ci: add SonarCloud continuous inspection by don-petry · Pull Request #31 · oneirosoft/dagger

don-petry · 2026-03-31T02:48:49Z

Why?

SonarCloud provides continuous code quality inspection — tracking bugs, code smells, security vulnerabilities, and test coverage over time. Unlike one-shot linters, it maintains a historical baseline so quality trends are visible and regressions are caught as they happen.

Summary

Adds sonar-project.properties with project configuration for SonarCloud
Adds .github/workflows/sonarcloud.yml GitHub Actions workflow that runs SonarCloud analysis on pushes to main and on pull requests
Fork PRs are handled gracefully — the scan step is skipped when SONAR_TOKEN is unavailable

Relates to #11 (item 9 — SonarCloud / SonarQube integration).

Maintainer setup required

Create a SonarCloud account at sonarcloud.io and import the oneirosoft/dagger repository
Add the SONAR_TOKEN secret to the GitHub repository settings (Settings → Secrets and variables → Actions → New repository secret)

Test plan

Verify the workflow triggers on push to main and on PRs
Confirm SonarCloud scan completes successfully once the token is configured

🤖 Generated with Claude Code

Add SonarCloud configuration and GitHub Actions workflow for automated code quality analysis on pushes to main and pull requests. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds SonarCloud continuous inspection to the repository by introducing a standard SonarCloud project configuration file and a dedicated GitHub Actions workflow to run scans on main and on pull requests.

Changes:

Add sonar-project.properties to define SonarCloud project/org and analysis scope.
Add .github/workflows/sonarcloud.yml to run SonarCloud analysis in CI on pushes to main and PR updates.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`sonar-project.properties`	Defines SonarCloud project settings and what paths to analyze/exclude.
`.github/workflows/sonarcloud.yml`	Introduces a CI workflow job to execute the SonarCloud scan action.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-31T02:51:55Z

+sonar.sources=src
+sonar.tests=tests
+sonar.sourceEncoding=UTF-8
+sonar.exclusions=**/test_support.rs


sonar.tests=tests won’t classify the repo’s unit test files under src/core/**/tests.rs as tests, so SonarCloud will analyze them as production sources and skew metrics (bugs/smells/coverage on “new code”). Consider either adding those paths via sonar.tests + sonar.test.inclusions (e.g., matching src/**/tests.rs) or excluding src/**/tests.rs from sonar.sources using sonar.exclusions.

Suggested change

sonar.exclusions=**/test_support.rs

sonar.exclusions=**/test_support.rs

sonar.test.inclusions=src/**/tests.rs

Addressed — removed sonar.tests since Rust unit tests live alongside source code in #[cfg(test)] modules, not in a separate directory.

Copilot · 2026-03-31T02:51:55Z

+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}


This workflow will fail on pull requests from forks because secrets.SONAR_TOKEN is not provided for forked PRs, causing the scan step to error and the PR check to go red. To avoid blocking external contributors, add a job/step if: guard to only run when the PR originates from the same repo (or when secrets.SONAR_TOKEN is set), or make the scan non-blocking for forked PRs.

The if: ${{ env.SONAR_TOKEN \!= '' }} guard on the scan step already handles this — when the secret is unavailable on fork PRs, the step is skipped and the job succeeds. This matches the pattern used across all petry-projects repos.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

don-petry

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: 4e2a983886aff4ef1632d7bb11487f7a341e7d13
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

This PR adds SonarCloud continuous inspection via a GitHub Actions workflow and a sonar-project.properties config file. Security posture is solid: actions are SHA-pinned, permissions follow least-privilege, pull_request trigger (not pull_request_target) is used safely, and the SONAR_TOKEN is properly guarded so fork PRs are handled gracefully. One minor concern is a misleading version comment on the actions/checkout pin (labels it v6 but v4 is the latest stable release), which reduces auditability without introducing actual supply-chain risk since the SHA is the binding mechanism.

Findings

Minor

[minor] .github/workflows/sonarcloud.yml:21 — actions/checkout is pinned to SHA de0fac2e4500dabe0009e67214ff5f5447ce83dd with the comment # v6, but actions/checkout only goes up to v4 as of April 2026. The comment is misleading and should be corrected to the actual release tag the SHA corresponds to. SHA pinning still provides supply-chain protection, but inaccurate comments impede future audits.
[minor] .github/workflows/sonarcloud.yml:25 — SonarSource/sonarqube-scan-action is pinned to SHA fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 with # v6. Recommend verifying this SHA matches the intended release tag for auditability.

Info

[info] sonar-project.properties:6 — sonar.exclusions includes a single specific file (test_support.rs) rather than a pattern. If additional test-support files are added in the future, each would need to be manually appended. Consider using a pattern like **/*test_support* or a dedicated test directory excluded via sonar.test.inclusions.
[info] CI status — No CI status checks were observed in statusCheckRollup — either no CI runs have completed for this PR, or checks are not yet wired up. Merge is currently blocked (mergeStateStatus=BLOCKED). Once the SONAR_TOKEN secret is configured per the PR's maintainer setup instructions, the workflow should begin reporting.
[info] .github/workflows/sonarcloud.yml:3 — Workflow correctly uses permissions: {} at the top level and grants only contents:read and pull-requests:read at the job level. This is a best-practice least-privilege posture for a read-only analysis workflow.
[info] .github/workflows/sonarcloud.yml:24 — The workflow uses pull_request (not pull_request_target), so fork PRs run in the fork's context without access to repo secrets. The conditional if: env.SONAR_TOKEN != "" gracefully skips the scan for fork PRs where the secret is unavailable. This is the correct pattern.

CI status

No CI checks have reported yet for this PR (mergeStateStatus=BLOCKED). The SonarCloud workflow will begin reporting once the SONAR_TOKEN secret is configured in the repository settings.

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

ci: add SonarCloud continuous inspection

1fe5fb4

Add SonarCloud configuration and GitHub Actions workflow for automated code quality analysis on pushes to main and pull requests. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings March 31, 2026 02:48

Copilot started reviewing on behalf of don-petry March 31, 2026 02:49 View session

don-petry mentioned this pull request Mar 31, 2026

CI & quality gate improvements #11

Closed

Copilot AI reviewed Mar 31, 2026

View reviewed changes

DJ and others added 2 commits March 30, 2026 20:09

fix: align SonarCloud config with petry-projects org standards

6e95aef

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: remove sonar.tests and address fork PR concerns

4e2a983

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

don-petry commented Apr 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add SonarCloud continuous inspection#31

ci: add SonarCloud continuous inspection#31
don-petry wants to merge 3 commits intooneirosoft:mainfrom
don-petry:ci/sonarcloud

don-petry commented Mar 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

don-petry Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

don-petry Mar 31, 2026

Uh oh!

don-petry left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	sonar.exclusions=**/test_support.rs
	sonar.exclusions=**/test_support.rs
	sonar.test.inclusions=src/**/tests.rs

Conversation

don-petry commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why?

Summary

Maintainer setup required

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry left a comment

Choose a reason for hiding this comment

Automated review — APPROVED

Summary

Findings

Minor

Info

CI status

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

don-petry commented Mar 31, 2026 •

edited

Loading