JS-2209 Support AWS CDK assertions in S8784 #7876
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - branch-* | |
| - dogfood-* | |
| pull_request: | |
| merge_group: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' # Nightly for analysis, IRIS, and generated file freshness | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| setup: | |
| runs-on: sonar-xs | |
| name: Setup - Prepare Node.js versions and test hashes | |
| permissions: &read_permissions | |
| id-token: write | |
| contents: read | |
| outputs: | |
| node-matrix: ${{ steps.generate-matrix.outputs.matrix }} | |
| js-files-hash: ${{ steps.compute-js-hash.outputs.hash }} | |
| maven-hash: ${{ steps.compute-maven-hash.outputs.hash }} | |
| npm-hash: ${{ steps.compute-npm-hash.outputs.hash }} | |
| cache-month: ${{ steps.cache-month.outputs.month }} | |
| is-default-branch: ${{ github.ref_name == github.event.repository.default_branch }} | |
| steps: | |
| - &checkout | |
| name: Checkout source code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Generate Node.js version matrix from package.json | |
| id: generate-matrix | |
| run: | | |
| # Extract node version range from package.json and parse versions with jq | |
| MATRIX=$(jq -c '{ | |
| "node-version": ( | |
| .engines.node | |
| | split(" || ") | |
| | map(gsub("^[~^>=<]+"; "")) | |
| ) | |
| }' package.json) | |
| echo "matrix=$MATRIX" >> $GITHUB_OUTPUT | |
| echo "Generated Node.js version matrix from package.json: $MATRIX" | |
| - name: Compute JS test hash for skip caching | |
| id: compute-js-hash | |
| run: | | |
| HASH=$(find .github/workflows/build.yml packages patches sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules tools typings .nycrc package.json package-lock.json server.mjs -type f 2>/dev/null | sort | xargs sha256sum | sha256sum | cut -d' ' -f1) | |
| echo "hash=$HASH" >> $GITHUB_OUTPUT | |
| echo "Computed JS test hash: $HASH" | |
| - name: Compute Maven hash for cache key | |
| id: compute-maven-hash | |
| run: | | |
| HASH=$(find . -name 'pom.xml' -type f | sort | xargs sha256sum | sha256sum | cut -d' ' -f1) | |
| echo "hash=$HASH" >> $GITHUB_OUTPUT | |
| echo "Computed Maven hash: $HASH" | |
| - name: Compute NPM hash for cache key | |
| id: compute-npm-hash | |
| run: | | |
| HASH=$(sha256sum package-lock.json patches/* 2>/dev/null | sha256sum | cut -d' ' -f1) | |
| echo "hash=$HASH" >> $GITHUB_OUTPUT | |
| echo "Computed NPM hash: $HASH" | |
| - name: Compute cache month for periodic reset | |
| id: cache-month | |
| run: | | |
| MONTH=$(date +'%Y-%m') | |
| echo "month=$MONTH" >> $GITHUB_OUTPUT | |
| echo "Cache month: $MONTH" | |
| get_build_number: | |
| runs-on: sonar-xs | |
| name: Get build number | |
| needs: setup | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| outputs: | |
| build-number: ${{ steps.build-number.outputs.BUILD_NUMBER }} | |
| steps: | |
| - id: build-number | |
| uses: SonarSource/ci-github-actions/get-build-number@v1 | |
| populate_npm_cache: | |
| runs-on: sonar-xs | |
| name: Populate NPM cache for Linux | |
| needs: [setup, get_build_number] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: &shared_build_number | |
| # Reuse the build number minted once in get_build_number everywhere workflow metadata is configured or promoted. | |
| BUILD_NUMBER: ${{ needs.get_build_number.outputs.build-number }} | |
| steps: &populate_npm_cache_steps | |
| # Producer jobs need a lookup-only probe that still saves a freshly populated cache at job end. | |
| - name: Check NPM dependencies cache | |
| id: cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: node_modules | |
| key: npm-${{ runner.os }}-${{ needs.setup.outputs.npm-hash }} | |
| lookup-only: true | |
| - name: Checkout source code | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: ${{ needs.setup.outputs.is-default-branch == 'true' }} | |
| mise_toml: | | |
| [tools] | |
| java = "21.0" | |
| maven = "3.9" | |
| node = "24.11.0" | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| id: secrets | |
| name: Access vault secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/artifactory/token/${{ github.repository_owner }}-${{ github.event.repository.name }}-private-reader access_token | ARTIFACTORY_ACCESS_TOKEN; | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| name: Configure npm registry | |
| run: | | |
| npm config set //repox.jfrog.io/artifactory/api/npm/:_authToken=${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }} | |
| npm config set registry https://repox.jfrog.io/artifactory/api/npm/npm/ | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| name: Install NPM dependencies | |
| run: npm ci | |
| populate_npm_cache_win: | |
| runs-on: github-windows-latest-s | |
| name: Populate NPM cache for Windows | |
| needs: [setup, get_build_number] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: *populate_npm_cache_steps | |
| build: | |
| runs-on: sonar-l | |
| name: Build SonarJS on Linux | |
| needs: [setup, get_build_number, populate_npm_cache, prepare_rspec_rule_data] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - &mise | |
| uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: ${{ needs.setup.outputs.is-default-branch == 'true' }} | |
| mise_toml: | | |
| [tools] | |
| java = "21.0" | |
| maven = "3.9" | |
| node = "24.11.0" | |
| - &npm_cache | |
| name: Restore NPM dependencies | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: node_modules | |
| key: npm-${{ runner.os }}-${{ needs.setup.outputs.npm-hash }} | |
| fail-on-cache-miss: true | |
| - &download_rspec_rule_data | |
| name: Download prepared RSPEC rule data | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: rspec-rule-data-${{ github.sha }} | |
| path: sonar-plugin | |
| - &maven_cache | |
| uses: ./.github/actions/maven-cache | |
| with: | |
| cache-month: ${{ needs.setup.outputs.cache-month }} | |
| maven-hash: ${{ needs.setup.outputs.maven-hash }} | |
| - &cyclonedx_cli_cache | |
| name: Cache CycloneDX CLI | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.cache/cyclonedx-cli | |
| key: cyclonedx-cli-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('tools/merge-cyclonedx-bom.sh') }} | |
| - &config_maven | |
| name: Configure Maven | |
| id: config-maven | |
| uses: SonarSource/ci-github-actions/config-maven@v1 | |
| with: | |
| artifactory-reader-role: private-reader | |
| disable-caching: 'true' | |
| - id: deployer-secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/artifactory/token/{REPO_OWNER_NAME_DASH}-qa-deployer username | ARTIFACTORY_DEPLOY_USERNAME; | |
| development/artifactory/token/{REPO_OWNER_NAME_DASH}-qa-deployer access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN; | |
| development/kv/data/sign key | SIGN_KEY; | |
| development/kv/data/sign passphrase | PGP_PASSPHRASE; | |
| - name: Build, test and deploy Maven artifacts | |
| run: mvn deploy -Pdeploy-sonarsource,coverage,sign,release,sbom -T1C | |
| env: | |
| ARTIFACTORY_DEPLOY_USERNAME: ${{ fromJSON(steps.deployer-secrets.outputs.vault).ARTIFACTORY_DEPLOY_USERNAME }} | |
| ARTIFACTORY_DEPLOY_PASSWORD: ${{ fromJSON(steps.deployer-secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }} | |
| ARTIFACTORY_DEPLOY_REPO: sonarsource-public-qa | |
| SIGN_KEY: ${{ fromJSON(steps.deployer-secrets.outputs.vault).SIGN_KEY }} | |
| PGP_PASSPHRASE: ${{ fromJSON(steps.deployer-secrets.outputs.vault).PGP_PASSPHRASE }} | |
| - name: Upload SonarJS artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: sonarjs-m2 | |
| path: ~/.m2/repository/org/sonarsource/javascript | |
| retention-days: 1 | |
| - name: Upload Maven target artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: maven-targets-${{ github.sha }} | |
| path: | | |
| **/target/ | |
| !**/target/site/ | |
| retention-days: 1 | |
| - &upload_jacoco_xml_reports | |
| name: Upload JaCoCo XML reports | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: jacoco-xml-reports-${{ github.sha }} | |
| path: sonar-plugin/**/target/site/jacoco/jacoco.xml | |
| retention-days: 1 | |
| # Clean up SonarJS artifacts before post-job cache save (only on default branch where cache is saved) | |
| - name: Clean up SonarJS artifacts before cache save | |
| if: github.ref_name == github.event.repository.default_branch | |
| run: rm -rf ~/.m2/repository/org/sonarsource/javascript | |
| # Windows builds and tests | |
| build_win: | |
| runs-on: github-windows-latest-m | |
| name: Build SonarJS on Windows | |
| needs: [setup, get_build_number, populate_npm_cache_win, prepare_rspec_rule_data] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - *mise | |
| - *npm_cache | |
| - *download_rspec_rule_data | |
| - *maven_cache | |
| - *cyclonedx_cli_cache | |
| - *config_maven | |
| - name: Build and test Maven (no deploy) | |
| run: mvn verify -Psbom -T1C | |
| prepare_rspec_rule_data: | |
| runs-on: sonar-xs | |
| name: Prepare RSPEC rule data | |
| needs: [setup, populate_npm_cache] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| steps: | |
| - *checkout | |
| - *mise | |
| - *npm_cache | |
| - *maven_cache | |
| - uses: ./.github/actions/rule-api-cache | |
| - *config_maven | |
| - id: rspec-secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/github/token/{REPO_OWNER_NAME_DASH}-rspec token | RSPEC_GITHUB_TOKEN; | |
| - name: Refresh and deploy RSPEC rule data | |
| run: npm run rspec:refresh | |
| env: | |
| GITHUB_TOKEN: ${{ fromJSON(steps.rspec-secrets.outputs.vault).RSPEC_GITHUB_TOKEN }} | |
| - name: Upload prepared RSPEC rule data | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: rspec-rule-data-${{ github.sha }} | |
| path: | | |
| sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript | |
| sonar-plugin/javascript-checks/src/main/resources/rspec.sha | |
| sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css | |
| sonar-plugin/css/src/main/resources/rspec.sha | |
| retention-days: 1 | |
| build_eslint_plugin: | |
| runs-on: github-ubuntu-latest-s | |
| needs: [setup, prepare_rspec_rule_data] | |
| name: Build ESLint Plugin | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| steps: | |
| - *checkout | |
| - *mise | |
| - *npm_cache | |
| - id: secrets | |
| name: Access vault secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/artifactory/token/${{ github.repository_owner }}-${{ github.event.repository.name }}-private-reader access_token | ARTIFACTORY_ACCESS_TOKEN; | |
| - name: Configure npm registry | |
| run: | | |
| npm config set //repox.jfrog.io/artifactory/api/npm/:_authToken=${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }} | |
| npm config set registry https://repox.jfrog.io/artifactory/api/npm/npm/ | |
| - *download_rspec_rule_data | |
| - name: Build ESLint plugin | |
| run: npm run eslint-plugin:build | |
| - name: Upload ESLint plugin tarball | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: eslint-tarball-${{ github.sha }} | |
| path: lib/eslint-plugin-sonarjs-0.0.0-SNAPSHOT.tgz | |
| if-no-files-found: error | |
| retention-days: 1 | |
| generated_files_freshness: | |
| runs-on: github-ubuntu-latest-s | |
| needs: [setup, populate_npm_cache, prepare_rspec_rule_data] | |
| name: Generated Files Freshness | |
| if: github.event_name == 'schedule' | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - *checkout | |
| - *mise | |
| - id: secrets | |
| name: Access vault secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/artifactory/token/${{ github.repository_owner }}-${{ github.event.repository.name }}-private-reader access_token | ARTIFACTORY_ACCESS_TOKEN; | |
| - name: Configure npm registry | |
| run: | | |
| npm config set //repox.jfrog.io/artifactory/api/npm/:_authToken=${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }} | |
| npm config set registry https://repox.jfrog.io/artifactory/api/npm/npm/ | |
| - *npm_cache | |
| - *download_rspec_rule_data | |
| - name: Regenerate tracked generated files | |
| run: | | |
| npm install --no-save builtin-modules@3.3.0 | |
| npm run eslint-plugin:compile | |
| npm run count-rules | |
| - name: Open or update generated files refresh PR | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | |
| commit-message: Update generated README files and RSPEC JSON | |
| title: Update generated README files and RSPEC JSON | |
| body: | | |
| Automated refresh of generated README files and tracked RSPEC JSON resources. | |
| Updated paths: | |
| - `README.md` | |
| - `packages/analysis/src/jsts/rules/README.md` | |
| - `sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/*.json` | |
| - `sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/*.json` | |
| If this PR is created without CI, please click GitHub's `Approve workflows` button. | |
| If that still does not start CI, close and reopen the PR to retrigger it. | |
| branch: bot/update-generated-files | |
| base: master | |
| add-paths: | | |
| README.md | |
| packages/analysis/src/jsts/rules/README.md | |
| sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/*.json | |
| sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/*.json | |
| delete-branch: true | |
| test_eslint_plugin: | |
| runs-on: github-ubuntu-latest-s | |
| name: ESLint Plugin Test - ESLint ${{ matrix.eslint-version }} Node ${{ matrix.node-version }} | |
| needs: [setup, build_eslint_plugin] | |
| permissions: *read_permissions | |
| strategy: | |
| matrix: | |
| include: | |
| - eslint-version: 10 | |
| node-version: '20.19.0' | |
| node-label: 'min supported' | |
| - eslint-version: 9 | |
| node-version: '18.18.0' | |
| node-label: 'min supported' | |
| - eslint-version: 8 | |
| node-version: '18.18.0' | |
| node-label: 'min supported' | |
| steps: | |
| - *checkout | |
| - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: ${{ needs.setup.outputs.is-default-branch == 'true' }} | |
| mise_toml: | | |
| [tools] | |
| node = "${{ matrix.node-version }}" | |
| - name: Download ESLint plugin tarball | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: eslint-tarball-${{ github.sha }} | |
| path: lib | |
| - name: Validate ESLint plugin tarball | |
| shell: bash | |
| run: | | |
| TARBALL=lib/eslint-plugin-sonarjs-0.0.0-SNAPSHOT.tgz | |
| if [ ! -f "$TARBALL" ]; then | |
| echo "::error file=$TARBALL::Missing ESLint plugin tarball" | |
| exit 1 | |
| fi | |
| - name: Test ESLint Plugin | |
| run: | | |
| cd its/eslint${{ matrix.eslint-version }}-plugin-sonarjs | |
| npm install --ignore-scripts --fetch-retry-mintimeout=10000 --fetch-retry-maxtimeout=60000 --fetch-retries=3 | |
| npx tsc --noEmit | |
| npm run test | |
| knip: | |
| runs-on: sonar-xs | |
| name: Knip | |
| needs: [setup, populate_npm_cache, prepare_rspec_rule_data] | |
| permissions: *read_permissions | |
| steps: | |
| - *checkout | |
| - *mise | |
| - *npm_cache | |
| - *download_rspec_rule_data | |
| - name: Run knip | |
| run: | | |
| npm run bbf | |
| npx knip | |
| test_js: | |
| runs-on: sonar-m | |
| name: Unit tests JavaScript/TypeScript | |
| needs: [setup, populate_npm_cache, prepare_rspec_rule_data] | |
| permissions: *read_permissions | |
| steps: | |
| - name: Restore JS coverage cache | |
| id: cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: coverage/js | |
| key: js-coverage-${{ runner.os }}-${{ needs.setup.outputs.js-files-hash }} | |
| - name: Checkout source code | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: ${{ needs.setup.outputs.is-default-branch == 'true' }} | |
| mise_toml: | | |
| [tools] | |
| java = "21.0" | |
| maven = "3.9" | |
| node = "24.11.0" | |
| - name: Restore NPM dependencies | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: node_modules | |
| key: npm-${{ runner.os }}-${{ needs.setup.outputs.npm-hash }} | |
| fail-on-cache-miss: true | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| name: Download prepared RSPEC rule data | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: rspec-rule-data-${{ github.sha }} | |
| path: sonar-plugin | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| name: Run JS tests with coverage | |
| run: | | |
| npm run generate-meta | |
| npm run bridge:compile | |
| npm run bridge:test:cov | |
| - &validate_js_coverage_reports | |
| name: Validate JS coverage reports | |
| run: | | |
| for report in coverage/js/lcov.info coverage/js/test-report.xml; do | |
| if [ ! -f "$report" ]; then | |
| echo "::error file=$report::Missing JS coverage report" | |
| exit 1 | |
| fi | |
| done | |
| - name: Upload JS coverage reports | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: js-coverage-reports-${{ github.sha }} | |
| path: | | |
| coverage/js/lcov.info | |
| coverage/js/test-report.xml | |
| if-no-files-found: error | |
| retention-days: 1 | |
| test_js_win: | |
| runs-on: github-windows-latest-m | |
| name: Unit tests JavaScript on Windows | |
| needs: [setup, populate_npm_cache_win, prepare_rspec_rule_data] | |
| permissions: *read_permissions | |
| steps: | |
| - name: Check JS test results marker (Windows) | |
| id: cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: .js-test-marker-win | |
| key: js-test-win-${{ runner.os }}-${{ needs.setup.outputs.js-files-hash }} | |
| lookup-only: true | |
| - name: Checkout source code | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: ${{ needs.setup.outputs.is-default-branch == 'true' }} | |
| mise_toml: | | |
| [tools] | |
| java = "21.0" | |
| maven = "3.9" | |
| node = "24.11.0" | |
| - name: Restore NPM dependencies | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: node_modules | |
| key: npm-${{ runner.os }}-${{ needs.setup.outputs.npm-hash }} | |
| fail-on-cache-miss: true | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| name: Download prepared RSPEC rule data | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: rspec-rule-data-${{ github.sha }} | |
| path: sonar-plugin | |
| - if: steps.cache.outputs.cache-hit != 'true' | |
| name: Run JS tests on Windows | |
| shell: bash | |
| run: | | |
| npm run generate-meta | |
| npm run bridge:compile | |
| npm run bridge:test:js | |
| mkdir -p .js-test-marker-win && touch .js-test-marker-win/success | |
| analyze_primary: | |
| runs-on: sonar-m | |
| name: Analyze in SonarQube NEXT | |
| needs: [setup, get_build_number, test_js, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - &checkout_with_tags | |
| name: Checkout source code with tags | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: '0' | |
| fetch-tags: 'true' | |
| - *mise | |
| - *npm_cache | |
| - *maven_cache | |
| - &download_js_coverage_reports | |
| name: Download JS coverage reports | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: js-coverage-reports-${{ github.sha }} | |
| path: coverage/js | |
| - *validate_js_coverage_reports | |
| - &download_maven_targets | |
| name: Download Maven target artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: maven-targets-${{ github.sha }} | |
| - &download_jacoco_xml_reports | |
| name: Download JaCoCo XML reports | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: jacoco-xml-reports-${{ github.sha }} | |
| path: sonar-plugin | |
| - *config_maven | |
| - id: secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/kv/data/next url | SONAR_URL; | |
| development/kv/data/next token | SONAR_TOKEN; | |
| - name: Run SonarQube analysis on Next | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| run: | | |
| SONAR_ARGS="-Dsonar.host.url=$SONAR_HOST_URL" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.token=$SONAR_TOKEN" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.projectKey=org.sonarsource.javascript:javascript" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.projectVersion=${{ steps.config-maven.outputs.project-version }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.scm.revision=${{ github.sha }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dcommercial" | |
| # Add branch/PR information | |
| if [ "${{ github.event_name }}" == "pull_request" ]; then | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.pullrequest.branch=${{ github.head_ref }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.pullrequest.base=${{ github.base_ref }}" | |
| else | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.branch.name=${{ github.ref_name }}" | |
| fi | |
| mvn org.sonarsource.scanner.maven:sonar-maven-plugin:5.1.0.4751:sonar $SONAR_ARGS | |
| analyze_shadows: | |
| runs-on: sonar-m | |
| name: Analyze in ${{ matrix.platform }} | |
| needs: [setup, get_build_number, test_js, build] | |
| permissions: *read_permissions | |
| if: github.event_name == 'schedule' | |
| env: *shared_build_number | |
| strategy: | |
| matrix: | |
| include: | |
| - platform: SonarCloud EU | |
| sonar-platform: sonarcloud | |
| - platform: SonarQube US | |
| sonar-platform: sonarqube-us | |
| steps: | |
| - *checkout_with_tags | |
| - *mise | |
| - *npm_cache | |
| - *maven_cache | |
| - *download_js_coverage_reports | |
| - *validate_js_coverage_reports | |
| - *download_maven_targets | |
| - *download_jacoco_xml_reports | |
| - *config_maven | |
| - id: secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/kv/data/${{ matrix.sonar-platform }} url | SONAR_URL; | |
| development/kv/data/${{ matrix.sonar-platform }} token | SONAR_TOKEN; | |
| - name: Run SonarQube analysis on ${{ matrix.platform }} | |
| env: | |
| SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_URL }} | |
| SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }} | |
| run: | | |
| SONAR_ARGS="-Dsonar.host.url=$SONAR_HOST_URL" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.token=$SONAR_TOKEN" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.projectKey=SonarSource_SonarJS" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.projectVersion=${{ steps.config-maven.outputs.project-version }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.scm.revision=${{ github.sha }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.organization=sonarsource" | |
| SONAR_ARGS="$SONAR_ARGS -Dcommercial" | |
| # Add branch/PR information | |
| if [ "${{ github.event_name }}" == "pull_request" ]; then | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.pullrequest.branch=${{ github.head_ref }}" | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.pullrequest.base=${{ github.base_ref }}" | |
| else | |
| SONAR_ARGS="$SONAR_ARGS -Dsonar.branch.name=${{ github.ref_name }}" | |
| fi | |
| mvn org.sonarsource.scanner.maven:sonar-maven-plugin:5.1.0.4751:sonar $SONAR_ARGS | |
| plugin_qa_with_node: | |
| runs-on: sonar-m | |
| name: QA with Node ${{ matrix.node-version }} on Ubuntu | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| strategy: | |
| matrix: ${{ fromJson(needs.setup.outputs.node-matrix) }} | |
| steps: | |
| - *checkout | |
| - &mise_java_matrix_node | |
| uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: ${{ needs.setup.outputs.is-default-branch == 'true' }} | |
| mise_toml: | | |
| [tools] | |
| java = "21.0" | |
| maven = "3.9" | |
| node = "${{ matrix.node-version }}" | |
| - *maven_cache | |
| - &download_sonarjs_m2 | |
| name: Download SonarJS artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: sonarjs-m2 | |
| path: ~/.m2/repository/org/sonarsource/javascript | |
| - *config_maven | |
| - &get_licenses_token | |
| id: secrets | |
| uses: SonarSource/vault-action-wrapper@v3 | |
| with: | |
| secrets: | | |
| development/github/token/licenses-ro token | licenses_token; | |
| - &orchestrator_cache | |
| uses: ./.github/actions/orchestrator-cache | |
| - name: Run Plugin QA | |
| run: | | |
| mvn package -f its/plugin/plugins/consumer-plugin/pom.xml | |
| mvn -f its/plugin/sonarlint-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| mvn -f its/plugin/tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| plugin_qa_fast_with_node: | |
| runs-on: sonar-m | |
| name: Fast QA with Node ${{ matrix.node-version }} on Ubuntu | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| strategy: | |
| matrix: ${{ fromJson(needs.setup.outputs.node-matrix) }} | |
| steps: | |
| - *checkout | |
| - *mise_java_matrix_node | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - uses: ./.github/actions/orchestrator-cache | |
| with: | |
| key-prefix: orchestrator-fast | |
| - name: Run Fast Plugin QA | |
| run: | | |
| mvn package -f its/plugin/plugins/pom.xml | |
| mvn -f its/plugin/fast-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| plugin_qa_without_node: | |
| runs-on: sonar-m | |
| name: QA without Node on Ubuntu SQ:LATEST_RELEASE | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - &mise_java_only | |
| name: Setup Java and Maven | |
| uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: ${{ needs.setup.outputs.is-default-branch == 'true' }} | |
| mise_toml: | | |
| [tools] | |
| java = "21.0" | |
| maven = "3.9" | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - &remove_node_from_path | |
| name: Disable existing node | |
| shell: bash | |
| run: | | |
| node --version | |
| function node() { | |
| echo "node is disabled" | |
| exit 0 | |
| } | |
| export -f node | |
| node | |
| - *orchestrator_cache | |
| - name: Run Plugin QA without Node | |
| run: | | |
| mvn package -f its/plugin/plugins/consumer-plugin/pom.xml | |
| mvn -f its/plugin/sonarlint-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| mvn -f its/plugin/tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| SONARJS_ARTIFACT: multi | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| # DEV tests run only on nightly schedule to avoid constant downloads | |
| plugin_qa_without_node_dev: | |
| runs-on: sonar-m | |
| name: QA without Node on Ubuntu SQ:DEV | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name == 'schedule' | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - *mise_java_only | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - *remove_node_from_path | |
| # No orchestrator cache for DEV - version changes too frequently | |
| - name: Run Plugin QA without Node (DEV) | |
| run: | | |
| mvn package -f its/plugin/plugins/consumer-plugin/pom.xml | |
| mvn -f its/plugin/sonarlint-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=DEV -B -e -V verify surefire-report:report | |
| mvn -f its/plugin/tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=DEV -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| SONARJS_ARTIFACT: multi | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| plugin_qa_without_node_alpine: | |
| runs-on: warp-custom-ubuntu-24-04 | |
| name: QA without Node on Alpine SQ:LATEST_RELEASE | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name == 'schedule' | |
| container: | |
| image: alpine/java:22-jdk@sha256:f1537f450ab5c45a07a3323cbbdc2e4388d70b01940cf2acecea67faa3b36229 | |
| permissions: *read_permissions | |
| env: | |
| # Pre-set build number to avoid cache miss in container. | |
| # actions/cache doesn't work in Alpine containers (OS detection mismatch), | |
| # so get-build-number would generate a new number instead of reusing the one | |
| # from the get_build_number job. | |
| BUILD_NUMBER: ${{ needs.get_build_number.outputs.build-number }} | |
| steps: | |
| - *checkout | |
| - &alpine_install_deps | |
| name: Install dependencies | |
| run: apk add --no-cache bash curl util-linux | |
| - name: Create non-root user | |
| run: | | |
| # Elasticsearch refuses to run as root. Create a non-root user for the QA steps. | |
| # Use /github/home as home dir so Java's user.home matches where Maven cache lives. | |
| adduser -D -H -h /github/home -s /bin/bash sonar | |
| chown -R sonar:sonar "$GITHUB_WORKSPACE" | |
| chown -R sonar:sonar /github/home | |
| - &alpine_setup_maven | |
| name: Setup Maven | |
| uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1 | |
| with: | |
| version: 2026.7.12 | |
| cache_save: true | |
| mise_toml: | | |
| [tools] | |
| maven = "3.9" | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - *orchestrator_cache | |
| - name: Fix permissions for non-root user | |
| run: | | |
| # Ensure the sonar user can access all necessary directories after cache restores | |
| chown -R sonar:sonar "$GITHUB_WORKSPACE" | |
| chown -R sonar:sonar /github/home | |
| - name: Run Plugin QA without Node | |
| shell: bash | |
| run: | | |
| setpriv --reuid=sonar --regid=sonar --init-groups -- mvn package -f its/plugin/plugins/consumer-plugin/pom.xml -B | |
| setpriv --reuid=sonar --regid=sonar --init-groups -- mvn -f its/plugin/sonarlint-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| setpriv --reuid=sonar --regid=sonar --init-groups -- mvn -f its/plugin/tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| SONARJS_ARTIFACT: linux-x64-musl | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| plugin_qa_fast_without_node: | |
| runs-on: sonar-m | |
| name: Fast QA without Node on Ubuntu SQ:LATEST_RELEASE | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - *mise_java_only | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - *remove_node_from_path | |
| - uses: ./.github/actions/orchestrator-cache | |
| with: | |
| key-prefix: orchestrator-fast | |
| - name: Run Fast Plugin QA without Node | |
| run: | | |
| mvn package -f its/plugin/plugins/pom.xml --projects !org.sonarsource.javascript:eslint-custom-rules-plugin,!org.sonarsource.javascript:eslint-custom-rules-plugin-legacy | |
| mvn -f its/plugin/fast-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -Dtest=!EslintCustomRulesTest,!EslintCustomRulesLegacyTest -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| SONARJS_ARTIFACT: multi | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| # DEV tests run only on nightly schedule to avoid constant downloads | |
| plugin_qa_fast_without_node_dev: | |
| runs-on: sonar-m | |
| name: Fast QA without Node on Ubuntu SQ:DEV | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name == 'schedule' | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - *mise_java_only | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - *remove_node_from_path | |
| # No orchestrator cache for DEV - version changes too frequently | |
| - name: Run Fast Plugin QA without Node (DEV) | |
| run: | | |
| mvn package -f its/plugin/plugins/pom.xml --projects !org.sonarsource.javascript:eslint-custom-rules-plugin,!org.sonarsource.javascript:eslint-custom-rules-plugin-legacy | |
| mvn -f its/plugin/fast-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=DEV -Dtest=!EslintCustomRulesTest,!EslintCustomRulesLegacyTest -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| SONARJS_ARTIFACT: multi | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| plugin_qa_fast_without_node_alpine: | |
| runs-on: warp-custom-ubuntu-24-04 | |
| name: Fast QA without Node on Alpine SQ:LATEST_RELEASE | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name == 'schedule' | |
| container: | |
| image: alpine/java:22-jdk@sha256:f1537f450ab5c45a07a3323cbbdc2e4388d70b01940cf2acecea67faa3b36229 | |
| permissions: *read_permissions | |
| env: | |
| BUILD_NUMBER: ${{ needs.get_build_number.outputs.build-number }} | |
| steps: | |
| - *checkout | |
| - *alpine_install_deps | |
| - *alpine_setup_maven | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - uses: ./.github/actions/orchestrator-cache | |
| with: | |
| key-prefix: orchestrator-fast | |
| - name: Run Fast Plugin QA without Node | |
| shell: bash | |
| run: | | |
| mvn package -f its/plugin/plugins/pom.xml --projects !org.sonarsource.javascript:eslint-custom-rules-plugin,!org.sonarsource.javascript:eslint-custom-rules-plugin-legacy -B | |
| mvn -f its/plugin/fast-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -Dtest=!EslintCustomRulesTest,!EslintCustomRulesLegacyTest -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| SONARJS_ARTIFACT: linux-x64-musl | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| plugin_qa_win: | |
| runs-on: github-windows-latest-m | |
| name: QA on Windows (${{ matrix.group }}) | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| strategy: | |
| matrix: | |
| include: | |
| - group: 1 | |
| exclude: false | |
| - group: 2 | |
| exclude: true | |
| steps: | |
| - *checkout | |
| - *mise | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - *orchestrator_cache | |
| - name: Run Plugin QA on Windows | |
| shell: bash | |
| run: | | |
| # Tests for group 1 (group 2 runs everything else) | |
| GROUP1_TESTS="CoverageTest,CssMetricsTest,MetricsTest,MinifiedFilesTest" | |
| if [ "${{ matrix.exclude }}" == "true" ]; then | |
| # Convert to exclusion pattern: add ! prefix to each test | |
| TEST_PATTERN=$(echo "$GROUP1_TESTS" | sed 's/,/,!/g' | sed 's/^/!/') | |
| else | |
| TEST_PATTERN="$GROUP1_TESTS" | |
| fi | |
| mvn package -f its/plugin/plugins/consumer-plugin/pom.xml | |
| mvn -f its/plugin/tests/pom.xml -DskipTests=false -Dtest="$TEST_PATTERN" -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| plugin_qa_sonarlint_win: | |
| runs-on: github-windows-latest-m | |
| name: QA SonarLint on Windows | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - *mise | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - name: Run Plugin QA on Windows | |
| shell: bash | |
| run: | | |
| mvn -f its/plugin/sonarlint-tests/pom.xml -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| plugin_qa_win_fast_with_node: | |
| runs-on: github-windows-latest-m | |
| name: Fast QA on Windows with Node (${{ matrix.group }}) | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| strategy: | |
| matrix: | |
| include: | |
| - group: 1 | |
| exclude: false | |
| - group: 2 | |
| exclude: true | |
| steps: | |
| - *checkout | |
| - *mise | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - uses: ./.github/actions/orchestrator-cache | |
| with: | |
| key-prefix: orchestrator-fast | |
| - name: Run Fast Plugin QA on Windows | |
| shell: bash | |
| run: | | |
| # Tests for group 1 (group 2 runs everything else) | |
| GROUP1_TESTS="ConsumerPluginTest,CssIssuesTest,CssNoCssFileProjectTest,CssNonStandardPathTest,CssStylelintReportTest,ECMAScriptModulesTest,EmbeddedNodeTest,EslintBasedRulesTest,EslintCustomRulesLegacyTest,EslintCustomRulesTest,EslintReportTest,ExternalTSConfigDependencyTest" | |
| if [ "${{ matrix.exclude }}" == "true" ]; then | |
| # Convert to exclusion pattern: add ! prefix to each test | |
| TEST_PATTERN=$(echo "$GROUP1_TESTS" | sed 's/,/,!/g' | sed 's/^/!/') | |
| else | |
| TEST_PATTERN="$GROUP1_TESTS" | |
| fi | |
| mvn package -f its/plugin/plugins/pom.xml | |
| mvn -f its/plugin/fast-tests/pom.xml -DskipTests=false -Dtest="$TEST_PATTERN" -Dsonar.runtimeVersion=LATEST_RELEASE -B -e -V verify surefire-report:report | |
| env: | |
| SONARSOURCE_QA: true | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| js_ts_ruling: | |
| runs-on: sonar-xl | |
| name: JS/TS Ruling | |
| needs: [setup, populate_npm_cache, prepare_rspec_rule_data] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - &checkout_with_submodules | |
| name: Checkout source code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| - *mise | |
| - *npm_cache | |
| - *download_rspec_rule_data | |
| - name: Run JS/TS Ruling | |
| id: ruling | |
| run: | | |
| npm run generate-meta | |
| npm run grpc:generate-proto | |
| npm run ruling | |
| - name: Update ruling and notify | |
| if: always() && (github.event_name == 'pull_request' || github.ref_name == github.event.repository.default_branch) | |
| uses: ./.github/actions/ruling_bot | |
| with: | |
| github-token: ${{ github.token }} | |
| pr-number: ${{ github.event.pull_request.number || '' }} | |
| target-ref: ${{ github.head_ref || github.ref_name }} | |
| base-ref: ${{ github.base_ref || github.event.repository.default_branch }} | |
| base-sha: ${{ github.event.pull_request.base.sha || '' }} | |
| is-pull-request: ${{ github.event_name == 'pull_request' }} | |
| ruling-failed: ${{ steps.ruling.outcome == 'failure' }} | |
| new-results-path: packages/ruling/actual | |
| old-results-path: its/ruling/src/test/expected | |
| sources-path: its/sources | |
| sources-repo-url: https://github.com/SonarSource/jsts-test-sources/blob/master | |
| rspec-base-url: https://musical-adventure-r9qk65j.pages.github.io/rspec/# | |
| ruling: | |
| runs-on: sonar-xl | |
| name: Ruling Test | |
| needs: [setup, get_build_number, build] | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout_with_submodules | |
| - *mise | |
| - *maven_cache | |
| - *download_sonarjs_m2 | |
| - *config_maven | |
| - *get_licenses_token | |
| - uses: ./.github/actions/orchestrator-cache | |
| with: | |
| save: 'false' | |
| - name: Run Ruling Tests | |
| run: | | |
| cd its/ruling | |
| # Cap ruling parallelism explicitly: using all CPUs on sonar-xl can | |
| # overwhelm the shared SonarQube/Node workload and make the runner drop. | |
| mvn test -Dtest=RulingTest -DskipTests=false -Dsonar.runtimeVersion=LATEST_RELEASE -Dmaven.test.redirectTestOutputToFile=false -Djunit.jupiter.execution.parallel.config.strategy=fixed -Djunit.jupiter.execution.parallel.config.fixed.parallelism=8 -B -e -V | |
| env: | |
| SONARSOURCE_QA: true | |
| GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).licenses_token }} | |
| - name: Upload ruling differences | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ruling-differences | |
| path: its/ruling/target/actual/ | |
| # IRIS tasks (nightly only) | |
| run_iris: | |
| runs-on: sonar-xs | |
| name: IRIS SQ NEXT -> ${{ matrix.shadow-name }} | |
| needs: [analyze_primary, analyze_shadows] | |
| if: github.event_name == 'schedule' | |
| permissions: | |
| id-token: write | |
| contents: read | |
| strategy: | |
| matrix: | |
| include: | |
| - shadow-name: SonarCloud EU | |
| shadow-platform: SQC-EU | |
| - shadow-name: SonarQube US | |
| shadow-platform: SQC-US | |
| steps: | |
| - uses: SonarSource/unified-dogfooding-actions/run-iris@v1 | |
| with: | |
| primary_project_key: org.sonarsource.javascript:javascript | |
| primary_platform: Next | |
| shadow1_project_key: SonarSource_SonarJS | |
| shadow1_platform: ${{ matrix.shadow-platform }} | |
| promote: | |
| runs-on: sonar-xs | |
| needs: | |
| - get_build_number | |
| - build | |
| - build_win | |
| - test_js | |
| - test_js_win | |
| - analyze_primary | |
| - test_eslint_plugin | |
| - plugin_qa_with_node | |
| - plugin_qa_without_node | |
| - plugin_qa_fast_with_node | |
| - plugin_qa_fast_without_node | |
| - plugin_qa_without_node_alpine | |
| - plugin_qa_fast_without_node_alpine | |
| - plugin_qa_win | |
| - plugin_qa_sonarlint_win | |
| - plugin_qa_win_fast_with_node | |
| - ruling | |
| - js_ts_ruling | |
| if: >- | |
| !failure() && !cancelled() && | |
| (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) | |
| permissions: *read_permissions | |
| env: *shared_build_number | |
| steps: | |
| - *checkout | |
| - name: Reject root rspec.sha | |
| if: >- | |
| (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'master') || | |
| (github.event_name == 'merge_group' && github.event.merge_group.base_ref == 'refs/heads/master') | |
| run: | | |
| if [ -e rspec.sha ]; then | |
| echo "::error file=rspec.sha::Root rspec.sha must be removed before merging to master" | |
| exit 1 | |
| fi | |
| - *mise | |
| - uses: SonarSource/ci-github-actions/promote@v1 | |
| with: | |
| promote-pull-request: true | |
| releasability: | |
| runs-on: sonar-xs | |
| name: Releasability | |
| needs: | |
| - promote | |
| if: >- | |
| !failure() && !cancelled() && | |
| needs.promote.result == 'success' && | |
| ( | |
| github.ref_name == github.event.repository.default_branch || | |
| startsWith(github.ref_name, 'branch-') || | |
| startsWith(github.ref_name, 'dogfood-') | |
| ) | |
| permissions: | |
| id-token: write | |
| statuses: write | |
| contents: read | |
| steps: | |
| - uses: SonarSource/gh-action_releasability/releasability-status@v3 | |
| with: | |
| optional_checks: "Jira" | |
| env: | |
| GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}' |