SONARJAVA-5850 Migrate Windows Build from Cirrus to GitHub action #163
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - branch-* | |
| - dogfood-* | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "30 1 * * *" # Run daily at 1:30 AM UTC | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| runs-on: github-ubuntu-latest-m # Public repo uses custom GitHub-hosted runner | |
| name: Build | |
| permissions: | |
| id-token: write # Required for Vault OIDC authentication | |
| contents: write # Required for repository access and tagging | |
| outputs: | |
| build-number: ${{ steps.build-maven.outputs.BUILD_NUMBER }} | |
| deployed: ${{ steps.build-maven.outputs.deployed }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - uses: SonarSource/ci-github-actions/build-maven@v1 | |
| id: build-maven | |
| with: | |
| deploy-pull-request: true | |
| # Override artifactory roles for public repo using private access | |
| artifactory-reader-role: private-reader | |
| artifactory-deployer-role: qa-deployer | |
| maven-args: > | |
| -Dmaven.test.skip=true | |
| -Dsonar.skip=true | |
| -pl !java-checks-test-sources/default,!java-checks-test-sources/aws,!java-checks-test-sources/spring-web-4.0 | |
| ruling-qa: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| runner: | |
| - github-ubuntu-latest-m | |
| - github-windows-latest-m | |
| profile: | |
| - without-sonarqube-project | |
| - only-sonarqube-project | |
| name: Ruling QA | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: ${{ matrix.runner }} | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| submodules: recursive | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - name: Select Java 17 | |
| run: mise use java@17 | |
| - name: Configure Maven | |
| uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| - name: Getting Vault Secrets | |
| id: secrets | |
| uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # v3.1.0 | |
| with: | |
| secrets: | | |
| development/github/token/licenses-ro token | GITHUB_TOKEN; | |
| - name: Run ruling tests | |
| shell: bash # Set explicitly so Bash is used on Windows runners too. | |
| env: | |
| MAVEN_OPTS: "-Xmx3g" | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }} | |
| run: | | |
| cd its/ruling | |
| mvn package --batch-mode "-Pit-ruling,${{ matrix.profile }}" -Dsonar.runtimeVersion=LATEST_RELEASE -Dmaven.test.redirectTestOutputToFile=false -B -e -V -Dparallel=methods -DuseUnlimitedThreads=true | |
| plugin-qa: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sq_version: | |
| - LATEST_RELEASE | |
| - DEV | |
| name: Plugin QA | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: github-ubuntu-latest-m | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| submodules: recursive | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - name: Select Java 17 | |
| run: mise use java@17 | |
| - name: Configure Maven | |
| uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| - name: Getting Vault Secrets | |
| id: secrets | |
| uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # v3.1.0 | |
| with: | |
| secrets: | | |
| development/github/token/licenses-ro token | GITHUB_TOKEN; | |
| - name: Plugin QA | |
| env: | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }} | |
| run: | | |
| cd its/plugin | |
| mvn package --batch-mode -Pit-plugin -Dsonar.runtimeVersion=${{ matrix.sq_version }} -Dmaven.test.redirectTestOutputToFile=false -B -e -V -Dparallel=classes -DuseUnlimitedThreads=true | |
| sanity: | |
| name: Sanity Test | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: github-ubuntu-latest-m | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - uses: SonarSource/vault-action-wrapper@v3 | |
| id: secrets | |
| with: | |
| secrets: | | |
| development/kv/data/next url | SONAR_HOST_URL; | |
| development/kv/data/next token | SONAR_TOKEN; | |
| - name: Compile Test Sources | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| working-directory: java-checks-test-sources | |
| run: | | |
| mvn clean compile --batch-mode | |
| - uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| deploy: false | |
| artifactory-reader-role: private-reader | |
| artifactory-deployer-role: qa-deployer | |
| - name: Sanity Test | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| run: | | |
| mvn verify --batch-mode -f sonar-java-plugin/pom.xml -Psanity -Dtest=SanityTest | |
| test-analyze: | |
| name: Test Analyze | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: github-ubuntu-latest-m | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - uses: SonarSource/vault-action-wrapper@v3 | |
| id: secrets | |
| with: | |
| secrets: | | |
| development/kv/data/next url | SONAR_HOST_URL; | |
| development/kv/data/next token | SONAR_TOKEN; | |
| - name: Test Analyze | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| run: | | |
| # ignore duplications in the SE engine plugin, as it will be moved away from sonar-java at some point | |
| PULL_REQUEST_SHA=$GIT_SHA1 mvn clean verify sonar:sonar --batch-mode -P-deploy-sonarsource,-release,-sign -Dmaven.deploy.skip=true -Dsonar.analysisCache.enabled=true -Dsonar.sca.exclusions="**/test/files/**, **/test/resources/**, its/plugin/projects/**, java-checks-test-sources/**, its/sources/**," | |
| - name: Build Java Custom Rules Example | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| working-directory: docs/java-custom-rules-example | |
| run: | | |
| mvn clean package -f pom_SQ_10_6_LATEST.xml --batch-mode | |
| - name: Check License Compliance | |
| run: | | |
| # See https://xtranet.sonarsource.com/display/DEV/Open+Source+Licenses | |
| mvn org.codehaus.mojo:license-maven-plugin:aggregate-add-third-party \ | |
| --batch-mode \ | |
| "-Dlicense.missingFile=${PWD}/missing-dep-licenses.properties" \ | |
| -DuseMissingFile \ | |
| "-Dlicense.overrideUrl=file://${PWD}/override-dep-licenses.properties" | |
| autoscan: | |
| name: Autoscan Tests | |
| needs: | |
| - build | |
| if: ${{ needs.build.outputs.deployed }} | |
| runs-on: github-ubuntu-latest-m | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| BUILD_NUMBER: ${{ needs.build.outputs.build-number }} | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| # For now, the autoscan job need to execute two mvn commands: | |
| # * The build of java-checks-test-sources module which requires Java 24. | |
| # * The tests using Orchestrator and SonarQube that, for now, fail to work using Java 24 | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - uses: SonarSource/vault-action-wrapper@v3 | |
| id: secrets | |
| with: | |
| secrets: | | |
| development/kv/data/next url | SONAR_HOST_URL; | |
| development/kv/data/next token | SONAR_TOKEN; | |
| development/github/token/licenses-ro token | GITHUB_TOKEN; | |
| - name: Compile Test Sources | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| working-directory: java-checks-test-sources | |
| run: | | |
| mvn clean compile test-compile --batch-mode | |
| - name: Select Java 17 | |
| run: mise use java@17 | |
| - uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| deploy: false | |
| artifactory-reader-role: private-reader | |
| artifactory-deployer-role: qa-deployer | |
| - name: Run autoscan tests | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }} | |
| working-directory: its/autoscan | |
| run: > | |
| mvn clean package --batch-mode --errors --show-version | |
| --activate-profiles it-autoscan | |
| -Dsonar.runtimeVersion=LATEST_RELEASE | |
| -Dmaven.test.redirectTestOutputToFile=false | |
| -Dparallel=methods | |
| -DuseUnlimitedThreads=true | |
| qa-os-win-old: | |
| runs-on: github-windows-latest-m | |
| permissions: | |
| id-token: write # Required for Vault OIDC authentication | |
| contents: write # Required for repository access and tagging | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - name: Run Script and Maven | |
| run: | | |
| .cirrus/install-latest-java-on-windows.ps1 ; if ($?) { & mvn.cmd --batch-mode clean verify } | |
| qa-os-win-new: | |
| runs-on: github-windows-latest-m | |
| permissions: | |
| id-token: write # Required for Vault OIDC authentication | |
| contents: write # Required for repository access and tagging | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - uses: SonarSource/ci-github-actions/build-maven@v1 | |
| id: build-maven | |
| with: | |
| deploy: false | |
| artifactory-reader-role: private-reader | |
| artifactory-deployer-role: qa-deployer | |
| maven-args: > | |
| -Dsonar.skip=true | |
| qa-os-win-new-on-linux: | |
| runs-on: github-ubuntu-latest-m | |
| permissions: | |
| id-token: write # Required for Vault OIDC authentication | |
| contents: write # Required for repository access and tagging | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - uses: SonarSource/ci-github-actions/build-maven@v1 | |
| id: build-maven | |
| with: | |
| deploy: false | |
| artifactory-reader-role: private-reader | |
| artifactory-deployer-role: qa-deployer | |
| maven-args: > | |
| -Dsonar.skip=true | |
| windows-info: | |
| runs-on: github-windows-latest-m | |
| permissions: | |
| id-token: write # Required for Vault OIDC authentication | |
| contents: write # Required for repository access and tagging | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 | |
| with: | |
| version: 2025.7.12 | |
| - name: Info | |
| run: | | |
| java -version | |
| mvn --version | |
| mvn help:system --batch-mode | |
| mvn dependency:tree --batch-mode |