66 - master
77 pull_request :
88 types : [opened, synchronize, reopened, ready_for_review]
9+ pull_request_target :
10+ types : [opened, synchronize, reopened, ready_for_review] # added for fork PRs
911 workflow_dispatch :
1012
1113permissions :
2123 fail-fast : false
2224 matrix :
2325 include :
24- # - python-version: 3.9
25- # toxenv: py39,style,coverage-ci
2626 - python-version : 3.10.9
2727 toxenv : py310,style,coverage-ci
2828 - python-version : 3.11
@@ -34,29 +34,96 @@ jobs:
3434 - uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
3535 with :
3636 submodules : recursive
37- fetch-depth : 0 # Shallow clones should be disabled for a better relevancy of analysis
37+ fetch-depth : 0 # shallow clones should be disabled for analysis
38+
3839 - name : Setup python
3940 uses : actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
4041 with :
4142 python-version : ${{ matrix.python-version }}
43+
4244 - name : Setup Node.js
4345 uses : actions/setup-node@v3
4446 with :
4547 node-version : ' 20'
48+
4649 - name : Install dependencies
4750 run : |
4851 pip install --upgrade virtualenv
4952 pip install tox
5053 npm --prefix plugins/magma install
5154 npm --prefix plugins/magma run build
55+
5256 - name : Run tests
5357 env :
5458 TOXENV : ${{ matrix.toxenv }}
5559 run : tox
60+
5661 - name : Override Coverage Source Path for Sonar
57- run : sed -i "s/<source>\/home\/runner\/work\/caldera\/caldera/<source>\/github\/workspace/g" /home/runner/work/caldera/caldera/coverage.xml
62+ run : sed -i "s#<source>/home/runner/work/caldera/caldera#<source>/github/workspace#g" /home/runner/work/caldera/caldera/coverage.xml
63+
64+ # --- Sonar scan for pushes and same-repo PRs only ---
5865 - name : SonarQube Scan
66+ if : ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}
67+ uses :
SonarSource/[email protected] 68+ env :
69+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }} # needed for PR info
70+ SONAR_TOKEN : ${{ secrets.SONAR_TOKEN }}
71+ # Uncomment if your sonar-project.properties is in a subfolder:
72+ # with:
73+ # args: |
74+ # -Dsonar.projectBaseDir=caldera
75+
76+ # --- Sonar scan for forked PRs (runs safely with pull_request_target) ---
77+ sonar_fork_pr :
78+ runs-on : ubuntu-latest
79+ if : ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.fork }}
80+ permissions :
81+ contents : read
82+ pull-requests : write # remove if you don't want PR comments
83+ steps :
84+ - name : Checkout base repo
85+ uses : actions/checkout@v4
86+ with :
87+ ref : ${{ github.event.pull_request.base.sha }}
88+ fetch-depth : 0
89+
90+ - name : Checkout PR HEAD (fork)
91+ uses : actions/checkout@v4
92+ with :
93+ repository : ${{ github.event.pull_request.head.repo.full_name }}
94+ ref : ${{ github.event.pull_request.head.sha }}
95+ path : pr
96+ fetch-depth : 0
97+ submodules : recursive
98+
99+ # Detect where the sonar-project.properties actually is (pr/ or pr/caldera)
100+ - name : Detect Sonar base dir
101+ id : detect
102+ run : |
103+ set -euo pipefail
104+ if [ -f pr/caldera/sonar-project.properties ]; then
105+ echo "base=pr/caldera" >> "$GITHUB_OUTPUT"
106+ elif [ -f pr/sonar-project.properties ]; then
107+ echo "base=pr" >> "$GITHUB_OUTPUT"
108+ else
109+ echo "No sonar-project.properties found under pr/ or pr/caldera"
110+ echo "base=pr" >> "$GITHUB_OUTPUT" # fallback to repo root
111+ fi
112+ echo "Using base dir: $(grep '^base=' "$GITHUB_OUTPUT" | cut -d= -f2)"
113+ echo "Has SONAR_TOKEN? $([ -n "${SONAR_TOKEN:-}" ] && echo yes || echo no)"
114+ env :
115+ SONAR_TOKEN : ${{ secrets.SONAR_TOKEN }}
116+
117+ # If your project key/org are NOT in the properties file, uncomment and set below
118+ - name : SonarQube Scan (fork PR)
59119 uses :
SonarSource/[email protected] 60120 env :
61- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
62121 SONAR_TOKEN : ${{ secrets.SONAR_TOKEN }}
122+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
123+ # SONAR_HOST_URL: https://sonarcloud.io # set if you’re self-hosted or non-default
124+ with :
125+ projectBaseDir : ${{ steps.detect.outputs.base }}
126+ args : |
127+ -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
128+ -Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
129+ -Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}
0 commit comments