Skip to content

Commit 60a05aa

Browse files
authored
feat: add sso plugin to plugin image. (#33)
* feat: add sso plugin to plugin image. Signed-off-by: kychen <[email protected]> * fix: update Dockerfile and build.gradle dependencies for compatibility - Updated JRE image version in Dockerfile to use '17.0.16_8-jre-ubi10-minimal'. - Upgraded sonar-java-symbolic-execution-plugin, sonar-javascript-plugin, and sonar-iac plugins to their latest versions in build.gradle for improved functionality and security. * fix: update Dockerfile to use ARG for dependency versions - Replaced hardcoded dependency versions with ARG variables for netty and bouncycastle in Dockerfile. - This change improves maintainability and allows for easier updates in the future. --------- Signed-off-by: kychen <[email protected]>
1 parent f12aa41 commit 60a05aa

File tree

16 files changed

+663
-224
lines changed

16 files changed

+663
-224
lines changed

.tekton/build-image.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ spec:
2727
url: "{{ repo_url }}"
2828
branch: "{{ source_branch }}"
2929
commit: "{{ revision }}"
30+
pull-request-number: "{{ pull_request_number }}"
31+
pull-request-source: "{{ source_branch }}"
32+
pull-request-target: "{{ target_branch }}"
3033
- name: clean-cache
3134
value: "{{ clean-cache }}"
3235

.tekton/build-testing-base-image.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ spec:
2727
value: "{{ source_branch }}"
2828
- name: git-commit
2929
value: "{{ revision }}"
30+
- name: pull-request-number
31+
value: "{{ pull_request_number }}"
3032

3133
- name: image-repository
3234
value: build-harbor.alauda.cn/devops/sonarqube-ce-test-base

.tekton/integration-test.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ spec:
4646
url: "{{ repo_url }}"
4747
branch: "{{ source_branch }}"
4848
commit: "{{ revision }}"
49+
pull-request-number: "{{ pull_request_number }}"
50+
pull-request-source: "{{ source_branch }}"
51+
pull-request-target: "{{ target_branch }}"
4952
- name: build-test-image
5053
value:
5154
image-repository: build-harbor.alauda.cn/devops/sonarqube-ce-test

.tekton/pipeline/sonar-image-build.yaml

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,26 @@ spec:
1414
description: "Workspace for cache files"
1515
params:
1616
- name: git-revision
17-
description: Git revision object with url, branch, commit, and pull-request-number.
17+
description: |
18+
Git revision object with url, branch, commit, and pull request information.
19+
* url: The url of the git repository
20+
* branch: The source branch of the git repository
21+
* commit: The commit of the git repository
22+
* pull-request-number: The pull request number
23+
* pull-request-source: The source branch of the pull request
24+
* pull-request-target: The target branch of the pull request
1825
type: object
1926
properties:
20-
url: {}
21-
branch: {}
22-
commit: {}
27+
url: { type: string }
28+
branch: { type: string }
29+
commit: { type: string }
30+
pull-request-number: {} # Pull request number.
31+
pull-request-source: {} # Pull request source.
32+
pull-request-target: {} # Pull request target branch.
33+
default:
34+
pull-request-number: ""
35+
pull-request-source: ""
36+
pull-request-target: ""
2337
- name: image-scan-gate-enabled
2438
description: Determine whether to skip the image scan step
2539
type: string
@@ -40,6 +54,8 @@ spec:
4054
value: $(params.git-revision.branch)
4155
- name: depth
4256
value: 1
57+
- name: pr-number
58+
value: $(params.git-revision.pull-request-number)
4359
taskRef:
4460
resolver: hub
4561
params:
@@ -327,6 +343,12 @@ spec:
327343
workspace: source
328344
- name: basic-auth
329345
workspace: basic-auth
346+
when:
347+
- input: $(params.git-revision.pull-request-number)
348+
operator: in
349+
values:
350+
- ""
351+
- " "
330352
params:
331353
- name: BASE_IMAGE
332354
value: registry.alauda.cn:60080/devops/nonroot/chainguard/git:latest

.tekton/pr-manage.yaml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: tekton.dev/v1
2+
kind: PipelineRun
3+
metadata:
4+
name: pr-manage
5+
annotations:
6+
pipelinesascode.tekton.dev/pipeline: "https://raw.githubusercontent.com/AlaudaDevops/toolbox/main/pr-cli/pipeline/pr-manage.yaml"
7+
pipelinesascode.tekton.dev/on-comment: "^/(help|rebase|lgtm|remove-lgtm|cherry-?pick|assign|merge|ready|unassign|label|unlabel|check|retest|close|batch)($|\\s.*)"
8+
pipelinesascode.tekton.dev/max-keep-runs: "5"
9+
spec:
10+
pipelineRef:
11+
name: pr-manage
12+
params:
13+
- name: trigger_comment
14+
value: "{{ trigger_comment }}"
15+
- name: repo_owner
16+
value: "{{ repo_owner }}"
17+
- name: repo_name
18+
value: "{{ repo_name }}"
19+
- name: pull_request_number
20+
value: "{{ pull_request_number }}"
21+
- name: comment_sender
22+
value: "{{ sender }}"
23+
- name: git_auth_secret
24+
value: "{{ git_auth_secret }}"
25+
#
26+
# Optional parameters (value is the default):
27+
#
28+
# The key in git_auth_secret that contains the token (default: git-provider-token)
29+
# - name: git_auth_secret_key
30+
# value: "git-provider-token"
31+
#
32+
# Container image for pr-cli tool (default: registry.alauda.cn:60070/devops/toolbox/pr-cli:latest)
33+
# - name: image
34+
# value: "registry.alauda.cn:60070/devops/toolbox/pr-cli:latest"
35+
#
36+
# The /lgtm threshold needed of approvers for a PR to be approved (default: 1)
37+
# - name: lgtm_threshold
38+
# value: "1"
39+
#
40+
# The permissions the user need to trigger a lgtm (default: admin,write)
41+
# - name: lgtm_permissions
42+
# value: "admin,write"
43+
#
44+
# The review event when lgtm is triggered, can be APPROVE,
45+
# REQUEST_CHANGES, or COMMENT if setting to empty string it will be set as
46+
# PENDING (default: APPROVE)
47+
# - name: lgtm_review_event
48+
# value: "APPROVE"
49+
#
50+
# The merge method to use. Can be one of: merge, squash, rebase (default: squash)
51+
# - name: merge_method
52+
# value: "squash"
53+
#
54+
# The name used for self-check status (default: pr-manage)
55+
# - name: self_check_name
56+
# value: "pr-manage"
57+
#
58+
# Enable debug mode (skip validation, allow PR creator self-approval) (default: false)
59+
# - name: debug
60+
# value: "false"
61+
#
62+
# Enable verbose logging (debug level logs) (default: false)
63+
# - name: verbose
64+
# value: "false"
65+
#
66+
# The platform to use, can be one of: github, gitlab, gitee (default: github)
67+
# - name: platform
68+
# value: "github"
69+
#
70+
# The robot accounts for managing bot approval reviews.
71+
# - name: robot_accounts
72+
# value: "alaudabot,dependabot,renovate"

chart/values.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@ global:
77
sonarqube:
88
code: github.com/AlaudaDevops/docker-sonarqube
99
repository: devops/sonarqube
10-
tag: v2025.1.0-gbfb64f0
10+
tag: v2025.1.0-g59d27f1
1111
support_arm: true
1212
thirdparty: true
1313
digest: sha256:bd8aa76c68de359ef5495dafa155fe98b12009a82ad01bb10325226fd3f6b4be
1414
pluginPackage:
1515
code: github.com/AlaudaDevops/docker-sonarqube
1616
repository: devops/sonarqube-plugins
17-
tag: v2025.1.0-gbfb64f0
17+
tag: v2025.1.0-g59d27f1
1818
support_arm: true
1919
thirdparty: true
2020
digest: sha256:565500e7f0acfb7da4693eaf49b24629dc1fcd7cc6ca4571809c794959d0c0d8

image/community-build/Dockerfile

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -32,16 +32,20 @@ RUN set -eux \
3232
&& chmod -R 550 /data/sonarqube \
3333
&& chmod -R 770 /data/sonarqube/data /data/sonarqube/extensions /data/sonarqube/logs /data/sonarqube/temp
3434

35-
# COPY --chown=sonarsource:sonarsource image/community-build/apply-jar-patch.sh /tmp/apply-jar-patch.sh
36-
# # renovate: datasource=maven depName=json-smart lookupName=net.minidev:json-smart
37-
# ARG JSON_SMART_VERSION=2.5.2
38-
# # renovate: datasource=maven depName=netty-handler lookupName=io.netty:netty-handler
39-
# ARG NETTY_HANDLER_VERSION=4.1.123.Final
40-
# RUN set -eux \
41-
# && curl -o /data/patches/json-smart-${JSON_SMART_VERSION}.jar https://repo1.maven.org/maven2/net/minidev/json-smart/${JSON_SMART_VERSION}/json-smart-${JSON_SMART_VERSION}.jar \
42-
# && curl -o /data/patches/netty-handler-${NETTY_HANDLER_VERSION}.jar https://repo1.maven.org/maven2/io/netty/netty-handler/${NETTY_HANDLER_VERSION}/netty-handler-${NETTY_HANDLER_VERSION}.jar \
43-
# && chmod +x /tmp/apply-jar-patch.sh \
44-
# && /tmp/apply-jar-patch.sh /data/patches /data/sonarqube
35+
COPY --chown=sonarsource:sonarsource image/community-build/replace-jar.sh /tmp/replace-jar.sh
36+
37+
# renovate: datasource=maven depName=netty-codec lookupName=io.netty:netty-codec
38+
ARG NETTY_VERSION=4.1.118.Final
39+
# renovate: datasource=maven depName=bc-fips lookupName=org.bouncycastle:bc-fips
40+
ARG BC_VERSION=1.0.2.5
41+
# renovate: datasource=maven depName=bcpkix-jdk18on lookupName=org.bouncycastle:bcpkix-jdk18on
42+
ARG BCPKIX_VERSION=1.78.1
43+
RUN chmod +x /tmp/replace-jar.sh && \
44+
/tmp/replace-jar.sh io.netty netty-codec 4.1.118.Final ${NETTY_VERSION} /data/sonarqube/elasticsearch && \
45+
/tmp/replace-jar.sh io.netty netty-codec-http 4.1.118.Final ${NETTY_VERSION} /data/sonarqube/elasticsearch && \
46+
/tmp/replace-jar.sh io.netty netty-codec-http2 4.1.118.Final ${NETTY_VERSION} /data/sonarqube/elasticsearch && \
47+
/tmp/replace-jar.sh org.bouncycastle bc-fips 1.0.2.5 ${BC_VERSION} /data/sonarqube/elasticsearch && \
48+
/tmp/replace-jar.sh org.bouncycastle bcpkix-jdk18on 1.78.1 ${BCPKIX_VERSION} /data/sonarqube/elasticsearch
4549

4650
FROM docker-mirrors.alauda.cn/library/eclipse-temurin:${JRE_IMAGE_VERSION}
4751

@@ -82,6 +86,7 @@ RUN set -eux; \
8286
curl \
8387
fonts-dejavu \
8488
perl-base=5.34.0-3ubuntu1.5; \
89+
apt-get --no-install-recommends -y upgrade libc-bin libc6 locales; \
8590
echo "networkaddress.cache.ttl=5" >> "${JAVA_HOME}/conf/security/java.security"; \
8691
sed --in-place --expression="s?securerandom.source=file:/dev/random?securerandom.source=file:/dev/urandom?g" "${JAVA_HOME}/conf/security/java.security"; \
8792
ln -s ${SONARQUBE_HOME}/lib/sonar-application-${SONARQUBE_VERSION}.jar ${SONARQUBE_HOME}/lib/sonarqube.jar; \

0 commit comments

Comments
 (0)