Skip to content

Commit f25e362

Browse files
jl-0jl-0
authored
Merge pull request #774 from NASA-AMMOS/sonarcloud_action
Including Updated Security Scan Config
2 parents 501cf40 + 64f5417 commit f25e362

2 files changed

Lines changed: 220 additions & 0 deletions

File tree

‎.github/workflows/security-scan.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Security-Scan
2+
on:
3+
workflow_dispatch:
4+
push:
5+
branches:
6+
- development
7+
- sonarcloud_action
8+
jobs:
9+
sonarqube:
10+
name: SonarQube
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
with:
15+
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
16+
- name: Extract version from package.json
17+
id: package_version
18+
run: |
19+
VERSION=$(node -p "require('./package.json').version")
20+
echo "VERSION=$VERSION" >> $GITHUB_ENV
21+
echo "Extracted version: $VERSION"
22+
- name: Initialize CodeQL
23+
uses: github/codeql-action/init@v3
24+
with:
25+
queries: security-and-quality, security-extended
26+
- name: CodeQL Scan
27+
uses: github/codeql-action/analyze@v3
28+
- name: Post-Process CodeQL
29+
run: |
30+
python3 -m pip install nasa-scrub
31+
32+
results_dir=`realpath ${{ github.workspace }}/../results`
33+
sarif_files=`find $results_dir -name '*.sarif'`
34+
35+
for sarif_file in $sarif_files
36+
do
37+
output_file="$results_dir/$(basename $sarif_file .sarif)_stripped.sarif"
38+
39+
python3 -m scrub.tools.parsers.translate_results $sarif_file $output_file ${{ github.workspace }} sarifv2.1.0
40+
done
41+
42+
echo "RESULTS_DIR=$results_dir" >> $GITHUB_ENV
43+
echo "Results generated: "
44+
echo $results_dir
45+
46+
# Create comma-separated list of SARIF files for SonarQube
47+
sarif_list=$(find $results_dir -name '*_stripped.sarif' | tr '\n' ',' | sed 's/,$//')
48+
echo "SARIF_FILES=$sarif_list" >> $GITHUB_ENV
49+
- name: SonarQube Scan
50+
uses: SonarSource/sonarqube-scan-action@v6
51+
env:
52+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
53+
with:
54+
projectBaseDir: .
55+
args: >
56+
-Dsonar.sarifReportPaths=${{ env.SARIF_FILES }}
57+
-Dsonar.projectVersion=${{ env.VERSION }}

‎sonar-project.properties‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
# SonarCloud Configuration for MMGIS
2+
sonar.projectKey=NASA-AMMOS_MMGIS
3+
sonar.organization=nasa-ammos
4+
5+
# Project metadata - will be overridden by workflow
6+
sonar.projectName=MMGIS
7+
sonar.projectVersion=4.1.0
8+
sonar.projectDescription=Multi-Mission Geographic Information System - A web-based mapping and localization solution for science operation on planetary missions.
9+
10+
# Project links - shown in SonarQube UI
11+
sonar.links.homepage=https://nasa-ammos.github.io/MMGIS/
12+
sonar.links.scm=https://github.com/NASA-AMMOS/MMGIS
13+
sonar.links.issue=https://github.com/NASA-AMMOS/MMGIS/issues
14+
sonar.links.ci=https://github.com/NASA-AMMOS/MMGIS/actions
15+
16+
# Source directories to analyze
17+
# Note: 'public' directory excluded from sources to reduce LOC - contains mostly static assets (SVGs, images, config files)
18+
# Note: 'auxiliary' directory excluded from sources - contains standalone utility scripts, not server code
19+
sonar.sources=src,API,scripts,views,configure
20+
# Note: sonar.tests is not set because test files are intermixed with source files.
21+
# Test files are excluded via sonar.test.exclusions patterns below.
22+
23+
# Exclude patterns to reduce lines of code analyzed
24+
sonar.exclusions=\
25+
**/node_modules/**,\
26+
**/build/**,\
27+
**/dist/**,\
28+
**/coverage/**,\
29+
**/playwright-report/**,\
30+
**/test-results/**,\
31+
**/*.min.js,\
32+
**/*.min.css,\
33+
**/config/js/jquery*.js,\
34+
**/config/js/materialize.min.js,\
35+
**/config/js/papaparse.min.js,\
36+
**/config/js/codemirror/**,\
37+
**/vendor/**,\
38+
**/vendors/**,\
39+
**/third_party/**,\
40+
**/Missions/**,\
41+
**/__pycache__/**,\
42+
**/sessions/**,\
43+
**/.venv*/**,\
44+
**/data/**,\
45+
**/logs/**,\
46+
**/*.log,\
47+
**/*.svg,\
48+
**/*.json,\
49+
**/.DS_Store,\
50+
**/.vscode/**,\
51+
**/.git/**,\
52+
**/documentation/**,\
53+
**/docs/**,\
54+
**/public/**,\
55+
**/auxiliary/**,\
56+
**/config/**,\
57+
**/images/**,\
58+
**/fonts/**
59+
60+
# Test exclusions
61+
sonar.test.exclusions=\
62+
**/*.spec.js,\
63+
**/*.test.js,\
64+
**/*.spec.jsx,\
65+
**/*.test.jsx,\
66+
**/*.spec.ts,\
67+
**/*.test.ts,\
68+
**/*.spec.tsx,\
69+
**/*.test.tsx,\
70+
**/test/**,\
71+
**/tests/**,\
72+
**/__tests__/**,\
73+
**/playwright-report/**,\
74+
**/test-results/**
75+
76+
# Coverage exclusions - don't analyze coverage for these
77+
sonar.coverage.exclusions=\
78+
**/*.spec.js,\
79+
**/*.test.js,\
80+
**/*.spec.jsx,\
81+
**/*.test.jsx,\
82+
**/test/**,\
83+
**/tests/**,\
84+
**/__tests__/**,\
85+
**/configuration/**,\
86+
**/*.config.js,\
87+
**/*.config.ts,\
88+
**/scripts/**
89+
90+
# Duplication exclusions - ignore generated or vendor code
91+
sonar.cpd.exclusions=\
92+
**/*.min.js,\
93+
**/config/js/**,\
94+
**/vendor/**
95+
96+
# Language-specific settings
97+
sonar.javascript.file.suffixes=.js,.jsx
98+
sonar.typescript.file.suffixes=.ts,.tsx
99+
sonar.python.version=3.8,3.9,3.10,3.11
100+
101+
# Code analysis settings
102+
sonar.sourceEncoding=UTF-8
103+
104+
# Component tags for categorization and filtering in SonarQube UI
105+
sonar.tags=gis,mapping,planetary,nasa,web-app,geospatial,react,nodejs,postgres
106+
107+
# New Code definition - consider code new if added in last 30 days
108+
sonar.leak.period=30
109+
110+
# Import external reports - will be set by workflow
111+
# sonar.sarifReportPaths will be provided by GitHub Actions workflow
112+
113+
# ==========================================
114+
# LOC Optimization Notes
115+
# ==========================================
116+
# To stay within SonarCloud organization LOC limits, this configuration excludes:
117+
# - public/ directory: ~130k LOC of SVG patterns, static assets, and config files
118+
# - auxiliary/ directory: Standalone utility scripts for users (GDAL tiling, etc.) - not server code
119+
# - All SVG files: Geologic patterns and icons (not meaningful for code analysis)
120+
# - All JSON files: Configuration and data files (not executable code)
121+
# - Image and font directories: Binary/generated assets
122+
#
123+
# Estimated LOC after exclusions: ~273k (down from ~475k total)
124+
# This focuses analysis on MMGIS application code: src/, API/, scripts/, views/, configure/
125+
126+
# ==========================================
127+
# Component Organization for Issue Attribution
128+
# ==========================================
129+
# While SonarQube/SonarCloud no longer uses sonar.modules for multi-module projects,
130+
# issues are automatically organized by file path. The structure below documents
131+
# the logical organization of MMGIS for reference:
132+
#
133+
# FRONTEND COMPONENTS (src/)
134+
# - src/essence/ : Core frontend engine (map, globe, tools, UI framework)
135+
# - src/essence/Tools/ : Interactive tools (Draw, Measure, Chemistry, etc.)
136+
# - src/essence/Basics/ : Core UI components and utilities
137+
# - src/essence/Ancillary: Supporting UI modules
138+
# - src/pre/ : Pre-initialization scripts
139+
# - src/external/ : Third-party integrations
140+
#
141+
# BACKEND COMPONENTS (API/)
142+
# - API/Backend/Config/ : Mission configuration management
143+
# - API/Backend/Draw/ : Multi-user vector drawing backend
144+
# - API/Backend/Geodatasets/: Geospatial dataset management
145+
# - API/Backend/Users/ : User authentication and authorization
146+
# - API/Backend/Webhooks/: External service integrations
147+
# - API/Backend/Stac/ : SpatioTemporal Asset Catalog integration
148+
#
149+
# CONFIGURATION SITE (configure/)
150+
# - configure/src/ : Admin configuration interface (React app)
151+
#
152+
# BUILD & DEPLOYMENT (scripts/)
153+
# - scripts/ : Build tools, server initialization, database setup
154+
#
155+
# VIEWS & TEMPLATES (views/)
156+
# - views/ : Server-side Pug templates
157+
#
158+
# EXCLUDED FROM ANALYSIS:
159+
# - auxiliary/ : Standalone Python utilities (not server code)
160+
# - public/ : Static assets (SVGs, images, fonts)
161+
#
162+
# Issues in SonarQube will be automatically grouped by these directory paths,
163+
# making it easy to identify which component needs attention.

0 commit comments

Comments
 (0)