chore(ci): add SonarQube analysis (advisory) and Harbor deployment config - #23
Open
emmanuelbruno wants to merge 5 commits into
Open
emmanuelbruno wants to merge 5 commits into
emmanuelbruno wants to merge 5 commits into
Conversation
- sonar-project.properties: Python/Shell analysis scope, coverage.xml, quality gate wait - .github/workflows/sonarqube.yml: IJava-pattern scan (PR/branch/main scan args, vars-based activation, in-cluster runner support) - deployments/harbor/values.yaml: phase-1 Harbor Helm values (internal PG/Redis, ingress+cert-manager, Trivy on)
…icate coverage - sonar.projectKey/projectName: jupyter-base → solen - SONAR_MAIN_BRANCH default: main → develop - ci-validate: add coverage + upload artifact - sonarqube: download coverage artifact with pytest fallback
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟡 Changes recommended
Critical security concerns and multiple configuration issues remain in the SonarQube workflow and Harbor values.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds advisory SonarQube analysis and coverage reporting, plus Harbor Helm deployment configuration.
Changes:
- Adds SonarQube project metadata and workflow.
- Generates and uploads CI coverage artifacts.
- Adds Harbor ingress, storage, database, Redis, and Trivy settings.
File summaries
| File | Description |
|---|---|
sonar-project.properties |
SonarQube analysis configuration |
deployments/harbor/values.yaml |
Harbor Helm deployment values |
.github/workflows/sonarqube.yml |
SonarQube scanning workflow |
.github/workflows/ci-validate.yml |
Coverage generation and artifact upload |
Review details
Suppressed comments (2)
.github/workflows/sonarqube.yml:95
- Only the quality-gate polling step is marked
continue-on-error. A scanner failure (for example an unreachable SonarQube server, invalid project configuration, or analysis error) still fails this PR workflow, which contradicts the stated advisory/non-blocking behavior and can block merges if the check is required. Make the analysis path explicitly best-effort, or separate hard configuration/test failures from the advisory scan.
- name: SonarQube Scan
uses: sonarsource/sonarqube-scan-action@v6
with:
args: ${{ env.SONAR_SCAN_ARGS }}
deployments/harbor/values.yaml:16
- Even after correcting the parent key, Harbor's TLS values use
certSource(autoorsecret);certManagerandnotAfterare not recognized chart settings. These entries therefore will not request a cert-manager certificate.
tls:
enabled: true
certManager: true
notAfter: 21d
- Files reviewed: 4/4 changed files
- Comments generated: 12
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| sonarqube: | ||
| name: Analyze with SonarQube | ||
| if: github.event_name == 'workflow_dispatch' || vars.SONAR_HOST_URL != '' || vars.SONAR_PUBLIC_URL != '' | ||
| runs-on: ${{ vars.SONAR_RUNNER || 'ubuntu-latest' }} |
| runs-on: ${{ vars.SONAR_RUNNER || 'ubuntu-latest' }} | ||
| env: | ||
| SONAR_HOST_URL: ${{ vars.SONAR_RUNNER && vars.SONAR_HOST_URL || vars.SONAR_PUBLIC_URL || vars.SONAR_HOST_URL }} | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |
Comment on lines
+38
to
+41
| image: | ||
| registry: docker.io | ||
| repository: aquasec/trivy | ||
| tag: v0.51.2 |
| jobs: | ||
| sonarqube: | ||
| name: Analyze with SonarQube | ||
| if: github.event_name == 'workflow_dispatch' || vars.SONAR_HOST_URL != '' || vars.SONAR_PUBLIC_URL != '' |
Comment on lines
+59
to
+63
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: coverage | ||
| path: . | ||
| github-token: ${{ github.token }} |
| redis: | ||
| enabled: true | ||
|
|
||
| exposure: |
| notAfter: 21d | ||
| ingress: | ||
| hosts: | ||
| core: registry.ebpro.local |
Comment on lines
+23
to
+28
| volumes: | ||
| - registry storage: | ||
| type: persistentVolumeClaim | ||
| persistentVolumeClaim: | ||
| size: 30Gi | ||
| accessMode: ReadWriteOnce |
Comment on lines
+30
to
+32
| jobService: | ||
| jobLog: | ||
| persistentVolume: |
Comment on lines
+44
to
+45
| resourcesRequests: | ||
| memory: 512Mi |
- values.yaml: rewrite with correct goharbor/harbor chart keys (expose, database.internal, redis.internal, persistence.persistentVolumeClaim, externalURL, trivy severity/resources) - sonarqube.yml: add permissions block, scope SONAR_TOKEN to scan/gate steps only, remove dead cross-workflow artifact download
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds SonarQube CI integration (advisory mode) and Harbor deployment configuration to the solen project.
Changes
SonarQube (advisory — does not block PRs)
sonar-project.properties: project keycom.ebpro:solen, sources = solen-cli, scripts, features.github/workflows/sonarqube.yml: full analysis workflow with:continue-on-error: true) — reports issues but never fails CIdevelop.github/workflows/ci-validate.yml: now produces coverage.xml + uploads as artifactHarbor
deployments/harbor/values.yaml: Helm values for deploying a Harbor registry instanceregistry.ebpro.localwith TLS (cert-manager)CHANGE-MEplaceholders (replace with secrets at deploy time)Notes
solen) will be created via Harbor API after instance deploymentjupyter-base→solennaming migration (repo rename, GHCR, 18 consumer repos) is tracked as a separate future epic