Skip to content

Commit da4ace0

Browse files
nikhil2611nikhil2611
authored
Black Duck integration and CI/SonarQube updates (#303)
* Update sonar-project.properties Signed-off-by: nikhil2611 <[email protected]> * updating to common GitHub Action 1.0.5 Signed-off-by: nikhil2611 <[email protected]> * added chef-cli-5 release branch Signed-off-by: nikhil2611 <[email protected]> * empty commit to run the scans again Signed-off-by: nikhil2611 <[email protected]> * updating blackduck config Signed-off-by: nikhil2611 <[email protected]> --------- Signed-off-by: nikhil2611 <[email protected]>
1 parent f74828f commit da4ace0

File tree

3 files changed

+142
-12
lines changed

3 files changed

+142
-12
lines changed

.github/workflows/sonarqube.yml renamed to .github/workflows/archived/sonarqube.yml

File renamed without changes.

‎.github/workflows/ci-main-pull-request-stub.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# stub to call common GitHub Action (GA) as part of Continuous Integration (CI) Pull Request process checks for main branch
2+
# inputs are described in the chef/common-github-actions/<GA.yml> with same name as this stub
3+
#
4+
# secrets are inherited from the calling workflow, typically SONAR_TOKEN, SONAR_HOST_URL, GH_TOKEN, AKEYLESS_JWT_ID, POLARIS_SERVER_URL and POLARIS_ACCESS_TOKEN
5+
6+
name: CI Pull Request on Main Branch
7+
8+
on:
9+
pull_request:
10+
branches: [ main, release/** ]
11+
push:
12+
branches: [ main, release/** ]
13+
14+
workflow_dispatch:
15+
16+
permissions:
17+
contents: read
18+
19+
env:
20+
STUB_VERSION: "1.0.5"
21+
22+
jobs:
23+
echo_version:
24+
name: 'Echo stub version'
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: echo version of stub and inputs
28+
run: |
29+
echo "CI main pull request stub version $STUB_VERSION"
30+
31+
call-ci-main-pr-check-pipeline:
32+
uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main
33+
secrets: inherit
34+
permissions:
35+
id-token: write
36+
contents: read
37+
38+
with:
39+
visibility: ${{ github.event.repository.visibility }} # private, public, or internal
40+
# go-private-modules: GOPRIVATE for Go private modules, default is 'github.com/progress-platform-services/*
41+
42+
# if version specified, it takes precedence; can be a semver like 1.0.2-xyz or a tag like "latest"
43+
version: '6.1.13' # ${{ github.event.repository.version }}
44+
detect-version-source-type: 'none' # options include "none" (do not detect), "file", "github-tag" or "github-release"
45+
detect-version-source-parameter: '' # use for file name
46+
language: 'ruby' # Go, Ruby, Rust, JavaScript, TypeScript, Python, Java, C#, PHP, other - used for build and SonarQube language setting
47+
48+
# complexity-checks
49+
perform-complexity-checks: true
50+
# scc-output-filename: 'scc-output.txt'
51+
perform-language-linting: false # Perform language-specific linting and pre-compilation checks
52+
53+
# trufflehog secret scanning
54+
perform-trufflehog-scan: true
55+
56+
# trivy dependency and container scanning
57+
perform-trivy-scan: true
58+
59+
# BlackDuck SAST (Polaris) and SCA scans (requires a build or download to do SAST)
60+
# requires these secrets: POLARIS_SERVER_URL, POLARIS_ACCESS_TOKEN
61+
perform-blackduck-polaris: true
62+
polaris-application-name: "Chef-Agents" # one of these: Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Other, Chef-Non-Product
63+
polaris-project-name: ${{ github.event.repository.name }}
64+
polaris-blackduck-executable: 'path/to/blackduck/binary'
65+
polaris-executable-detect-path: 'path/to/detect'
66+
67+
# perform application build and unit testing, will use custom repository properties when implemented for chef-primary-application, chef-build-profile, and chef-build-language
68+
build: false
69+
# ga-build-profile: $chef-ga-build-profile
70+
# language: $chef-ga-build-language # this will be removed from stub as autodetected in central GA
71+
unit-tests: false
72+
73+
# perform SonarQube scan, with or wihout unit test coverage data
74+
# requires secrets SONAR_TOKEN and SONAR_HOST_URL (progress.sonar.com)
75+
perform-sonarqube-scan: false
76+
# perform-sonar-build: true
77+
# build-profile: 'default'
78+
# report-unit-test-coverage: true
79+
80+
# report to central developer dashboard
81+
report-to-atlassian-dashboard: false
82+
quality-product-name: 'Chef-Agents' # product name for quality reporting, like Chef360, Courier, Inspec
83+
# quality-product-name: ${{ github.event.repository.name }} # like 'Chef-360' - the product name for quality reporting, like Chef360, Courier, Inspec
84+
# quality-sonar-app-name: 'YourSonarAppName'
85+
# quality-testing-type: 'Integration' like Unit, Integration, e2e, api, Performance, Security
86+
# quality-service-name: 'YourServiceOrRepoName'
87+
# quality-junit-report: 'path/to/junit/report''
88+
89+
# perform native and Habitat packaging, publish to package repositories
90+
package-binaries: false # Package binaries (e.g., RPM, DEB, MSI, dpkg + signing + SHA)
91+
habitat-build: false # Create Habitat packages
92+
publish-packages: false # Publish packages (e.g., container from Dockerfile to ECR, go-releaser binary to releases page, omnibus to artifactory, gems, choco, homebrew, other app stores)
93+
94+
# generate and export Software Bill of Materials (SBOM) in various formats
95+
generate-sbom: true
96+
export-github-sbom: true # SPDX JSON artifact on job instance
97+
perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above
98+
blackduck-project-group-name: 'Chef-Agents' # typically one of (Chef), Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Non-Product'
99+
blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name
100+
generate-blackduck-sbom: true # obsolete, use perform-blackduck-sca-scan instead
101+
102+
generate-msft-sbom: false
103+
license_scout: false # Run license scout for license compliance (uses .license_scout.yml)
104+
105+
# udf1: 'default' # user defined flag 1
106+
# udf2: 'default' # user defined flag 2
107+
# udf3: 'default' # user defined flag 3

‎sonar-project.properties‎

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,44 @@
1-
# must be unique in a given SonarQube instance
2-
sonar.projectKey=chef_chef-cli_AYcNv4diJ4YHsO5MtJHg
1+
# SonarQube configuration file
2+
#
3+
# Sample Ruby Sonar file - https://docs.sonarsource.com/sonarqube-server/10.6/analyzing-source-code/languages/ruby/
4+
# properties defined in https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/analysis-parameters/
5+
#
6+
# view this repo in sonar: https://sonar.progress.com/dashboard?id=chef_chef-workstation_AYbLDTBoJ4YHsO5MtH07
37

4-
sonar.projectName=chef-cli
8+
# Required metadata
9+
sonar.projectKey=chef_chef-cli_AYcNv4diJ4YHsO5MtJHg
10+
# project name is 3 parts: "Chef" + "<area/product>" + "<repo>" with underscores between
11+
# <area/product> choices: Chef-Agents | Chef-Automate | Chef360 | Chef-Habitat | Chef-Infra-Server | Chef-Shared-Services
12+
# example project name: chef/chef-vault repo would be Chef_Chef-Infra-Client_chef-vault
13+
sonar.projectName=Chef_Chef-Agents_chef-cli
14+
# sonar.projectVersion=1.0
15+
# sonar.projectDescription=
516

6-
# defaults to 'not provided'
7-
#sonar.projectVersion=1.0
17+
# Language - https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/languages/overview/ go, ruby, rust
18+
sonar.language=ruby
19+
sonar.sources=lib
20+
# sonar.sources=lib <-- for Ruby, match this with the /spec directory for tests & SARIF output directory for test results/rcov
21+
# sonar.exclusions=**/*_test.go, **/*.js, **/*.sql, **/*.yml, **/*.yaml; may exclude **/vendor/** for Ruby
822

9-
sonar.sources=.
10-
sonar.exclusions=**/*_test.go
23+
# Unit tests
24+
sonar.tests=spec
25+
# was spec/**/*.rb
26+
# sonar.test.inclusions=**/*_test.go **/*Test.java
27+
# Coverage report
28+
# sonar.ruby.coverage.framework=RSpec
29+
# sonar.ruby.coverage.reportPaths=coverage/coverage.json
30+
# ^^^ comma-delimited paths to Rubocop reports, SimpleCov, or RSpec plugin reports (coverage/coverage.json <-- default output for simpleCov)
1131

12-
sonar.tests=.
13-
sonar.test.inclusions=**/*_test.go
32+
# sonar.ruby.rubocop.reportPaths=./rubocop-report.json -- import Ruby Rubocop
33+
# sonar.dependencyCheck.htmlReportPath=./dependency-check-report.html -- import OWASP dependency check report
34+
# sonar.externalIssuesReportPaths Comma-delimited list of paths to generic issue reports.
35+
# sonar.sarifReportPaths Comma-delimited list of paths to SARIF issue reports.
1436

15-
# Encoding of the source code. Default is default system encoding
16-
#sonar.sourceEncoding=UTF-8
37+
# Additional settings
38+
# sonar.qualitygate.wait=false
39+
# sonar.qualitygate.timeout=300
1740

1841
# skip C-language processor
1942
sonar.c.file.suffixes=-
2043
sonar.cpp.file.suffixes=-
21-
sonar.objc.file.suffixes=-
44+
sonar.objc.file.suffixes=-

0 commit comments

Comments
 (0)