Add GitHub action to run SonarQube for METplus pull requests and feature branches

JohnHalleyGotway commented 3 months ago

Describe the New Feature

This issue is to add a new SonarQube workflow to GitHub actions to automate the static code analysis for all pull requests. In addition, add a manual trigger workflow dispatch option where the reference branch can be manually specified.

Recommend adding this workflow to both the develop branch and the current main_v*so that the workflow dispatch option can be made available.

Recommend pushing results to a new SonarQube project named METplus GHA at needham.rap.ucar.edu.

Recommend having the workflow report bad status if the number of SonarQube findings are increased relative to the SonarQube reference.

See issue dtcenter/MET#2379 and its two linked PR's as an example, but the implementation for a python-only repo should be more straight-forward.

Acceptance Testing

List input data types and sources. Describe tests required for new functionality.

Time Estimate

Estimate the amount of work required here. Issues should represent approximately 1 to 3 days of work.

Sub-Issues

Consider breaking the new feature down into sub-issues.

Relevant Deadlines

List relevant project deadlines here or state NONE.

Funding Source

Needed for the Air Force - 2771024

Define the Metadata

Assignee

[ ] Select engineer(s) or no engineer required
[ ] Select scientist(s) or no scientist required

Labels

[x] Select component(s)
[x] Select priority
[x] Select requestor(s)

Projects and Milestone

[x] Select Repository and/or Organization level Project(s) or add alert: NEED CYCLE ASSIGNMENT label
[x] Select Milestone as the next official version or Future Versions

Define Related Issue(s)

Consider the impact to the other METplus components.

[x] METplus, MET, METdataio, METviewer, METexpress, METcalcpy, METplotpy

The following SonarQube issues are closely related:

[x] dtcenter/METplus#2537
[x] dtcenter/MET#2379
[x] dtcenter/METviewer#521
[x] dtcenter/METplotpy#429
[x] dtcenter/METcalcpy#366
[x] dtcenter/METdataio#289

New Feature Checklist

See the METplus Workflow for details.

[ ] Complete the issue definition above, including the Time Estimate and Funding source.
[ ] Fork this repository or create a branch of develop. Branch name: feature_<Issue Number>_<Description>
[ ] Complete the development and test your changes.
[ ] Add/update log messages for easier debugging.
[ ] Add/update unit tests.
[ ] Add/update documentation.
[ ] Add any new Python packages to the METplus Components Python Requirements table.
[ ] Push local changes to GitHub.
[ ] Submit a pull request to merge into develop. Pull request: feature <Issue Number> <Description>
[ ] Define the pull request metadata, as permissions allow. Select: Reviewer(s) and Development issues Select: Repository level development cycle Project for the next official release Select: Milestone as the next official version
[ ] Iterate until the reviewer(s) accept and merge your changes.
[ ] Delete your fork or branch.
[ ] Close this issue.

JohnHalleyGotway commented 3 months ago

Followed these instructions to better integrate SonarQube with GitHub: https://docs.sonarsource.com/sonarqube/10.2/devops-platform-integration/github-integration/

To create a new GitHub app for the DTCenter organization (https://github.com/apps/dtcenter-sonarqube-integration) to support SonarQube integration.

Installed that app in the DTCenter org settings (https://github.com/organizations/dtcenter/settings/apps) for 6 repositories: METplus, MET, METviewer, METplotpy, METcalcpy, METdataio

Followed these instructions to setup GitHub user authentication for our SonarQube server: https://docs.sonarsource.com/sonarqube/10.2/instance-administration/authentication/github/

To create a new GitHub app for the DTCenter organization (https://github.com/apps/dtcenter-sonarqube-user-auth) to support GitHub user authentication at our SonarQube server.

Members of the DTCenter GitHub organization are now able to authenticate at needham.rap.ucar.edu using their GitHub credentials.

JohnHalleyGotway commented 3 months ago

Reopening issue during the beta5 development cycle to switch to pushing to a single SonarQube project rather than separate ones for GitHub actions and the nightly build.

dtcenter / METplus