AS-5461: Added sonarqube scanning to PR, commit and workflows

.github/workflows/ds-release.yml

@@ -0,0 +1,26 @@
+name: DS Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  create-release:
+    permissions: write-all
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up JDK 17
+        uses: actions/setup-java@v2
+        with:
+          java-version: '17'
+          distribution: 'adopt'
+      - name: Build with Maven
+        run: mvn -B package -DskipTests -Dcheckstyle.skip
+      - uses: ncipollo/release-action@v1
+        with:
+          artifacts: "**/target/*.nar"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          generateReleaseNotes: true

.github/workflows/pr-test.yml

@@ -4,7 +4,7 @@ on:
   pull_request:
   push:
     branches:
-      - master
+      - 3.2_ds
 
 jobs:
   build:

.github/workflows/release.yml

@@ -36,7 +36,7 @@ jobs:
             PULSAR_VERSION=`mvn -q -Dexec.executable=echo -Dexec.args='${pulsar.version}' --non-recursive exec:exec 2>/dev/null`
             REPO=`mvn -q -Dexec.executable=echo -Dexec.args='${project.artifactId}' --non-recursive exec:exec 2>/dev/null`
             IMAGE_REPO=streamnative/${REPO}
-            RUNNER_IMAGE=docker.cloudsmith.io/streamnative/staging/pulsar-functions-java-runner:${PULSAR_VERSION}
+            RUNNER_IMAGE=streamnative/pulsar-functions-java-runner:${PULSAR_VERSION}
             docker pull ${RUNNER_IMAGE}
             docker build --build-arg PULSAR_VERSION="$PULSAR_VERSION" -t ${IMAGE_REPO}:${CONNECTOR_VERSION} -f ./image/Dockerfile ./
             docker push ${IMAGE_REPO}:${CONNECTOR_VERSION}

.github/workflows/sonarqube.yaml

@@ -0,0 +1,106 @@
+name: SonarQube Scan
+
+on:
+  push:
+    branches:
+      - 4.0_ds
+      - 3.2_ds
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - 4.0_ds
+      - 3.2_ds
+  workflow_dispatch:
+    inputs:
+      scan_type:
+        description: 'Type of scan to run'
+        required: true
+        type: choice
+        options:
+          - branch
+          - pr
+        default: branch
+      ref:
+        description: 'Commit SHA, branch, or tag to check out and scan (leave blank to use the default branch)'
+        required: false
+        type: string
+        default: ''
+
+concurrency:
+  group: sonarqube-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  TRUSTSTORE_PATH: ./ibm_castorevpcprod
+  # Maven tuning — mirrors settings used across the rest of the CI workflows.
+  MAVEN_OPTS: >-
+    -Xss1500k
+    -Xmx2048m
+    -XX:+UnlockDiagnosticVMOptions
+    -XX:+IgnoreUnrecognizedVMOptions
+    -XX:GCLockerRetryAllocationCount=100
+    -Daether.connector.http.reuseConnections=false
+    -Daether.connector.requestTimeout=60000
+    -Dhttp.keepAlive=false
+    -Dmaven.wagon.http.pool=false
+    -Dmaven.wagon.http.retryHandler.class=standard
+    -Dmaven.wagon.http.retryHandler.count=3
+    -Dmaven.wagon.http.retryHandler.requestSentEnabled=true
+    -Dmaven.wagon.http.serviceUnavailableRetryStrategy.class=standard
+    -Dmaven.wagon.rto=60000
+
+jobs:
+  sonarqube-scan:
+    name: SonarQube Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          # Full history required for accurate blame and new-code period detection.
+          fetch-depth: 0
+          # When triggered manually with a specific ref (commit SHA, branch, tag),
+          # check out that ref; otherwise fall back to the default event ref.
+          ref: ${{ (github.event_name == 'workflow_dispatch' && inputs.ref != '') && inputs.ref || github.ref }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: corretto
+          java-version: '17'
+          cache: maven
+
+      # Decode the IBM truststore from the base64 secret and write it to disk.
+      # Secret is bound to an env var to avoid shell-injection (S7636).
+      - name: Decode IBM SonarQube truststore
+        env:
+          TRUSTSTORE_B64: ${{ secrets.IBM_SONARQUBE_CERT_TRUSTSTORE_BASE64 }}
+        run: |
+          echo "$TRUSTSTORE_B64" | base64 --decode > "${{ env.TRUSTSTORE_PATH }}"
+
+      # Produce .class files required by SonarQube's Java bytecode analyser.
+      - name: Build
+        run: mvn -B package -DskipTests --no-transfer-progress
+
+      # Pinned to v8.2.1 (SHA: 22918119ff8e1ca75a623e15c8296b6ea4fbe28f).
+      - name: Run SonarQube scan
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f
+        env:
+          SONAR_TOKEN: ${{ secrets.IBM_SONARQUBE_API_TOKEN }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+        with:
+          args: >
+            -D sonar.projectKey=${{ vars.SONAR_PROJECT_KEY }}
+            -D sonar.projectName=${{ vars.SONAR_PROJECT_NAME }}
+            -D sonar.java.source=17
+            -D sonar.sources=.
+            -D sonar.exclusions=**/proto/**,**/shade/**,**/shaded/**,**/target/**
+            -D sonar.java.binaries=**/target/classes
+            -D sonar.scanner.truststorePath=${{ env.TRUSTSTORE_PATH }}
+            -D sonar.scanner.truststorePassword=${{ secrets.IBM_SONARQUBE_CERT_PASSWORD }}
+            ${{ (github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.scan_type == 'pr'))
+                && format('-Dsonar.pullrequest.key={0} -Dsonar.pullrequest.branch={1} -Dsonar.pullrequest.base={2}',
+                          github.event.pull_request.number, github.head_ref, github.base_ref)
+                || format('-Dsonar.branch.name={0}',
+                          (github.event_name == 'workflow_dispatch' && inputs.ref != '') && inputs.ref || github.ref_name) }}

image/Dockerfile

@@ -18,5 +18,5 @@
 #
 
 ARG PULSAR_VERSION
-FROM docker.cloudsmith.io/streamnative/staging/pulsar-functions-java-runner:${PULSAR_VERSION}
+FROM streamnative/pulsar-functions-java-runner:${PULSAR_VERSION}
 COPY --chown=$UID:$GID target/*.nar /pulsar/connectors/