Skip to content

Commit 0e7ebec

Browse files
yasen-pavlov-sonarsourceyasen-pavlov-sonarsource
authored
GHA-114 Add cloud security workflow (#47)
1 parent 1a912fb commit 0e7ebec

File tree

10 files changed

+559
-38
lines changed

10 files changed

+559
-38
lines changed

‎.github/workflows/cloud-security-automated-release.yml‎

Lines changed: 376 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/test-create-integration-ticket.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,53 @@ jobs:
3838
run: |
3939
cd create-integration-ticket
4040
python -m pytest test_create_integration_ticket.py -v --cov=create_integration_ticket --cov-report=term-missing
41+
42+
integration-tests:
43+
name: Integration Tests
44+
runs-on: ubuntu-latest
45+
46+
steps:
47+
- name: Checkout code
48+
uses: actions/checkout@v4
49+
50+
- name: Test with basic inputs
51+
id: test-basic
52+
uses: ./create-integration-ticket
53+
with:
54+
target-jira-project: 'TESTPROJ'
55+
release-ticket-key: 'TEST-123'
56+
ticket-summary: 'Test integration ticket'
57+
use-jira-sandbox: 'true'
58+
continue-on-error: true
59+
60+
- name: Test with description and Jira release URL
61+
id: test-with-url
62+
uses: ./create-integration-ticket
63+
with:
64+
target-jira-project: 'TESTPROJ'
65+
release-ticket-key: 'TEST-123'
66+
plugin-name: 'TestPlugin'
67+
release-version: '1.0.0'
68+
ticket-description: 'This is a test ticket with description'
69+
jira-release-url: 'https://test.atlassian.net/projects/TEST/versions/123/tab/release-report-all-issues'
70+
use-jira-sandbox: 'true'
71+
continue-on-error: true
72+
73+
- name: Test with only Jira release URL (no description)
74+
id: test-url-only
75+
uses: ./create-integration-ticket
76+
with:
77+
target-jira-project: 'TESTPROJ'
78+
release-ticket-key: 'TEST-123'
79+
ticket-summary: 'Test ticket with URL only'
80+
jira-release-url: 'https://test.atlassian.net/projects/TEST/versions/123/tab/release-report-all-issues'
81+
use-jira-sandbox: 'true'
82+
continue-on-error: true
83+
84+
- name: Verify integration tests
85+
run: |
86+
echo "Integration tests completed:"
87+
echo "- Basic test: Expected to fail due to missing credentials (normal in CI)"
88+
echo "- Test with description + URL: Should format description with URL appended"
89+
echo "- Test with URL only: Should format description as just the URL"
90+
echo "All tests use continue-on-error since Jira credentials are not available in CI"

‎.github/workflows/test-create-jira-version.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,55 @@ jobs:
3838
run: |
3939
cd create-jira-version
4040
python -m pytest test_create_jira_version.py -v --cov=create_jira_version --cov-report=term-missing
41+
42+
integration-tests:
43+
name: Integration Tests
44+
runs-on: ubuntu-latest
45+
46+
steps:
47+
- name: Checkout code
48+
uses: actions/checkout@v4
49+
50+
- name: Test with explicit new version name
51+
id: test-explicit
52+
uses: ./create-jira-version
53+
with:
54+
jira-project-key: 'TESTPROJ'
55+
jira-new-version-name: '1.2.3'
56+
use-jira-sandbox: 'true'
57+
continue-on-error: true
58+
59+
- name: Verify explicit version test outputs
60+
run: |
61+
echo "Test with explicit new version name:"
62+
echo "Expected to fail due to missing credentials (which is expected in CI)"
63+
echo "Action should have determined new-version-name as: 1.2.3"
64+
65+
- name: Test with current version (auto-increment)
66+
id: test-auto
67+
uses: ./create-jira-version
68+
with:
69+
jira-project-key: 'TESTPROJ'
70+
jira-version-name: '1.2.2'
71+
use-jira-sandbox: 'true'
72+
continue-on-error: true
73+
74+
- name: Verify auto-increment test outputs
75+
run: |
76+
echo "Test with current version (should auto-increment):"
77+
echo "Expected to fail due to missing credentials (which is expected in CI)"
78+
echo "Action should have determined new-version-name as: 1.2.3"
79+
80+
- name: Test with environment variables
81+
uses: ./create-jira-version
82+
env:
83+
JIRA_PROJECT_KEY: 'TESTPROJ'
84+
JIRA_VERSION_NAME: '2.0.1'
85+
USE_JIRA_SANDBOX: 'true'
86+
continue-on-error: true
87+
88+
- name: Verify environment variables test
89+
run: |
90+
echo "Test with environment variables:"
91+
echo "Expected to fail due to missing credentials (which is expected in CI)"
92+
echo "Action should have determined new-version-name as: 2.0.2"

‎create-integration-ticket/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ This action requires:
3030
| `release-version` | The release version (used to generate ticket summary if ticket-summary is not provided). If not set version will be retreived from build. | No | - |
3131
| `use-jira-sandbox` | Use the sandbox Jira server instead of production. Can also be controlled via `USE_JIRA_SANDBOX` environment variable | No | - |
3232
| `link-type` | The type of link to create (e.g., "relates to", "depends on") | No | `relates to` |
33+
| `jira-release-url` | Jira release URL to append to ticket description | No | - |
3334

3435
**Note:** Either `ticket-summary` must be provided, or both `plugin-name` and `release-version` must be provided. If `ticket-summary` is not provided, it will be automatically generated as "Update {plugin-name} to {release-version}".
3536

@@ -79,6 +80,20 @@ This action requires:
7980
target-jira-project: "SQS"
8081
```
8182
83+
### Example 4: Using with Jira release URL
84+
```yaml
85+
- name: Create Integration Ticket
86+
id: create-ticket
87+
uses: ./create-integration-ticket
88+
with:
89+
plugin-name: "SonarPython"
90+
release-version: "5.8.0.24785"
91+
ticket-description: "This release includes bug fixes and performance improvements."
92+
jira-release-url: "https://sonarsource.atlassian.net/projects/SONARPY/versions/22345/tab/release-report-all-issues"
93+
release-ticket-key: "REL-456"
94+
target-jira-project: "SQS"
95+
```
96+
8297
### Using outputs
8398
```yaml
8499
- name: Use ticket outputs

‎create-integration-ticket/action.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ inputs:
2222
link-type:
2323
description: 'The type of link to create (e.g., "relates to", "depends on")'
2424
default: 'relates to'
25+
jira-release-url:
26+
description: 'Jira release URL to append to ticket description'
27+
required: false
2528

2629
outputs:
2730
ticket-key:
@@ -53,7 +56,7 @@ runs:
5356
python -m pip install --upgrade pip
5457
pip install -r ${{ github.action_path }}/requirements.txt
5558
56-
- uses: ./get-release-version
59+
- uses: SonarSource/release-github-actions/get-release-version@f450c1d5ec393371788f0ad9c889a82358da2b5e
5760
if: ${{ !inputs.ticket-summary && !inputs.release-version && !env.RELEASE_VERSION }}
5861

5962
- name: Validate inputs and generate ticket summary
@@ -80,7 +83,10 @@ runs:
8083
JIRA_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).JIRA_TOKEN }}
8184
JIRA_PROD_URL: "https://sonarsource.atlassian.net/"
8285
JIRA_SANDBOX_URL: "https://sonarsource-sandbox-608.atlassian.net/"
83-
TICKET_DESCRIPTION: ${{ inputs.ticket-description }}
86+
TICKET_DESCRIPTION: |
87+
${{ inputs.ticket-description }}${{ inputs.jira-release-url && inputs.ticket-description && '
88+
89+
' || '' }}${{ inputs.jira-release-url || '' }}
8490
run: |
8591
python ${{ github.action_path }}/create_integration_ticket.py \
8692
--ticket-summary "${{ steps.validate_inputs.outputs.ticket_summary }}" \

‎create-integration-ticket/create_integration_ticket.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
import argparse
1010
import os
1111
import sys
12+
import time
1213
from jira import JIRA
1314
from jira.exceptions import JIRAError
1415

@@ -120,6 +121,8 @@ def create_integration_ticket(jira_client, args):
120121

121122
# Update description if provided (as a separate operation)
122123
if args.ticket_description:
124+
eprint("Waiting 3 seconds before setting description...")
125+
time.sleep(3)
123126
eprint("Setting description on ticket...")
124127
try:
125128
new_ticket.update(fields={'description': args.ticket_description})

‎create-jira-version/README.md‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,37 +19,38 @@ This action depends on:
1919

2020
## Inputs
2121

22-
| Input | Description | Required | Default |
23-
|---------------------|---------------------------------------------------------------------------------------------------------------------------|----------|-----------------|
24-
| `jira-project-key` | The key of the Jira project (e.g., SONARIAC). Can also be set via `JIRA_PROJECT_KEY` environment variable | No* | - |
25-
| `jira-version-name` | The name of the Jira version to create (e.g., 1.2.3). Can also be set via `JIRA_VERSION_NAME` environment variable | No | Auto-determined |
26-
| `use-jira-sandbox` | Use the sandbox server instead of the production Jira. Can also be controlled via `USE_JIRA_SANDBOX` environment variable | No | - |
22+
| Input | Description | Required | Default |
23+
|-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|-----------------|
24+
| `jira-project-key` | The key of the Jira project (e.g., SONARIAC). Can also be set via `JIRA_PROJECT_KEY` environment variable | No* | - |
25+
| `jira-version-name` | The name of the current Jira version. Used to determine the next version if `jira-new-version-name` is not provided. Can also be set via `JIRA_VERSION_NAME` environment variable | No | Auto-determined |
26+
| `jira-new-version-name` | The name of the new Jira version to create (e.g., 1.2.3). If not provided, the next version will be automatically determined by incrementing the current version | No | Auto-determined |
27+
| `use-jira-sandbox` | Use the sandbox server instead of the production Jira. Can also be controlled via `USE_JIRA_SANDBOX` environment variable | No | - |
2728

2829
*Either the input or corresponding environment variable must be provided for jira-project-key.
2930

3031
## Outputs
3132

32-
| Output | Description |
33-
|---------------------|--------------------------------------|
34-
| `jira-version-id` | The ID of the created Jira version |
35-
| `jira-version-name` | The name of the created Jira version |
33+
| Output | Description |
34+
|-------------------------|--------------------------------------|
35+
| `jira-new-version-id` | The ID of the created Jira version |
36+
| `jira-new-version-name` | The name of the created Jira version |
3637

3738
## Usage
3839

39-
### Basic usage with explicit version name
40+
### Basic usage with explicit new version name
4041

4142
```yaml
4243
- name: Create Jira Version
4344
id: create-version
4445
uses: SonarSource/release-github-actions/create-jira-version@master
4546
with:
4647
jira-project-key: 'SONARIAC'
47-
jira-version-name: '1.2.3'
48+
jira-new-version-name: '1.2.3'
4849

4950
- name: Use created version
5051
run: |
51-
echo "Created version ID: ${{ steps.create-version.outputs.jira-version-id }}"
52-
echo "Created version name: ${{ steps.create-version.outputs.jira-version-name }}"
52+
echo "Created version ID: ${{ steps.create-version.outputs.jira-new-version-id }}"
53+
echo "Created version name: ${{ steps.create-version.outputs.jira-new-version-name }}"
5354
```
5455
5556
### Auto-determine next version number
@@ -60,22 +61,21 @@ This action depends on:
6061
uses: SonarSource/release-github-actions/create-jira-version@master
6162
with:
6263
jira-project-key: 'SONARIAC'
63-
# jira-version-name is omitted - will auto-increment from latest version
64+
# jira-new-version-name is omitted - will auto-increment from current version
6465

6566
- name: Use created version
6667
run: |
67-
echo "Created version: ${{ steps.create-version.outputs.jira-version-name }}"
68+
echo "Created version: ${{ steps.create-version.outputs.jira-new-version-name }}"
6869
```
6970
70-
### Using environment variables
71+
### Using environment variables and current version
7172
7273
```yaml
7374
- name: Create Jira Version
7475
uses: SonarSource/release-github-actions/create-jira-version@master
7576
env:
7677
JIRA_PROJECT_KEY: 'SONARIAC'
77-
with:
78-
jira-version: '1.2.3'
78+
JIRA_VERSION_NAME: '1.2.2' # Current version, will create 1.2.3
7979
```
8080
8181
### Using sandbox environment
@@ -85,7 +85,7 @@ This action depends on:
8585
uses: SonarSource/release-github-actions/create-jira-version@master
8686
with:
8787
jira-project-key: 'TESTPROJECT'
88-
jira-version-name: '1.0.0-beta'
88+
jira-new-version-name: '1.0.0-beta'
8989
use-jira-sandbox: 'true'
9090
```
9191
@@ -111,7 +111,7 @@ The action uses a Python script that:
111111

112112
- This action requires access to SonarSource's HashiCorp Vault for Jira credentials
113113
- Either `jira-project-key` input or `JIRA_PROJECT_KEY` environment variable must be provided
114-
- When `jira-version-name` is not provided, the action automatically determines the next version by incrementing the latest existing version
114+
- When `jira-new-version-name` is not provided, the action automatically determines the next version by incrementing the current version (from `jira-version-name` input/env or latest existing version)
115115
- Input parameters take precedence over environment variables when both are provided
116116
- The action supports both production and sandbox Jira environments
117117
- Version names should follow semantic versioning patterns for best results

‎create-jira-version/action.yml‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,20 @@ inputs:
77
description: 'The key of the Jira project (e.g., SONARIAC). Required if JIRA_PROJECT_KEY env var is not set.'
88
required: false
99
jira-version-name:
10-
description: 'The name of the Jira version to create (e.g., 1.2.3). Can also be set via JIRA_VERSION_NAME environment variable.'
10+
description: 'The name of the current Jira version. Can also be set via JIRA_VERSION_NAME environment variable. Used to determine the next version if jira-new-version-name is not provided.'
11+
required: false
12+
jira-new-version-name:
13+
description: 'The name of the new Jira version to create (e.g., 1.2.3). If not provided, the next version will be automatically determined by incrementing the current version.'
1114
required: false
1215
use-jira-sandbox:
1316
description: "Use the sandbox server instead of the production Jira. Can also be controlled via USE_JIRA_SANDBOX environment variable."
1417
required: false
1518

1619
outputs:
17-
jira-version-id:
20+
jira-new-version-id:
1821
description: 'The ID of the created Jira version.'
1922
value: ${{ steps.run_python_script.outputs.new_version_id }}
20-
jira-version-name:
23+
jira-new-version-name:
2124
description: 'The name of the created Jira version.'
2225
value: ${{ steps.run_python_script.outputs.new_version_name }}
2326

@@ -43,14 +46,30 @@ runs:
4346

4447
- uses: SonarSource/release-github-actions/get-jira-version@f450c1d5ec393371788f0ad9c889a82358da2b5e
4548
id: get-jira-version
46-
if: ${{ !inputs.jira-version-name && !env.JIRA_VERSION_NAME }}
49+
if: ${{ !inputs.jira-version-name && !env.JIRA_VERSION_NAME && !inputs.jira-new-version-name }}
50+
51+
- name: Determine Current Version
52+
id: determine-current-version
53+
if: ${{ !inputs.jira-new-version-name }}
54+
shell: bash
55+
run: |
56+
if [[ -n "${{ inputs.jira-version-name || env.JIRA_VERSION_NAME }}" ]]; then
57+
CURRENT_VERSION="${{ inputs.jira-version-name || env.JIRA_VERSION_NAME }}"
58+
else
59+
CURRENT_VERSION="${{ steps.get-jira-version.outputs.jira-version-name }}"
60+
fi
61+
echo "current-version-name=$CURRENT_VERSION" >> $GITHUB_OUTPUT
4762
4863
- name: Determine New Jira Version
49-
id: determine-version-name
50-
if: ${{ !inputs.jira-version-name && !env.JIRA_VERSION_NAME }}
64+
id: determine-new-version-name
5165
shell: bash
5266
run: |
53-
echo "VERSION_NAME=$(echo "${{ steps.get-jira-version.outputs.jira-version-name }}" | awk -F. '{$NF+=1; OFS="."; print $0}')" >> $GITHUB_OUTPUT
67+
if [[ -n "${{ inputs.jira-new-version-name }}" ]]; then
68+
NEW_VERSION="${{ inputs.jira-new-version-name }}"
69+
else
70+
NEW_VERSION=$(echo "${{ steps.determine-current-version.outputs.current-version-name }}" | awk -F. '{$NF+=1; print}' OFS='.')
71+
fi
72+
echo "new-version-name=$NEW_VERSION" >> $GITHUB_OUTPUT
5473
5574
- name: Create Jira Version
5675
id: run_python_script
@@ -70,6 +89,6 @@ runs:
7089
7190
python ${{ github.action_path }}/create_jira_version.py \
7291
--project-key="$PROJECT_KEY" \
73-
--version-name="${{ inputs.jira-version-name || env.JIRA_VERSION_NAME }}" \
74-
--jira-url="${{ ((inputs.use-jira-sandbox || env.USE_JIRA_SANDBOX) == 'true') && env.JIRA_SANDBOX_URL || env.JIRA_PROD_URL }}"
92+
--version-name="${{ steps.determine-new-version-name.outputs.new-version-name }}" \
93+
--jira-url="${{ ((inputs.use-jira-sandbox || env.USE_JIRA_SANDBOX) == 'true') && env.JIRA_SANDBOX_URL || env.JIRA_PROD_URL }}" \
7594
>> $GITHUB_OUTPUT

‎get-jira-release-notes/README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ This action depends on:
3939

4040
## Environment Variables Set
4141

42-
| Environment Variable | Description |
43-
|------------------------|------------------------------------------------------------------------------------------|
44-
| `RELEASE_NOTES` | The formatted release notes as Markdown (same content as `release-notes` output) |
45-
| `JIRA_RELEASE_NOTES` | The formatted release notes in Jira wiki markup (same content as `jira-release-notes` output) |
46-
| `JIRA_RELEASE_URL` | The URL to the Jira release notes page (same content as `jira-release-url` output) |
42+
| Environment Variable | Description |
43+
|----------------------|-----------------------------------------------------------------------------------------------|
44+
| `RELEASE_NOTES` | The formatted release notes as Markdown (same content as `release-notes` output) |
45+
| `JIRA_RELEASE_NOTES` | The formatted release notes in Jira wiki markup (same content as `jira-release-notes` output) |
46+
| `JIRA_RELEASE_URL` | The URL to the Jira release notes page (same content as `jira-release-url` output) |
4747

4848
## Usage
4949

‎publish-github-release/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,8 @@ runs:
8484
if [[ "$EXISTING_DRAFT" == "true" ]]; then
8585
# If draft=false and existing release is a draft, publish it
8686
echo "Found existing draft release with title '$EXPECTED_TITLE'. Publishing it instead of creating a new one."
87-
gh release edit "$EXISTING_TAG" --draft=false
88-
echo "release-url=${EXISTING_URL}" >> $GITHUB_OUTPUT
87+
UPDATED_URL=$(gh release edit "$EXISTING_TAG" --draft=false)
88+
echo "release-url=${UPDATED_URL}" >> $GITHUB_OUTPUT
8989
echo "release-id=${EXISTING_ID}" >> $GITHUB_OUTPUT
9090
exit 0
9191
else

0 commit comments

Comments
 (0)