sonar: Update deprecated action #40
Conversation
WalkthroughThe GitHub Actions workflow for Sonar coverage reporting has been updated. The action responsible for uploading coverage reports was switched from Changes
Poem
Tip ⚡💬 Agentic Chat (Pro Plan, General Availability)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/sonar.yml (1)
46-46: Replace deprecated action and pin version
Switching toSonarSource/sonarqube-scan-action@masteraddresses the deprecation warning. For greater stability, consider pinning to a specific tag or commit SHA instead of@master.
Additionally, the file currently lacks a trailing newline—adding one will satisfy YAML lint requirements.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 46-46: no new line character at the end of file
(new-line-at-end-of-file)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/sonar.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.35.1)
.github/workflows/sonar.yml
[error] 46-46: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (2)
.github/workflows/sonar.yml (2)
44-44: Load SONAR_TOKEN from repository secrets
This step correctly injects theSONAR_TOKENsecret into the job’s environment, ensuring the SonarQube scanner can authenticate.
45-45: Ensure correct conditional for scan execution
Theifclause limits execution to PRs originating from the same repo or runs whenSONAR_TOKENis set (e.g., on main‑branch pushes). Please verify that this expression behaves as intended across bothpull_requestandpushevents to avoid inadvertently skipping scans.
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/sonar.yml (1)
46-46: Add a trailing newline
YAML parsers and linters (e.g., yamllint) expect a newline at EOF to avoid warnings.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 46-46: no new line character at the end of file
(new-line-at-end-of-file)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/sonar.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.35.1)
.github/workflows/sonar.yml
[error] 46-46: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (3)
.github/workflows/sonar.yml (3)
44-44: Secret mapping looks correct
LoadingSONAR_TOKENfromsecrets.SONAR_TOKENinto the step’s environment ensures the scan can authenticate.
45-45: Verify theifconditional for all event types
On apushevent,github.event.pull_requestwill be null, sogithub.event.pull_request.head.repo.full_nameresolves to an empty string. Ensure this expression behaves as expected (you might need to provide a fallback or wrap the entire expression in${{ }}for clarity).
46-46: Confirm the chosen action version
You’ve pinned toSonarSource/[email protected]. Double‑check whether you prefer a fixed version (recommended for reproducibility) or the@masterbranch as originally noted in the PR description.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 46-46: no new line character at the end of file
(new-line-at-end-of-file)
This PR replaces the deprecated
sonarsource/sonarcloud-github-action@masterwith the recommendedSonarSource/sonarqube-scan-action@masteras suggested in the CI warning message.The warning message was:
This change follows the same pattern as used in luno-go, including the conditional check to only run the SonarQube scan when:
Summary by CodeRabbit