search

cathive / concourse-sonarqube-resource

performs SonarQube analyses and checks quality gates https://concourse-ci.org/ https://sonarqube.org/
Apache License 2.0
46 stars 50 forks source link
code-quality concourse-ci concourse-ci-resource concourse-resource continuous-integration pipeline quality-gate quality-gates sonar-scanner sonarcloud sonarqube sonarqube-analysis sonarqube-scanner static-code-analysis

readme

CI

SonarQube Resource for Concourse CI

Performs SonarQube analyses and tracks the state of SonarQube quality gates.

This resource works with SonarCloud and self-hosted instances of SonarQube.

If you want to implement a real quality gate in your build pipeline, you might want to also use the concourse-sonarqube-qualitygate-task which can be used to break a build if certain quality goals (as reported by SonarQube) are not reached.

Requirements

Installation

Add a new resource type to your Concourse CI pipeline:

 resource_types:
 - name: sonar-runner
  type: docker-image
  source:
    repository: cathive/concourse-sonarqube-resource
    tag: latest # For reproducible builds use a specific tag and don't rely on "latest".

Source Configuration

Behavior

The resource implements all three actions (check, in and out). The analysis is triggered by the out action and check/in will be used to wait for the result of the analysis and pull in the project status. Tasks can use this information to break the build (if desired) if any of the criteria of the quality gate associated with a project are not met.

out: Trigger SonarQube analysis

Parameters

Wildcards Support

Support convert wildcards to comma-separated paths.

in: Fetch result of SonarQube analysis

The action will place two JSON files into the resource's folder which are fetched from the SonarQube Web API:

Parameters

Note: for ignore_warns/ignore_errors, possible value could be found through

Outputs

Full example

The following example pipeline shows how to use the resource to break the build if a project doesn't meet the requirements of the associated quality gate.

resource_types:

- name: sonar-runner
  type: docker-image
  source:
    repository: cathive/concourse-sonarqube-resource
    tag: latest # For reproducible builds use a specific tag and don't rely on "latest".

resources:

- name: sources
  type: git
  source:
    uri: https://github.com/example/example.git

- name: artifact
  type: s3
  # ... configuration omitted

- name: code-analysis
  type: sonar-runner
  source:
    host_url: https://sonarqube.example.com/
    login: ((sonarqube-auth-token))

jobs:

# The build job performs fetches stuff from the "sources" resource
# and executes a task that builds and tests everything. Once compilation,
# test execution and <whatever> has been performed, we copy the whole
# working directory into the output folder "sonarqube-analysis-input"
# and push the package that has been created by the "build" task to the
# artifact resource and utilize the sonarqube-resource to perform static
# code analysis.
- name: build-and-analyze
  plan:
  - get: sources
    trigger: true
  - task: build
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: debian
          tag: 'jessie'
      inputs:
      - name: sources
      outputs:
      # Hint: The sonar-runner needs more than just the
      # sources to perform a full analysis. Line coverage reports, unit test reports,
      # Java class files and mutation test results should also be present.
      # Therefore, you'll have to make sure that your build script provides the sources
      # and the compilation/test results in your Concourse CI build plan.
      # (And that is the reason, why we need the following output)
      - name: sonarqube-analysis-input
      run:
        path: build.sh
        dir: sources
  - in_parallel:
    - put: code-analysis
      params:
        project_path: sonarqube-analysis-input
        project_key: com.example.my_project
        sources: ["."]
        tests: ["."]
        additional_properties:
          # Will be passed as "-Dsonar.javascript.lcov.reportPaths="coverage/lcov.info" to the scanner.
          sonar.javascript.lcov.reportPaths: coverage/lcov.info
      get_params:
        quality_gate:
          ignore_errors: ['new_coverage', 'violations']
          ignore_warns: ['new_duplicated_lines_density', 'violations']
    - put: artifact

# The qualitygate task breaks the build if the analysis result from SonarQube
# indicates that any of our quality metrics have not been met.
- name: qualitygate
  plan:
  - in_parallel:
    - get: artifact
      passed:
      - build-and-analyze
    - get: code-analysis
      passed:
      - build-and-analyze
      trigger: true
  - task: check-sonarqube-quality-gate
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: cathive/concourse-sonarqube-qualitygate-task
          tag: latest # Use one of the versioned tags for reproducible builds!
      inputs:
      - name: code-analysis
      run:
        path: /sonarqube-qualitygate-check
        dir: code-analysis

# We deploy only artifacts that have made it through our quality gate!
- name: deploy
  plan:
  - get: artifact
    passed:
    - qualitygate