Skip to content

Commit 73fd354

Browse files
joke1196Seppli11
joke1196
authored and
Seppli11
committed
First draft
1 parent ccdcf3c commit 73fd354

File tree

3 files changed

+163
-0
lines changed

3 files changed

+163
-0
lines changed

‎.github/scripts/run_iris.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
: "${ARTIFACTORY_PRIVATE_USERNAME?}" "${ARTIFACTORY_PRIVATE_ACCESS_TOKEN?}" "${ARTIFACTORY_URL?}"
5+
: "${SONAR_SOURCE_IRIS_TOKEN?}" "${SONAR_TARGET_IRIS_TOKEN?}" "${SONAR_TARGET_URL?}"
6+
7+
function run_iris () {
8+
java \
9+
-Diris.source.projectKey="SonarSource_sonar-scanner-python" \
10+
-Diris.source.url="https://next.sonarqube.com/sonarqube" \
11+
-Diris.source.token="$SONAR_SOURCE_IRIS_TOKEN" \
12+
-Diris.destination.projectKey="SonarSource_sonar-scanner-python" \
13+
-Diris.destination.url="$SONAR_TARGET_URL" \
14+
-Diris.destination.token="$SONAR_TARGET_IRIS_TOKEN" \
15+
-Diris.destination.organization="sonarsource" \
16+
-Diris.dryrun=$1 \
17+
-jar iris-\[RELEASE\]-jar-with-dependencies.jar
18+
}
19+
20+
VERSION="\[RELEASE\]"
21+
HTTP_CODE=$(\
22+
curl \
23+
--write-out '%{http_code}' \
24+
--location \
25+
--remote-name \
26+
--user "$ARTIFACTORY_PRIVATE_USERNAME:$ARTIFACTORY_PRIVATE_ACCESS_TOKEN" \
27+
"$ARTIFACTORY_URL/sonarsource-private-releases/com/sonarsource/iris/iris/$VERSION/iris-$VERSION-jar-with-dependencies.jar"\
28+
)
29+
30+
if [ "$HTTP_CODE" != "200" ]; then
31+
echo "Download $VERSION failed -> $HTTP_CODE"
32+
exit 1
33+
else
34+
echo "Downloaded $VERSION"
35+
fi
36+
37+
echo "===== Execute IRIS as dry-run"
38+
run_iris "true"
39+
STATUS=$?
40+
if [ $STATUS -ne 0 ]; then
41+
echo "===== Failed to run IRIS dry-run"
42+
exit 1
43+
else
44+
echo "===== Successful IRIS dry-run - executing IRIS for real."
45+
run_iris "false"
46+
fi

‎.github/workflows/iris.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Iris sync
2+
on:
3+
schedule:
4+
# Nightly job
5+
- cron: '0 2 * * *'
6+
workflow_dispatch:
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
jobs:
13+
iris:
14+
name: "IRIS ${{ matrix.name }}"
15+
needs: [analysis-shadow-sqc-eu, analysis-shadow-sqc-us]
16+
runs-on: sonar-s-public
17+
if: github.ref == 'refs/heads/master'
18+
permissions:
19+
id-token: write
20+
contents: write
21+
strategy:
22+
matrix:
23+
include:
24+
- name: "IRIS SQ NEXT -> Sonarcloud.io"
25+
env:
26+
SONAR_TARGET_URL: https://sonarcloud.io
27+
SONAR_TARGET_IRIS_TOKEN: VAULT[development/kv/data/iris data.sqc-eu]
28+
- name: "IRIS SQ NEXT -> SonarQube.us"
29+
env:
30+
SONAR_TARGET_URL: https://sonarqube.us
31+
SONAR_TARGET_IRIS_TOKEN: VAULT[development/kv/data/iris data.sqc-us]
32+
steps:
33+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
34+
- name: Run IRIS
35+
run: ./.github/scripts/run_iris.sh
36+

‎.github/workflows/shadow-analysis.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Shadow Analysis
2+
on:
3+
schedule:
4+
# Nightly job
5+
- cron: '0 2 * * *'
6+
workflow_dispatch:
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
jobs:
13+
coverage:
14+
name: "Coverage report generation"
15+
runs-on: github-ubuntu-latest-s
16+
needs: [install_deps]
17+
permissions:
18+
id-token: write
19+
contents: write
20+
steps:
21+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
22+
- uses: ./.github/actions/config-poetry
23+
- run: |
24+
poetry run pytest --cov-report=xml:coverage.xml --cov-config=pyproject.toml --cov=src --cov-branch tests
25+
poetry run mypy src/ > mypy-report.txt || true
26+
- name: Upload coverage artifacts
27+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
28+
with:
29+
name: coverage-reports
30+
path: |
31+
coverage.xml
32+
mypy-report.txt
33+
34+
analysis-shadow-sqc-eu:
35+
name: "SQC-EU Shadow Analysis"
36+
needs: [coverage]
37+
runs-on: github-ubuntu-latest-s
38+
if: github.ref == 'refs/heads/master'
39+
permissions:
40+
id-token: write
41+
contents: write
42+
steps:
43+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
44+
- name: Download coverage artifacts
45+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
46+
with:
47+
name: coverage-reports
48+
- uses: jdx/mise-action@e3d7b8d67a7958d1207f6ed871e83b1ea780e7b0 #v3.3.1
49+
with:
50+
install_args: "[email protected]"
51+
- run: mise use -g [email protected]
52+
- uses: SonarSource/ci-github-actions/build-poetry@v1
53+
env:
54+
sonar-platform: sqc-eu
55+
artifactory-reader-role: private-reader
56+
artifactory-deployer-role: qa-deployer
57+
58+
analysis-shadow-sqc-us:
59+
name: "SQC-US Shadow Analysis"
60+
needs: [coverage]
61+
runs-on: sonar-s-public
62+
if: github.ref == 'refs/heads/master'
63+
permissions:
64+
id-token: write
65+
contents: write
66+
steps:
67+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
68+
- name: Download coverage artifacts
69+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
70+
with:
71+
name: coverage-reports
72+
- uses: jdx/mise-action@e3d7b8d67a7958d1207f6ed871e83b1ea780e7b0 #v3.3.1
73+
with:
74+
install_args: "[email protected]"
75+
- run: mise use -g [email protected]
76+
- uses: SonarSource/ci-github-actions/build-poetry@v1
77+
env:
78+
sonar-platform: sqc-us
79+
artifactory-reader-role: private-reader
80+
artifactory-deployer-role: qa-deployer
81+

0 commit comments

Comments
 (0)