggered by: workflow_run (CI on pull_request)
+# - Steps: Download coverage → Get PR info → Run SonarCloud PR analysis
+# - Scans: All files in the PR
+# - Quality gate: Focuses on new/changed code in PR only
+#
+# JOB 2: sonar-branch-analysis (for long-lived branches)
+# - Triggered by: workflow_run (CI on push to devel/stable-*)
+# - Steps: Download coverage → Run SonarCloud branch analysis
+# - Scans: Full codebase
+# - Quality gate: Focuses on overall project health
+#
+# This ensures coverage data is always available from CI before analysis runs.
 
 
 # With much help from:
 # https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/30
 # https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/32
 name: SonarCloud
 on:
-  workflow_run:
+  workflow_run:   # This is triggered by CI being completed.
     workflows:
       - CI
     types:
       - completed
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: 'PR number (for push events, use 0)'
-        required: true
-        type: string
-      event_type:
-        description: 'Event type (push or pull_request)'
-        required: true
-        type: string
-      commit_sha:
-        description: 'Commit SHA'
-        required: true
-        type: string
-      repository:
-        description: 'Repository name'
-        required: true
-        type: string
-      ci_run_id:
-        description: 'CI workflow run ID (for downloading coverage artifact)'
-        required: false
-        type: string
 permissions: read-all
 jobs:
-  sonar:
-    name: Upload to SonarCloud
+  sonar-pr-analysis:
+    name: SonarCloud PR Analysis
     runs-on: ubuntu-latest
     if: |
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') ||
-      (github.event_name == 'workflow_dispatch')
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      startsWith(github.repository, 'ansible') && endsWith(github.repository, 'django-ansible-base')
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          show-progress: false
 
-      # Download coverage artifact (for both workflow_run and workflow_dispatch)
+      # Download coverage artifact from CI workflow
       - name: Download coverage artifact
-        if: |
-          github.event_name == 'workflow_run' ||
-          (github.event_name == 'workflow_dispatch' && inputs.ci_run_id != '')
         uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           workflow: CI
-          run_id: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.id || inputs.ci_run_id }}
+          run_id: ${{ github.event.workflow_run.id }}
           name: coverage
 
-      # Set PR number based on trigger type
-      - name: Set PR number and event type
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_run" ]; then
-            # Extract from coverage.xml for workflow_run
-            echo "PR_NUMBER=$(grep -m 1 '<!-- PR' coverage.xml | awk '{print $3}')" >> $GITHUB_ENV
-            echo "EVENT_TYPE=pull_request" >> $GITHUB_ENV
-            echo "COMMIT_SHA=${{ github.event.workflow_run.head_sha }}" >> $GITHUB_ENV
-            echo "REPO_NAME=${{ github.event.repository.full_name }}" >> $GITHUB_ENV
-          else
-            # Use inputs for workflow_dispatch
-            echo "PR_NUMBER=${{ inputs.pr_number }}" >> $GITHUB_ENV
-            echo "EVENT_TYPE=${{ inputs.event_type }}" >> $GITHUB_ENV
-            echo "COMMIT_SHA=${{ inputs.commit_sha }}" >> $GITHUB_ENV
-            echo "REPO_NAME=${{ inputs.repository }}" >> $GITHUB_ENV
-          fi
-
-      - name: Get PR info
-        if: env.EVENT_TYPE == 'pull_request' && env.PR_NUMBER != '0'
-        uses: octokit/request-action@v2.x
-        id: pr_info
-        with:
-          route: GET /repos/{repo}/pulls/{number}
-          repo: ${{ env.REPO_NAME }}
-          number: ${{ env.PR_NUMBER }}
+      # Extract PR metadata from workflow_run event
+      - name: Set PR metadata and prepare for analysis
         env:
+          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
+          REPO_NAME: ${{ github.event.repository.full_name }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Print SonarCloud Analysis Decision Summary
-        id: print_summary
         run: |
           echo "🔍 SonarCloud Analysis Decision Summary"
           echo "========================================"
-          
-          # Check CI Event type
-          if [ "${{ env.EVENT_TYPE }}" = "pull_request" ]; then
-            echo "├── CI Event: ✅ Pull Request"
-            
-            # Check backport labels (only for PRs)
-            if [ "${{ env.PR_NUMBER }}" != "0" ]; then
-              echo "├── Backport Label: ➖ N/A (Skip check for workflow_dispatch)"
-              
-              # Check Python changes for PRs
-              files=$(gh api repos/${{ env.REPO_NAME }}/pulls/${{ env.PR_NUMBER }}/files --jq '.[].filename')
-              
-              # Get file extensions for summary
-              extensions=$(echo "$files" | sed 's/.*\.//' | sort | uniq | tr '\n' ',' | sed 's/,$//')
-              
-              # Check if any Python files were changed
-              python_files=$(echo "$files" | grep '\.py$' || true)
-              if [ -z "$python_files" ]; then
-                echo "├── Python Changes: ❌ None (.$extensions only)"
-                echo "└── Result: ⏭️ Skip - \"No Python code changes detected\""
-                exit 0
-              else
-                python_count=$(echo "$python_files" | wc -l)
-                echo "├── Python Changes: ✅ Found ($python_count files)"
-                echo "└── Result: ✅ Proceed - \"Running SonarCloud analysis\""
-              fi
-            else
-              echo "├── Backport Label: ➖ N/A (Not a PR)"
-              echo "└── Result: ✅ Proceed - \"Running SonarCloud analysis\""
-            fi
+          echo "├── CI Event: ✅ Pull Request"
+          echo "├── Repo: $REPO_NAME"
+
+          # Extract PR number from coverage.xml
+          if [ -f coverage.xml ]; then
+            PR_NUMBER=$(grep -m 1 '<!-- PR' coverage.xml | awk '{print $3}' || echo "")
           else
-            # For push events, always proceed
-            echo "├── CI Event: ✅ Push"
-            echo "├── Backport Label: ➖ N/A (Push event)"
-            echo "├── Python Changes: ➖ N/A (Full codebase scan)"
-            echo "└── Result: ✅ Proceed - \"Running SonarCloud analysis\""
+            PR_NUMBER=""
           fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Check if analysis should proceed
-        id: check_proceed
-        run: |
-          # This step only runs if we got past the summary step
-          # which means all conditions are met for analysis
-          echo "proceed=true" >> $GITHUB_OUTPUT
-          echo "✅ All conditions met - proceeding with SonarCloud analysis"
-
-      - name: Set PR info into env
-        if: steps.check_proceed.outputs.proceed == 'true' && env.EVENT_TYPE == 'pull_request' && env.PR_NUMBER != '0' && steps.pr_info.outputs.data != ''
-        run: |
-          echo "PR_BASE=${{ fromJson(steps.pr_info.outputs.data).base.ref }}" >> $GITHUB_ENV
-          echo "PR_HEAD=${{ fromJson(steps.pr_info.outputs.data).head.ref }}" >> $GITHUB_ENV
+          echo "├── PR Number from coverage.xml: #${PR_NUMBER:-<not found>}"
 
-      - name: Get changed Python files for Sonar
-        if: steps.check_proceed.outputs.proceed == 'true' && env.EVENT_TYPE == 'pull_request' && env.PR_NUMBER != '0'
-        run: |
-          files=$(gh api repos/${{ env.REPO_NAME }}/pulls/${{ env.PR_NUMBER }}/files --jq '.[].filename')
-          echo "All changed files in PR:"
-          echo "$files"
-          python_files=$(echo "$files" | grep '\.py$' || true)
-          if [ -n "$python_files" ]; then
-            echo "Changed Python files:"
-            echo "$python_files"
-            # Convert to comma-separated list for sonar.inclusions
-            inclusions=$(echo "$python_files" | tr '\n' ',' | sed 's/,$//')
-            echo "SONAR_INCLUSIONS=$inclusions" >> $GITHUB_ENV
-            echo "Will scan these Python files: $inclusions"
+          if [ -z "$PR_NUMBER" ]; then
+            echo "##[error]❌ FATAL: PR number not found in coverage.xml"
+            echo "##[error]This job requires a PR number to run PR analysis."
+            echo "##[error]The CI workflow should have injected the PR number into coverage.xml."
+            exit 1
           fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Add base branch (for PRs)
-        if: steps.check_proceed.outputs.proceed == 'true' && env.EVENT_TYPE == 'pull_request' && env.PR_NUMBER != '0'
+          # Get PR metadata from GitHub API
+          PR_DATA=$(gh api "repos/$REPO_NAME/pulls/$PR_NUMBER")
+          PR_BASE=$(echo "$PR_DATA" | jq -r '.base.ref')
+          PR_HEAD=$(echo "$PR_DATA" | jq -r '.head.ref')
+
+          # Print summary
+          echo "├── Base Branch: $PR_BASE"
+          echo "├── Head Branch: $PR_HEAD"
+          echo "├── Coverage Data: ✅ Available"
+          echo "└── Result: ✅ Running SonarCloud PR analysis"
+
+          # Export to GitHub env for later steps
+          echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
+          echo "PR_BASE=$PR_BASE" >> $GITHUB_ENV
+          echo "PR_HEAD=$PR_HEAD" >> $GITHUB_ENV
+          echo "COMMIT_SHA=$COMMIT_SHA" >> $GITHUB_ENV
+          echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV
+
+      - name: Add base branch
+        if: env.PR_NUMBER != ''
         run: |
           gh pr checkout ${{ env.PR_NUMBER }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: SonarCloud Scan (Pull Request)
-        if: steps.check_proceed.outputs.proceed == 'true' && env.EVENT_TYPE == 'pull_request' && env.PR_NUMBER != '0'
-        uses: SonarSource/sonarqube-scan-action@v5
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarcloud-github-action@e44258b109568baa0df60ed515909fc6c72cba92
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets[format('{0}', vars.SONAR_TOKEN_SECRET_NAME)] }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
           args: >
             -Dsonar.scm.revision=${{ env.COMMIT_SHA }}
             -Dsonar.pullrequest.key=${{ env.PR_NUMBER }}
             -Dsonar.pullrequest.branch=${{ env.PR_HEAD }}
             -Dsonar.pullrequest.base=${{ env.PR_BASE }}
-            ${{ env.SONAR_INCLUSIONS && format('-Dsonar.inclusions={0}', env.SONAR_INCLUSIONS) || '' }}
 
-      - name: SonarCloud Scan (Push)
-        if: steps.check_proceed.outputs.proceed == 'true' && env.EVENT_TYPE == 'push'
-        uses: SonarSource/sonarqube-scan-action@v5
+  sonar-branch-analysis:
+    name: SonarCloud Branch Analysis
+    runs-on: ubuntu-latest
+    if: |
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      startsWith(github.repository, 'ansible') && endsWith(github.repository, 'django-ansible-base')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          show-progress: false
+
+      # Download coverage artifact from CI workflow (optional for branch pushes)
+      - name: Download coverage artifact
+        continue-on-error: true
+        uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          workflow: CI
+          run_id: ${{ github.event.workflow_run.id }}
+          name: coverage
+
+      - name: Print SonarCloud Analysis Summary
+        env:
+          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
+          REPO_NAME: ${{ github.event.repository.full_name }}
+        run: |
+          echo "🔍 SonarCloud Analysis Summary"
+          echo "=============================="
+          echo "├── CI Event: ✅ Push (via workflow_run)"
+          echo "├── Repo: $REPO_NAME"
+          echo "├── Branch: $BRANCH_NAME"
+          
+          if [ -f coverage.xml ]; then
+            echo "├── Coverage Data: ✅ Available"
+          else
+            echo "├── Coverage Data: ⚠️  Not available (analysis will proceed without coverage)"
+          fi
+          
+          echo "└── Result: ✅ Running SonarCloud branch analysis"
+
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarcloud-github-action@e44258b109568baa0df60ed515909fc6c72cba92
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets[format('{0}', vars.SONAR_TOKEN_SECRET_NAME)] }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
           args: >
-            -Dsonar.scm.revision=${{ env.COMMIT_SHA }}
+            -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
+            -Dsonar.branch.name=${{ github.event.workflow_run.head_branch }}
